Ago Ambur - Identifying 100 Cybercriminals In 1 Hour

Heat. Heat. [music]

[music]

Hello everybody. Um, my name is Amber. Um, I'm I'm [clears throat] here to talk to you about cyber crime and in in particular about attribution. I come from uh I'm a one of the founders of a company called Glazer Technologies. We are a Estonian cyber intelligence company but I do have a history with uh with cyber crime uh but on the on the correct side of the uh correct side of the things um I did a decade in in National Criminal Police of Estonia uh combating cyber crime uh within cyber crime bureau. So a lot of my previous life or most of my professional life has been around uh working in the trenches uh going from incidents to actually

identifying who are the perpetrators behind the attack and then bringing these uh cases to to justice and and these u actors u from behind their keyboards to uh to the court. And um the the topic today uh identify 100 cyber criminals in in 1 hour. It's actually a bit of a understatement but uh you know 100 at one it goes it goes very well. So this is why the title but we'll get to that part uh in a bit before that uh just really briefly on on on the motivation of this talk. Lately when I when I open up LinkedIn or when I open up news outlets and and different uh mediums there is I I I

sense a growing kind of polarized view on on the matters of attribution. So very often attribution is is is seen as something super mystified super luxurious and glamorous thing that uh only a few entities uh be it law enforcement or intelligence agencies have the luxury of working with. Um I think this this premise creates a bit of a uh wrong alignment uh when we tackle cyber security. Um and to bring a real world analogy when uh when your house is broken into and something is stolen and you see your stolen bicycle for example um being sold on Facebook marketplace quite often I would say most of you would try and click on the profile and

see like who is this person that's selling my stolen bicycle right um in minimum you would uh announce this to law enforcement and and respective agencies is to go and you know my bike is being sold on Facebook marketplace. Uh and we had real life cases like that in in Estonia where people were able to identify their bikes being stolen on uh and sold on Facebook uh marketplace and police could take action and the point being here is that there are many things that we do in real world but we don't necessarily always do in in in the cyber domain. So we don't always go and check like okay my bicycle was stolen um where

is it being sold and who is the person selling that and if you think of it in that sense it doesn't you know doesn't sound that luxurious or glamorous at all right it it feels very fairly basic um additionally to that um the polarized view is even more amplified by the fact that if we look at the messaging that's being pushed to us by uh frontier model providers so every day we are seeing or every week we're seeing somebody announcing a you know a a gentic workforce broke into system X upgrade their defenses. Um this is also a wrong premise because yes of course we need to reinforce our defenses but uh when my kids go and

throw in someone's my neighbor's windows I don't blame the neighbor and and ask them to upgrade the uh the windows of the building. actually it it is me whose responsibility this is and it is me you know who gets attributed for that activity and I am the one who's bearing responsibility for that. So let's not forget that computers don't do crime. It's still the humans. Even if it is a a gentic workforce, there's still a human behind uh who is take who is to be taken accountable. And actually we've been through that in uh in cryptocurrency cases uh where um different actors have put up decentralized finance uh decentralized uh cryptocurrency dumblers for money laundering and the system

works independently of them. It transacts independently of the criminal actor and they will claim that they have no visibility into what's going on. They have no way to block it. And this means that they are, you know, they're not responsible for any any money laundering taking place with the system that they built. Um, it's gone through court and it's not the case. Uh, they actually bear responsibility for that. Additionally, u, Visa Stalin has started to have a bit of a track record on Infos Steelers. So, I also wanted to, um, to kind of carry on with the legacy B Marvet left here last year. uh if you haven't seen his talk is in YouTube uh

really gives you the basics of of info steelers as we will be combining info steelers and attribution is in this talk it's a it's a really good premise if if some of it maybe today uh is left confusing um you can always refer to better's talk and and get the really essential basics there but before we before we get to the juicy part uh before we get to that attribution um a bit on info steelers uh without referring to better's talk. So info steelers essent essentially are a form of u malware. Historically you would categorize um things like key loggers, things like banking trojans um as part of uh the info steelers ecosystem. But over time it has changed and it has

