Full Report
Cybersecurity analyst's guide on how to use machine learning to show cybercriminals' true colors
Analysis Summary
Based on the provided article, here is the summary of the techniques and threat actors discussed.
# Tool/Technique: Semantic and Behavioral ML Analysis of Underground Forums
## Overview
This technique involves the use of Machine Learning (ML), specifically semantic analysis and behavioral pattern mapping, to identify links between disparate underground forum accounts. The purpose is to uncover the "true colors" of cybercriminals by deanonymizing threat actors who operate under multiple aliases or across different dark web platforms.
## Technical Details
- **Type:** Investigative Technique (Attribution/Intelligence)
- **Platform:** Underground forums, Dark Web, Messaging platforms (Telegram)
- **Capabilities:** Semantic message matching, contact detail correlation, and activity pattern analysis.
- **First Seen:** N/A (ML methods applied to historical data, specifically targeting actors active since approximately 2020).
## MITRE ATT&CK Mapping
- **[TA0043 - Reconnaissance]**
- **[T1589 - Gather Victim Identity Information]** (Used by analysts to gather info on actors)
- **[T1593 - Search Open Technical Databases]**
- **[TA0042 - Resource Development]**
- **[T1585 - Establish Accounts]** (Targeted behavior: criminals creating multiple personas)
## Functionality
### Core Capabilities
- **Semantic Analysis:** Uses ML to find messages that are linguistically similar or semantically close, even if the phrasing differs, to link different accounts to a single author.
- **Contact Detail Correlation:** Automatically extracts and links indicators such as emails, Jabber IDs, and Telegram handles (e.g., linking *ShinyHunters* to *fs0c131y* via shared contact info).
- **Relational Mapping:** Visualizes links between accounts to build a comprehensive view of a threat group’s infrastructure.
### Advanced Features
- **Behavioral Pattern Analysis:** Identifying correlation based on posting times, sub-forum preferences, and specific jargon unique to a threat actor.
- **Automated Deanonymization:** Reducing the "suspect list" by filtering common administrative phrases to focus on unique actor-generated content.
## Indicators of Compromise (Associated Identifiers)
*Note: These are identifiers for the threat actors mentioned in the investigative study, not file-based IOCs.*
- **Actor Handles:**
- ShinyHunters
- fs0c131y (aka whysodankk, whysodank)
- J4ckd0x
- Megadimarus
- Databases
- Troy Hunt (aka Jnx3cx - *Note: This is a fraudulent use of a researcher's name by an actor*)
- ExpertData
- **Network Indicators:**
- [h]xxps://group-ib[.]com/blog/cybercrime-fighters-club/ (Defanged Source)
## Associated Threat Actors
- **ShinyHunters:** A high-profile data breach group known for targeting large corporations and selling databases on underground forums (e.g., RaidForums, Empire).
## Detection Methods
- **Behavioral Detection:** Identifying accounts that exhibit identical semantic signatures or post identical data samples under different aliases.
- **Metadata Analysis:** Tracking the reuse of specific PGP keys or cryptocurrency wallet addresses across forum profiles.
## Mitigation Strategies
- **Threat Intelligence Integration:** Utilizing automated ML tools to monitor underground forums for mentions of corporate assets or leaked credentials.
- **Identity Monitoring:** Tracking the evolution of threat actor aliases to stay ahead of new campaigns launched by rebranded groups.
## Related Tools/Techniques
- **Natural Language Processing (NLP):** Used for the semantic comparison of forum posts.
- **Graph Database Analysis:** Used to visualize the connections between the various aliases identified in the report.
- **Stylometry:** The study of linguistic style for the purpose of attribution.