Anonymity is a valuable commodity in cyber-criminal spheres. To evade law enforcement and security analysts, threat actors routinely rotate their handles and open new storefronts. They move discussions between encrypted chat rooms, darknet forums, and illicit marketplaces. It is all in an attempt to avoid detection.
Chasing isolated handles or individual forum posts creates a fragmented picture of risk that can confuse analysts and delay incident response. For example, a known handle advertising stolen corporate credentials on one forum might belong to the same threat actor selling network access on a password-protected marketplace – under a completely different alias.
Threat actor profiling is the primary tool security teams utilize to overcome these sorts of issues. DarkOwl links its value to an ability to help security teams look past temporary handles to connect disparate operating signals and build effective strategies around known adversary identities.
Darknet Identities Are Elusive by Nature
Online handles and storefronts are disposable assets to threat actors. So, when an underground marketplace is seized or a forum undergoes a moderator dispute, threat actors simply relocate. Handles are easily changed, but underlying human habits are much harder to erase. Therein lies the power of threat actor profiling.
Also known as threat actor tracking, the practice takes advantage of the fact that cyber criminals consistently leave subtle digital fingerprints as they move across platforms. Here are four key examples:
- PGP Key Reuse – In order to establish trust with buyers, threat actors frequently reuse public PGP encryption keys across multiple platforms.
- Crypto Wallet Addresses – Threat actors are big on cryptocurrency to handle financial transactions. Unfortunately for them, transaction histories and deposit addresses often link seemingly unrelated marketplace accounts.
- Stylometric Patterns – Writing styles don’t change across platforms. Like everyone else, cyber criminals are recognized by their phrasing, technical vocabulary, and contact preferences. Such things usually remain consistent as they travel the dark web.
- Operational Tactics – Threat actors also have a tendency to demonstrate preferred operational tactics. They have their favorite malware strains and target choices. They lean on specific initial access methods that create distinct behavioral patterns.
Isolated manual checks capture only single snapshots in time. Meanwhile, advanced threat actor profiling correlates recurring indicators across years of darknet data. Diligent tracking can reveal a single entity operating behind multiple online personas.
3 Strategic Reasons to Profile Threat Actors
If you are a CISO or risk manager new to the idea of threat actor profiling, there are very good reasons to implement the practice. Here are just three of them:
1. A Reactive Posture Becomes Proactive Defense
A security team limited to only reacting to individual credential leaks or software vulnerabilities remains perpetually on defense. Mapping an adversary’s full profile reveals things like motivations and preferred attack vectors. This kind of information allows security teams to be proactive. They do not have to wait for something to happen.
2. High-Risk Threat Actors Are Prioritized
Some threat actors need to be taken more seriously than others. Comprehensive threat actor tracking helps analysts differentiate between script kiddies, amateurs, and serious actors capable of doing real damage.
3. Incident Investigation and Attribution Improve
Investigations and attribution follow every incident. When analysts have profile data to work with, their investigations can take them to places they otherwise would not go. Creating links between incidents then makes it easier to attribute the current incident to the right individual or group.
Threat actor profiling seems so fundamental at a time when threats are only increasing. SOCs and corporate security teams making use of the practice can stay a step ahead of their adversaries. That’s the way it should be.