become fairly uh a very specific subset of malware. For those of you working in different security operation centers um or or uh dealing with alerts or u you know looking into your EDR deductions some of these familiars might be uh familiar some some of these families might be familiar to you. So the subset of info steelers are really uh grouped around the set of families that operate in a specific way. Um the main goal of these this malware is to get in the victim device really quickly, capture as much information as possible and then exfiltrate that and get out of the system. Um and these are some of the families that are doing exactly that. On

the right hand side here we see a chart of uh monthly um credential volume uh stolen from victim computers by these info steelers. Uh this is uh this is break broken down by month uh in 2022 uh 20 sorry 2025. So this is last year's statistics uh by recorded future and it's constantly growing and these are as you can see really really big volumes. So we start off the year by 63 million credentials stolen from uh victim computers and we finish at 128 something million credentials stolen from victim computers. Um there is a really simple reason for for these uh economics. The growth is explained by two things. First of all uh do you know what malware as a service

means? So mass all of these families are being distributed online under a mass uh mass subscription model. So malware as a service subscription model. So most of the operators who are carrying out the uh infection v victim computer and stealing the uh stealing the information, stealing the credentials, they don't actually build this malware. They become affiliates of the malware developers. They subscribe to the service and as a result of that the uh the developers give them the malware that they can distribute. Now this creates a nice uh nice service-based uh economy. But once the infection happens and once the operator has uh gathered the credentials, there is another uh economy that drives uh the volume up and this is credentials as a

service. So uh CAS uh as an acronym. What does this mean that is that the operator actually taking the malware uh getting it on the systems and extracting the credentials doesn't actually necessarily use the credentials themselves but they will publish it online uh they will publish it online under the credentials as a service model and then there is bunch of people uh who are subscribing to the service and they will get what we call fresh logs or fresh credentials usually on a daily basis and again in in all of these points there is a very uh concrete economics at play. There is concrete demand. Demand is always increasing as we see these breaches and and intrusions happening.

Um and and this is what's driving this chart up. I briefly mentioned um the the core components of the info steeler. Uh here's a chart to represent that. So at a very high level the idea is to somehow for the operator to get it in the victim machine. So there is going to be a deliver delivery mechanism. Usually this can be anything from a email attachment potential unwanted programs. It can be attached to game cracks. It can be click fix for example asking you to copy some instruction from your uh from the browser to your command prompts. uh really popular lately. So the delivery mechanisms vary by operator after it has gotten on your PC uh it will do the data

harvesting and infostelers are really well designed around gathering the data from your computer super fast uh and then doing the xfiltration as fast as possible. So usually the the uh the lifespan of the info steeler is is fairly short and after that what is unique about the uh info steelers contrary to like common remote access trojans or key loggers they will clean up the traces they will leave the system. So after the info steeler operation has completed they will uh cease to exist and your computer you know continues to continues behaving normally. So this this also some in some cases makes the after the fact discovery much more difficult because there aren't many tra traces left on the system

on the data harvesting side. So we we're mentioning credentials but it's not just the credentials uh and actually your computer stores credentials in many many different forms right so in in the case of info steelers some of the most common uh grounds that they will be collecting from is the device information so that is usually your operating system your language settings your time zone your country zone uh your your username on the system, you know, major, minor version and so forth. Um, and then in some cases also, uh, directory listing of your desktop. In some cases, they would take a screenshot of your desktop. Um, some really general information around that and then it gets

more specific. Um, one of the aspects that is uh, you know, collected around credentials is the saved credentials. So, this will be coming from your browser. uh everything that you've saved in your B password manager of the browser will be um taken. So all of your saved credentials uh are gone in one second. Additionally uh not just your saved credentials but your autofill forms. So if you use a a address at somewhere, if you use a you know if you use a credit card someplace uh this will also get stolen. And uh what's becoming more popular nowadays over the last few years um I've left here um unmarked but can you guess what is the the core

component that's getting stolen nowadays and it's it allows the most of the actors also defeat uh multiffactor authentication. Yeah I heard I heard session cookies there. So yeah correct. uh more and more emphasis is around session cookies and authorization tokens as well. Um as the uses of uh multiffactor authentication was going up, criminals understood, okay, the the login and password is not enough anymore. Let's start extracting session cookies. And that's why it's also helpful for them to disseminate that data within within the same day because usually the session cookies will they will usually last for a working day, right? Um in minimum. So really helpful for them to gain access. Now they just need to take the cookie uh set

