A cat on a windowsill helped Ukrainian cyber experts expose a hacker from the DarkNet
Ukrainian cyber threat intelligence specialists from FS GROUP told how they use stylistic cues and photos from social networks to expose hackers and scammers.
Ukrainian cyber threat intelligence specialists from FS GROUP told how they use stylistic cues and photos from social networks to expose hackers and scammers.
A leading threat intelligence analyst at FS GROUP, Yevgeny, spoke about unexpected methods for de-identifying criminals in a material from the Ministry of Digital Transformation.
How an Odessa cat helped the FBI
Cyber threat intelligence is the process of gathering thousands of disparate digital fragments to expose individuals who are trying to be invisible. Often, an attacker is given away by a detail they didn’t even consider evidence: an old nickname, a favorite password, or a photo.
This is how Ukrainian analysts identified a member of a top hacker group (probably ZeuS) hiding in Italy. The crucial clue was his WhatsApp avatar.
“The picture was just a cat sitting on a windowsill. But from the landscape in the background, we established that the photo was taken in Odessa, identified the exact floor and his family’s apartment. Soon the guy was detained by the FBI and extradited to the USA,” recalls Yevhen.
Stylometry: when a space gives a person away
Even if a criminal has been using encrypted messengers for years, each of his actions creates a unique digital portrait. One of the main methods of analysts is stylometry (writing style analysis). Experts pay attention to how a person builds sentences, where they put punctuation marks, whether they put a space before a comma, and even whether they use the Tab key instead of several spaces in a row.
"We semantically parse correspondence. Such contrasting markers make it possible to attach to a person even in the deepest DarkNet," the analyst explains.
Additionally, digital identifiers are scanned: if a hacker uses the same nickname for a long time on different platforms, his activity can easily be collected into a single profile, which often leads to a real name. Cryptocurrency does not save either. According to the expert, the money paid as a ransom immediately receives the label "Ransomware". Even if they are crushed through mixers, transfers on open blockchains leave a clear trace.
"Cryptocurrency does not provide complete anonymity. The money paid for stolen data immediately becomes "dirty" and receives the Ransomware label. No matter where they surface and no matter how they are crushed through mixers, they will have a clear trace - where they came from and where they ended up," said Yevhen.
DarkNet as a service ecosystem
After the rise of ransomware groups (Conti, TrickBot, LockBit) in 2020–2021 and a series of high-profile police raids, the shadow market has changed. Hackers no longer need to perform the entire attack cycle themselves — the processes are divided into narrow specializations. Some look for vulnerabilities, others sell access, and still others launder money.
"DarkNet is like a supermarket. There are offers for every taste: from brokers selling access to corporate networks to zero-day vulnerabilities for $200,000-300,000," the specialist says.
In 2022, the American Qintel acquired the Ukrainian company FS GROUP. Now the domestic team works with the Platform Blue cyber intelligence platform, which is used by law enforcement, the military and governments of various countries. Although Ukrainian analysts do not detain hackers personally, they collect evidence, which is transferred to foreign partners (such as the FBI) exclusively through the competent state bodies of Ukraine. Due to the high risk of retaliation from cybercriminals, the names of specialists and most of the technical details of the company are strictly classified.
Ukrainian hackers claim to have obtained documentation on 70 Russian Navy projects, including submarines, robotics, and GPS-free navigation
Ukrainian hackers claim to have obtained documentation on 70 Russian Navy projects, including submarines, robotics, and GPS-free navigation
In Switzerland, a Ukrainian hacker was sentenced to almost 13 years in prison for cyberattacks worth millions of dollars
In Switzerland, a Ukrainian hacker was sentenced to almost 13 years in prison for cyberattacks worth millions of dollars
Russian hackers used a "nuclear prompt" to block AI analysis during a cyberattack in Ukraine
Russian hackers used a "nuclear prompt" to block AI analysis during a cyberattack in Ukraine
Read the country's main IT news in our Telegram
Read the country's main IT news in our Telegram
Вступление я прочитал, а сама статья то где? Про кота хотя бы.