Full Report
Group-IB dark web investigations: To avoid prying eyes, find out how adversaries increasingly shift from the dark web to social media to execute attacks, leak credentials, share exploitable vulnerabilities, and more.
Analysis Summary
# Tool/Technique: Adversarial Shift to Social Media (Social Media-Based Cybercrime)
## Overview
This technique involves threat actors transitioning their primary operations—including communication, malware distribution, and data leaking—from the traditional dark web (Tor-based forums) to mainstream social media platforms and instant messaging applications. This shift allows for greater accessibility, speed, and a wider pool of potential victims and recruits.
## Technical Details
- **Type**: Technique / Operational Shift
- **Platform**: Web, Mobile (iOS/Android), Windows, macOS
- **Capabilities**: Credential leaking, malware distribution, vulnerability sharing, recruitment, and Command & Control (C2) coordination.
- **First Seen**: Increasing trend noted significantly from 2022–2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566 - Phishing]**: Using social media messages to deliver malicious links or files.
- **[TA0011 - Command and Control]**
- **[T1102 - Web Service]**: Utilizing social media platforms (e.g., Telegram, Discord) for C2 communication.
- **[TA0010 - Exfiltration]**
- **[T1567 - Exfiltration Over Web Service]**: Leaking stolen data via social media channels or private groups.
- **[TA0042 - Resource Development]**
- **[T1585 - Establish Accounts]**: Creating burner or fake profiles to engage with victims or peers.
## Functionality
### Core Capabilities
- **Information Leaking**: Instant dissemination of stolen credentials, databases, and sensitive corporate information.
- **Exploit Sharing**: Rapid exchange of exploitable vulnerabilities (N-days and 0-days) and Proof-of-Concept (PoC) code.
- **Communication & Recruitment**: Streamlined networking for "Cybercrime-as-a-Service" and recruitment of low-level affiliates.
### Advanced Features
- **Automated Bot Integration**: Use of Telegram bots for automated sales of stolen logs (infostealer data) and checking account validity.
- **Anonymity Layering**: Leveraging the encryption and "disappearing message" features of modern social platforms to evade law enforcement.
- **Mobile Targeting**: Direct exploitation of mobile users who are more likely to click links within social media apps.
## Indicators of Compromise
- **File Names**: Often masquerade as legitimate documents or media files (e.g., `invoice_pdf.exe`, `leak_data.zip`).
- **Network Indicators**:
- `t[.]me` (Telegram links for data exfiltration/communication)
- `discord[.]com/api/webhooks/` (Used for exfiltrating stolen data)
- **Behavioral Indicators**:
- High frequency of encrypted traffic to social media domains from server environments.
- Unusual API calls to social media platforms originating from non-user-facing applications.
## Associated Threat Actors
- **Infostealer Operators**: (e.g., groups using RedLine, Raccoon, or Lumma Stealer).
- **Initial Access Brokers (IABs)**: Who sell corporate access via Telegram/Discord.
- **Hacktivist Groups**: Who use social media for publicity and leak announcements.
## Detection Methods
- **Behavioral Detection**: Monitoring for "living off the land" techniques where scripts (PowerShell/Python) interact with social media APIs (e.g., Telegram Bot API).
- **Network Monitoring**: Identifying anomalous volumes of data being sent to social media domains, particularly from sensitive internal segments.
- **Digital Risk Protection (DRP)**: Automated scraping and monitoring of social media channels for brand mentions, leaked credentials, or executive impersonation.
## Mitigation Strategies
- **Prevention Measures**: Implement robust Mobile Device Management (MDM) to secure corporate applications on smartphones.
- **Hardening Recommendations**: Restrict access to social media and instant messaging platforms on critical infrastructure and administrative workstations.
- **Threat Intelligence**: Subscribe to intelligence feeds that monitor the "Deep Web" and social media for unauthorized brand mentions or leaked data.
- **Employee Training**: Targeted social engineering awareness regarding messages received on platforms like LinkedIn, Telegram, and Facebook.
## Related Tools/Techniques
- **Infostealers**: Often the primary source of the data leaked on these platforms.
- **Phishing-as-a-Service (PhaaS)**: Frequently marketed and managed through social media telegram channels.
- **Telegram C2**: The specific use of the Telegram API to manage malware infections.