up their uh machine or or a or or the browser in a way that it uses us uses your cookie and and they log in. Um if we try and visualize that this is a very basic example from one of the info stealer uh logs. This is what it actually looks like on a very raw level. So on the left hand side we have a kind of the collection. So we have the general information of the system. We have uh you know the passwords that were we were able to exfiltrate. We have uh uh two directories uh autofill and cookies. So this is where the the autofill forms data lives and and also the uh the cookies are stored in the on

in the folder below. And then on the right hand side we see a extract from the bcinfo.json. So again, some really fairly generic u information, but some cases this can be really useful for the criminal. You might think like, okay, what's he going to do with my uh screen resolution? Um actually some of these uh session cookies are tied to uh additional kind of verification mechanism. So when the criminal takes the session cookie, they will actually try and emulate the uh the um the victim machine as accurately as possible. And some of these parameters are really helpful for that. For example, the dime zone. And then I mentioned these logs are usually offered on a daily basis. Uh so

there are specific channels where these are being pushed. Once the data gets excfiltrated and the and the operator has collected enough, they will usually push the push these to telegram channels or forums. Um the way that the data looks like when they're pushing it out is uh usually there is a multiart archive because these files are are relatively big uh especially when the stealer also collects raw information like screenshots from the computer. And then inside of these archives we will find different directories with different victim data inside of that. And on on average from a from a stealer they could be pushing these uh from the volume of like a few thousand up to like tens of

thousands per day. Uh and this is just from one operator just from one one uh one particular uh steeler family. There's one very specific distinction to be made here. very often uh there's talk about ulp when we talk about the infoser infos steelers ulp stands for URL login and password so the combination of URL where you can login and then the login and password pair that you can use to login through that URL usually the way these get published is under like a two-tier mechanism so first tier providers they give the raw logs so on the left hand side We see uh first tier providers offering the logs. They will give the the uh uh they will give

these files that contain a directory tree like that. So this is kind of the high quality stuff that uh those criminals who are really paying for it uh get access to. And then where the UR ulp model comes in is usually the second tier. So bunch of people buy this first year data. They will repackage that. They will get the get rid of all the session cookies, the screenshots and so forth and they will just push the ulp data on sale. Uh and very often the data quality is much lower because they would uh they would mix up the credentials from different uh different sources. They would inflate the volume uh uh artificially and so forth. So really

from uh from uh from a analyst or intelligence specialist uh perspective uh this is the the left hand side the raw data is actually the the most valuable uh information and it also applies to the criminals. Now I mentioned the intelligence analyst perspective. So one of the key components here um on this talk and the way we're going to be doing the attribution in the moment is the fact that there is a big industry built around credentials recapture. There is one really big um uh kind of the core idea behind that. Uh the industry has been growing now for I think almost a decade since it was kind of uh coming into existence. And the idea is that if

we are able to uh collect this information from the dark web faster than the criminals are able to use that then we will be able to prevent misuse of these leaked credentials. Right? And this is why we have a whole industry uh focused around capturing these credentials as they appear in in these telegram channels in these dark web forums and making this accessible and available this knowledge to the to the potential victims and organizations as fast as possible. So we can look up whether we are in there uh whether our users are in there and we can mitigate. um super helpful for us that this industry uh exists because thanks to that uh we have a uh vast access to raw

uh raw info stealer data historically going back years and we can use that to attribute uh cyber criminals. So how we're going to be doing that? Well, first of all let's look into the uh ecosystem a bit more. Uh first of all we should find uh the place where the criminals are uh in order to uh to start attributing them. Um we are going to be looking into Facebook marketplaces for uh for cyber criminals. So I mentioned this is the channel. These are the channels that uh the telegram channels that these logs are being uh uh disseminated in. It's not just the telegram channels. I also earlier mentioned forums. So actually the same people um who are disseminating

these uh these logs and collecting this data will be present in various different criminal forums not just the telegram channels. Uh for example in this case there is the uh black lovers up uh selling access private uh cloud logs access uh uh for you know 20 bucks a week. Um in this alternance.is is forum there is uh somebody going by Arian who's selling access to boxcloud uh logs and there seems to be 1 million credential uh credentials captured in that log that he's now giving uh giving access to in this case free that's their way of doing marketing but uh from free you would end up in their telegram channel and and and the goal end goal is to upsell the whole

