Darknet Intelligence Use Cases for Law Enforcement and Government Agencies
Summary
DarkOwl describes how its darknet data platform can support investigations, situational awareness, counterterrorism, counternarcotics, and monitoring of espionage, extremism, and critical infrastructure threats.
Key points
- The article presents darknet data as a way to connect online identities and aliases with other open-source information during investigations.
- DarkOwl says it detected discussions of sensitive Ukrainian data leaks before Russia’s invasion and describes monitoring darknet and Telegram activity for geopolitical awareness.
- It cites investigations involving alleged terrorist planning, illicit drug vendors, and doxxing of members of the Conti/Ryuk ransomware group.
- The article says the platform can monitor threats to critical infrastructure, including claimed targeting of water and energy systems.
- DarkOwl describes its platform as automatically collecting, indexing, and ranking darknet, deep-web, and high-risk surface-web data, with near-real-time storage.
Article Details
- Topic
- Use cases for darknet data in law enforcement and intelligence, including cyber investigations, situational awareness, counterterrorism, counternarcotics, targeting, cyber espionage, domestic extremism, and critical infrastructure protection.
Threat Actors
ContiIdentified as a Russia-aligned ransomware group whose members were doxxed after the invasion of Ukraine.Jerusalem Electronic ArmyDescribed as an offensive cyber group targeting agricultural water and heating systems with ICS/SCADA-based attacks.Oath KeepersIdentified as an alt-right paramilitary group whose members were involved in the insurrection against the US Capitol.Proud BoysIdentified as an alt-right paramilitary group whose members were involved in the insurrection against the US Capitol.RyukNamed alongside Conti as a Russia-aligned ransomware group whose members were doxxed after the invasion of Ukraine.Team AESA Telegram channel associated with the group declared successful campaigns to penetrate Israel’s solar energy systems.Team MajhidoonA Telegram channel associated with the group declared successful campaigns to penetrate Israel’s solar energy systems.
Malware
Vendors
Products
Countries
Brazilcommunities in the darknet and a leaked IP address provided a potential physical location of João Pessoa, Brazil.IsraelFor example, DarkOwl uncovered documents related to an anti-Israel terrorist group located in Palestine discussing how they and members of Hamas were planning to target military personnel from the Israeli Defense ForcePalestineFor example, DarkOwl uncovered documents related to an anti-Israel terrorist group located in Palestine discussing how they and members of Hamas were planning to target military personnel from the Israeli Defense ForceRussiaRussia’s late February military invasion of Ukraine and on-going offensive operation was preceded by numerous opportunities for geopolitical situational awareness prior to the invasion, and subsequent monitoring of theUkraineRussia’s late February military invasion of Ukraine and on-going offensive operation was preceded by numerous opportunities for geopolitical situational awareness prior to the invasion, and subsequent monitoring of theUnited States2022-06-13T19:03:17 user_1959717279 DomBaryay Barya Domansky wrote: Zelensky speaks beautifully, so they put him in the presidential post, pouring everything that the United States considers true
Industries
EnergyAlso included was data from critical infrastructure suppliers of energy, water, and transportation, which can be utilized for future cyber espionage purposes.GovernmentIn this blog, DarkOwl analysts outline top use cases for intelligence agencies, law enforcement, and government, where darknet data often plays a critical role.ResearchMinistry of Finance, Ministry of Foreign Affairs, etc.; academic and research institutions, such as, the Joint Institute of Nuclear Research (JINR) and the Russian Federal Institute of Science, were among the groupsTransportationAlso included was data from critical infrastructure suppliers of energy, water, and transportation, which can be utilized for future cyber espionage purposes.waterAlso included was data from critical infrastructure suppliers of energy, water, and transportation, which can be utilized for future cyber espionage purposes.