AI Analysis of StarFraud Telegram Chat Examines Fraud Topics and User Activity

Summary

DarkOwl used ChatGPT to analyze StarFraud Chat messages from August 2022 to February 2024, describing fraud-related discussions and user activity while noting limits in the analysis. Researchers have attributed the group to Scattered Spider.

Key points

DarkOwl analyzed a Telegram chat dataset spanning August 2022 to February 2024, containing 56,210 rows and 42 columns.
The analysis found discussions about financial and personal information, account-resetting services, social engineering, and account requests.
It identified active users, message reactions, reply patterns, and a peak of 3,973 messages at 1 AM; the timestamp data did not establish users’ time zones.
The article says security researchers have attributed StarFraud Chat to Scattered Spider; the analysis itself does not establish that attribution.
DarkOwl cautioned that usernames can change and that the AI analysis depended on specific questions; it also found location mentions too generic to be very useful.

Article Details

Topic: AI-assisted analysis of activity, users, interactions, and discussion themes in the StarFraud Chat Telegram channel.

Threat Actors

Scattered SpiderSecurity researchers are reported to have attributed the Star Fraud Chat group to Scattered Spider.The ComThe article reports that the group associated with Star Fraud Chat describes itself as “the Com” and is reported to conduct cyberattacks, cyberbullying, and swatting.

Products

TelegramIncreasingly, Telegram channels have been used by threat actors to communicate, sell illicit goods, share disinformation, and support a range of illicit activity.

Tools

ChatGPTChatGPT was then used to analyze the CSV file, with specific questions being asked to identify what information could be gleaned.