How to Become One of Them: Deep Cover Ops

The Enduring Value of Human Intelligence in Cyber Threat Analysis

This talk explores the critical role of human intelligence (HUMINT) in cyber threat intelligence, emphasizing its superiority over automated tools and AI in accessing private criminal communities and building trust.

Why HUMINT Still Matters

While AI, automation, and OSINT tools are prevalent, they cannot penetrate private groups or earn the trust of cybercriminals. HUMINT fills the gaps left by automated methods, allowing analysts to uncover closed-source threats and understand the intent behind attacks before they occur. It provides insights that technical collection alone cannot achieve, offering a deeper understanding of threat actors and their motivations.

The HUMINT Lifecycle: Deep Cover Operations

The presentation outlines a full lifecycle for deep cover operations, including:

Forum Selection: Identifying the right online communities.

Persona Development: Creating a believable online identity with a plausible backstory and supporting infrastructure (backstopping).

Operational Security (OpSec): Maintaining security to avoid detection and exposure.

Direct Engagement: Interacting with threat actors to extract high-value intelligence.

Risk Management: Addressing operational, technical, and emotional challenges, including legal and ethical considerations.

Real-World Examples and Methodologies

Initial Access Brokers (IABs): Analysts can engage with IABs selling access to systems, probing for more details than sellers initially reveal. This often involves moving conversations off-forum to platforms like Telegram.

Pre-Market Access: Threat actors may offer glimpses of upcoming sales or private access to databases, which HUMINT analysts can leverage.

Intelligence Validation: HUMINT provides pre-public, high-confidence intelligence. Direct engagement allows for threat validation and context gathering, offering a deeper understanding of intent and targeting.

Challenges and Risks of HUMINT

Operational & Technical Risks: Maintaining persona consistency (language, time zones, background story), risk of detection through changes in behavior, and potential blacklisting from communities.

Legal & Ethical Gray Areas: Navigating different jurisdictional interpretations of engagement, impersonation, and observation. Organizations must establish clear policies.

Time Intensity: Building credibility in closed communities can take weeks or months of low-level engagement, unlike the speed of OSINT tools.

Platform Instability: Forums can go dark, require new invites, or shift platforms, impacting long-term operations.

Psychological Toll: Daily exposure to toxic content and maintaining a deceptive identity can lead to moral fatigue and stress.

Information Verification: Threat actors often exaggerate or lie to make sales, requiring external validation of shared information.

Source Selection and Persona Crafting

Access and Placement: Evaluating a source's position and what they have access to is crucial.

Prioritization Criteria: Reputation on forums, connections, knowledge base, and what they sell.

Risk Analysis: Higher-level sources often carry higher risks, but the potential payoff can be significant.

Matching Needs: Ensuring the source aligns with intelligence requirements.

Persona Fundamentals: Creating an artificial online personality with a plausible backstory, consistent details, and supporting infrastructure (backstopping).

Building Reputation: Creating accounts across multiple forums, starting with passive listening, mimicking lingo, and gradually engaging to build credibility.

Understanding Ecosystems: Recognizing forum hierarchies, language, geographic habits, and social dynamics to gain access to exclusive areas.

Building Trust and Extracting Intelligence

Gaining Trust: Start with low-risk interactions, share harmless resources, be consistent, and avoid trying to impress. Credibility takes time and cannot be rushed.

Measuring Success: Look for direct replies from respected users, invitations to private chats, mentions by others, and early access to tools or data.

Intelligence Extraction:

Passive: Monitoring threads, downloading attachments, archiving discussions.

Active: Direct interaction with threat actors, using subtle conversation starters, faking collaboration, or asking for proof of access.

Relationship Building: Remembering details, referencing shared forum culture, and offering small favors can build rapport.

Verification and Documentation: Always verify information, save logs, screenshots, and artifacts securely. Tag and timestamp conversations for timeline reconstruction and correlate intel with OSINT.

Maintaining Cover: Avoid over-asking, breaking forum rules, or asking technical questions outside the persona's scope. Keep interactions brief and friendly.

Ethics and Infiltration

Legal Compliance: Understand and adhere to legal guidelines and organizational policies.

Minimizing Harm: Prioritize operations that cause the least harm and avoid actions that directly injure innocents or innocent organizations.

Contributing to Criminal Ecosystems: Be mindful that patronizing threat actors, even indirectly, supports their industry. Weigh the reward against this contribution.

Emotional Boundaries: Recognize the human element in interactions, manage personal emotional exposure, and be prepared for difficult decisions, such as reporting sources to law enforcement.

Peer Review: Discuss operations with fellow collectors and operators to check for ethical issues.

Documentation

Crucial for Actionability: Document every interaction, maintain a secure record, and preserve evidence for legal purposes and chain of custody.