\u2018authentic\u2019 and not-so-legitimate enterprise pursuits<\/a> that risk actors are discussing on prison boards, we\u2019ve arrived on the concluding chapter of our collection. Right here, we\u2019ll talk about the implications and alternatives that these actions current.<\/p>\nAs we\u2019ve famous all through this collection, risk actors diversifying into different industries and prison actions can have troubling penalties. It might make disrupting these risk actors tougher, notably in the case of seizing property, and may make investigations \u2013 \u2018following the cash\u2019 \u2013 extra complicated. Furthermore, it may well enhance risk actors\u2019 wealth, energy, and affect, which once more can complicate investigations. And it implies that their crimes can have an effect on extra victims, straight or not directly.<\/p>\n
Within the cybersecurity trade, we generally deal with cybercrime as being in a silo \u2013 to think about it a definite, specialist, and remoted exercise, restricted to the digital world of networks and hosts. Not unreasonably, our efforts are usually targeted on the \u2018cyber kill chain\u2019; typical risk intelligence; and bolstering protections, safety consciousness, and different preventative measures. And within the wake of assaults, our consideration often goes to the victims \u2013 whether or not these are organizations coping with incidents, or people who’ve been scammed.<\/p>\n
In the meantime, the perpetrators slip again into the shadows, and we don\u2019t sometimes take into consideration what they do as soon as an assault is over, or the place the cash goes. This query has not traditionally been prioritized by safety researchers.<\/p>\n
However maybe we should always spend extra time trying into how cybercriminals are utilizing and investing their income. Doing so can result in extra investigative and intelligence alternatives round attribution, motivation, connections, and extra.<\/p>\n
Furthermore, among the actions we\u2019ve uncovered on this collection strongly counsel that we should always not put risk actors on any form of pedestal. They aren’t simply cybercriminals \u2013 they’re criminals, full cease. They shouldn’t be glorified, or celebrated, or portrayed as something besides what they’re: individuals who earn cash on the expense of victims. Our investigation means that no less than some risk actors are engaged in exploitative, dangerous, and unlawful actions, each on-line and in the actual world, from which they’re actively profiting.<\/p>\n
Proactive intelligence-gathering and investigation on the boundaries of authentic and illegitimate earnings, and of cybercrime and real-world crime\/enterprise, might assist hit risk actors the place it actually hurts \u2013 their cash. Whereas we don\u2019t declare that this is able to be simple to perform, the knowledge we\u2019ve shared on this collection might be a helpful first step in laying the foundations for future efforts and analysis on this vein.<\/p>\n
Attribution and investigative avenues<\/h2>\n
As proven in our earlier articles, the schemes and programs which risk actors define intimately on prison boards \u2013 generally accompanied by screenshots, images, and particular biographical info \u2013 can present investigative and attribution alternatives which have beforehand been underexplored. These might be notably helpful on prison boards, the place individuals are sometimes nameless.<\/p>\n
For example, through the course of our investigation, we famous risk actors revealing the next info of their discussions of \u2018authorized enterprise\u2019:<\/p>\n
\n- References to the areas (nations\/areas\/cities) in they reside and\/or function<\/li>\n
- Different biographical info, together with age, marital standing, and whether or not they had youngsters<\/li>\n
- Unredacted or partially redacted screenshots revealing profile photos, names, addresses, and reference numbers<\/li>\n
- Images of areas, which might probably be recognized by way of open-source investigation<\/li>\n
- References to particular quantities of cash and purchases, generally accompanied by dates and instances<\/li>\n
- References to earlier convictions, which might be used for doable identification<\/li>\n
- Detailed discussions of authorized or unlawful schemes and actions<\/li>\n
- Particulars of recommendation obtained from attorneys, accountants, and associates.<\/li>\n<\/ul>\n
Understanding thine enemy<\/h2>\n
Our investigation additionally demonstrates the breadth and depth of data that risk actors possess about numerous industries, loopholes, laws, investigative methods, and laws in numerous territories and nations \u2013 in addition to what they find out about cash laundering and legitimizing methods. All of this could present investigators with helpful details about what risk actors know and what they don\u2019t, which might help to tell future operations. It additionally supplies a broader view of the risk panorama, and the way the cyber model of that panorama interacts and overlaps with risk landscapes in different prison domains \u2013 leading to a richer strategic intelligence image.<\/p>\n
Alternatives for collaboration<\/h2>\n
We hope that our analysis might encourage better collaboration between the cybersecurity trade, regulation enforcement, and regulators, as a result of it may well assist hyperlink the incidents we take care of and reply to day-after-day, to the real-world offenses, property, and companies which regulation enforcement and regulators have the power, and mandate, to analyze. Once more, we don\u2019t declare that our analysis will remedy this drawback, however we expect it might present some helpful widespread floor to encourage collaboration and information-sharing.<\/p>\n
The proof we uncovered \u2013 of hyperlinks between carders and drug sellers; risk actors and numerous industries and sectors; and risk actors and real-world prison exercise \u2013 signifies that we might probably hyperlink some cybercriminals to the circulation of the ensuing funds into wider economies, whether or not prison or authentic. Whereas this is able to require openness, willingness, and cautious administration, we propose that extra might and ought to be finished to analyze, monitor, and disrupt risk actors utilizing the form of info we\u2019ve mentioned.<\/p>\n
Some preliminary sensible strategies:<\/p>\n