KEYNOTE From Breach to Bust

### Keynote: Tracing Adversaries From Breach to Bust At 00:00, Andrew Macpherson (Andrew Mohawk) delivers the DEF CON 26 Recon Village Keynote, presenting advanced entity-relationship graph analysis techniques for tracing cybercriminals from initial corporate data breaches to real-world attribution.

### Ingesting and Structuring Compromised Data At 07:00, Macpherson explores the processing of unstructured breach datasets. Corporate leaks, underground forum dumps, and stolen credential collections contain millions of disparate data points—including email addresses, IP logs, usernames, and cryptocurrency addresses—that must be normalized for automated analysis.

### Visual Layouts and Relational Graph Models At 14:01, the speaker demonstrates how graph algorithms reveal hidden relational patterns. Rather than analyzing spreadsheets, plotting breach indicators as interconnected nodes and edges allows investigators to identify central communication hubs, shared hosting servers, and common administrative personas.

### Case Studies: Piercing Online Anonymity At 21:02 and 28:00, Macpherson walks through real-world forensic investigations. By pivoting across WHOIS registration records, forum post timestamps, and leaked database hashes using custom Maltego transforms, he illustrates how subtle operational security (OPSEC) failures unmask pseudonymous threat actors.

### Ethical Governance and Privacy in OSINT Investigations Concluding at 35:01, Macpherson addresses the ethical and regulatory boundaries of OSINT research. He discusses data protection standards (including GDPR), the risks of aggregating non-consensual personal data, and the professional responsibility investigators carry when managing sensitive intelligence.

(AI summary — Gemini Flash)