OSINT Gone Wild: How I Found Drug Traffickers and NarcoTerrorists Online | Schuyler Davis
Examines OSINT Gone Wild: how teams Found Drug Traffickers and NarcoTerrorists Online | Schuyler Davis and evaluates key implications for security practitioners.
Summary
Narco-Terrorism and Online Trafficking
OSINT analyst Schuyler Davis explains narco-terrorism—using kidnappings, assassinations, and bombings to deter law enforcement—and links it to U.S. gang activity beyond traditional cartels. Traffickers increasingly use Telegram for encrypted drug sales, menu-style ordering, and anti-screenshot features.
OSINT Toolkit and Tradecraft
Davis uses publicly available sources plus tools like PimEyes facial recognition, FaceCheck, and passive reconnaissance. He stresses sock-puppet accounts after accidentally liking a target page from a personal profile, and documents fentanyl's lethal potency amid a national overdose crisis.
Case Study One: Twitter to Arrest Records
Searching intentional keywords such as "join Telegram pills" surfaced dealers advertising counterfeit pills. One suspect posted self-photos alongside shipment images; FaceCheck matched a 2022 arrest for marijuana and unlawful weapon carry, yet the same account resumed selling drugs and illicit gun-conversion switches years later.
Case Study Two: Organized Network
A shared Telegram invite appeared across multiple Twitter promoters selling guns and drugs. When one hid their face behind cash, another affiliate exposed theirs, enabling identification of gang members—including youth recruited into a pink-themed crew—through arrest articles and Facebook linkage. Davis partners with law enforcement while teaching kindergarten CS.
Related talks
Videos·36 min
Analysts investigate attack surfaces and defenses concerning Finding Malicious PyPI Packages In The Wild by Christophe Tafani-Dereeper And Vladimir De Turckheim.
Videos·27 min
Charlie Hosier
Charlie Hosier examines Securi-Tay 2020: From Low to PWN: A CTF challenge in the wild.
Black Hat·39 min
a Large Scale Study
Security researchers examine technical aspects of TCP Injection Attacks in the Wild - a Large Scale Study.


