Darknet Intelligence Analyst Explains How Investigators Use Darknet Data
Summary
A DarkOwl analyst describes darknet platforms and criminal activity, and explains how investigators can connect usernames, cryptocurrency wallets and other OSINT to examine cybercrime.
Key points
- The speaker describes Tor as a common way to access the darknet, alongside I2P and other networks, and notes that criminals also use messaging platforms such as Telegram.
- He says darknet data can complement other OSINT sources, including by linking usernames found on social media, forums and other services.
- Investigators can use cryptocurrency wallet addresses found in darknet material to search for related activity on other platforms, according to the speaker.
- The analyst says much of the criminal content he encounters involves hacking-related material, fraud, stolen data, credentials and counterfeit documents.
- He describes an example of a darknet post containing a threat against public officials and a Bitcoin wallet address, which investigators could use to pursue related leads; he says he was unsure how serious the threat was.
- The speaker says that when a marketplace returns after a law-enforcement seizure, some in the industry suspect it may have been co-opted for surveillance; this is presented as an assessment, not a confirmed fact.
Article Details
- Topic
- Darknet history, access methods, criminal activity, and the use of darknet intelligence in cybercrime investigations
People
Dr. Sherif AlyIntroduced Richard Hancock during the American University of Cairo session.Michael BasilAuthor of a book on open-source intelligence search techniques, recommended during the presentation.Richard HancockDarknet Intelligence Analyst and Sales Engineering Team Lead at DarkOwl; presented on darknet intelligence and cybercrime investigations.Ross UlbrichtIdentified in the article as the founder of the Silk Road marketplace.
Threat Actors
Vendors
Products
AlphaBay MarketThis specific screenshot is showing AlphaBay Market, which is a really popular market that had temporarily gone offline after a law enforcement seizure, and then did come back online in 2021.BitcoinSo, going into this a little bit further, Bitcoin was created in 2009, and that’s what really facilitated the emergence of the marketplaces and forums, because it allowed people to buy things and make transactions.CoinbaseAny company that has a large mobile application user base, eo whether that’s Coinbase, Netflix and those kind of companies are going to be targeted for fraud the most on the darknet.DashThese 6 cryptocurrencies that are most used are: Bitcoin, Monero, ethereum, Zcash, Dash, and litecoin.EthereumThese 6 cryptocurrencies that are most used are: Bitcoin, Monero, ethereum, Zcash, Dash, and litecoin.FreenetThe one I primarily use is gonna always be Tor but also ZeroNet and FreeNet.I2Pi2p is also popular and same as Zeronet.litecoinThese 6 cryptocurrencies that are most used are: Bitcoin, Monero, ethereum, Zcash, Dash, and litecoin.MoneroThese 6 cryptocurrencies that are most used are: Bitcoin, Monero, ethereum, Zcash, Dash, and litecoin.NetflixIt could be Netflix. It could be social media.Pizza Hut10 years ago, trying to take money from their parents purse, they’ll actually try to steal somebody’s Pizza Hut account on Telegram and get free pizza for the night.RaidForumsthese 3 usernames, I should say we were able to find this individual’s presence on darknet forums like RaidForums.Silk RoadThe first really big marketplace was the Silk Road.TelegramAn app that we’re seeing is really on the rise right now is Telegram.TorHave you ever heard of The Onion Router (TOR) ?UberEatsWell, I can tell you that most of the fraud of those companies I just mentioned, UberEats and Netflix, etc – that type of fraud is usually perpetrated by teenagers, and it’s quite often these days when their parentsZcashThese 6 cryptocurrencies that are most used are: Bitcoin, Monero, ethereum, Zcash, Dash, and litecoin.ZeroNeti2p is also popular and same as Zeronet.
Tools
Countries
IndiaThis specific example looks like spoof calling in India.IranIt was originally used as a way for agents to communicate with each other in the field, so primarily in places like Iran or Russia.IsraelAnd this is issuing out a target for a water sanitation facility in Israel.JordanI spent 4 years living in Amman, Jordan and Abu Dhabi as well.RussiaWhether it’s right wing extremism, Islamic extremism activities, Russia Ukraine and the invasion, misinformation, and people selling Netflix accounts, etc.UkraineWhether it’s right wing extremism, Islamic extremism activities, Russia Ukraine and the invasion, misinformation, and people selling Netflix accounts, etc.United StatesThe Tor browser was created by the Naval Intelligence Unit in the CIA in the United States, back in 2002.