uh daily access to the to the to the another criminal and uh and another example from Gracking X somebody selling uh another set of uh uh credential logs in this case by by Ventos. So what we want to establish here is the fact that um a lot of these criminals, these cyber criminals working in the sphere of uh of infecting machines, collecting information from them and then disseminating actually persist in these um these communities in Telegram and and and cyber crime forums. So this begs me the question if we look at the credentials recaptured how many of info steeler victims are actually um present on these sites you know how many people who have infected

themselves uh with infostelers how many of them actually go to these uh cyber criminal uh layers right so let's take a sample set u I picked nine forums Um some of them are known for um providing hacking tools. Some of them are more known for uh just like a a learning place for aspiring cyber criminals. Some of them are known for really historical background into you know providing providing these kind of credential log accesses. So in this case we have nine different platforms batch two uh hack forums alenant is uh and they and and one upcoming forum here on the top right com for uh top top bottom right corner. Um so I did a lookup and I found that on

these forums I can identify that there is from four to at least 11,000 uh users active in these forums who have re infected themselves with infostelers which um it's a nice metric considering a lot of these have only 50,000 users or uh or a few hundred users. So we can really put this into uh uh proportion and we can we can see that okay most of these guys going into these sites have actually at some point even infected themselves. There is one thing to highlight though. Um if you think about um you know I guess most of us have in in some point in life I hope not but at at some point in life

we have probably infected ourselves with something or we've attempted to install something that is probably malicious. So what happens in many cases is a a user runs into a let's say a game crack. They want to install GTA 6, right? Somebody's saying it's already out there. They download it. they want to install it and they click on it and they discover that oh it doesn't work like what's wrong. So naturally you will go and click the executable again and again and again. Um and in very many cases the same machine infects itself many times. Uh which is problematic in terms of these numbers because they are inflated by duplicate infections of the same machine in a very

short time span. And that's in human nature and it happens with click fix as well. Like people copy the instruction, they paste it in the command prompt and like uh now what? Nothing happened, right? uh but in the background they keep running the info stealer again and again and again. So the numbers are a bit uninflated uh because people infect themselves many times the same identities and also because the sellers inflate the volume as I said they will repackage the stuff that they've already gathered before they will try and sell it again. Uh essentially you know I mentioned there is this two-tier model. So in in the drug world, the reference would be like the first tier sells, you know, cocaine

by by a brick and then the second tier takes that brick, halves it up and then dilutes it with uh with pretty much like flour. Uh so there is a lot of that noise in there which is inflating the numbers. But even though the same law can appear up to 75% in in in our numbers, there are still upsides. So I do have big confidence that this will work when when we start identifying the users based on these info steeler logs because there's a clear track record of these uh info steelers being used or the info steeler data being used in various different cases. Um some of the ne more recent ones even being SpyCloud published in January a

research how they used uh info stealer rocks and they used behavioral signals in these logs to identify fake North uh North Korean IT workers. Uh so they just established the baseline what they deem to be a North Korean IT worker and uh they went through the vast collection of the recaptured uh credentials and they were able to identify clusters of fake uh North Korean IT workers. Furthermore actually ironically Flair published in August a study that claims that one in 20 info stealer victims is actually a threat actor, which to me is like, oh, nice. So, 5% of all of the victims actually are criminals themselves. Um, this is very um very uh this is this is this is very um uh

raising the confidence that the approach might work. So we still need to choose the target from where we're going to build the mechanism to attribute these cyber criminals on scale. Uh and for that since we are working with fairly sensitive data um we're going to set some guard rails. So first of all I will be only looking into uh infostaler logs that are target are coming from victims who are customers or users of entirely criminal um places. So the ecosystem that we're targeting has to be criminal. That's my uh requirement number one. Um then requirement number two is the entry point. So I mentioned the tier 2 being the ulp uh URL login password. We will not be relying on that

because that is a weak signal. These get repack repackaged recaptured. Uh and uh also another nuance with the uh ulp logs is the fact that when I look at the infection of a cyber criminal machine there is tons of different usernames and passwords there. The reason being that is that these guys are operating the same under the same premise that they want to use these credentials to log into um you know different accounts. So if I look at the info stealer log of a criminal or cyber criminals the threat actor I will find tons of different credentials that don't belong to the uh to the cyber criminal themselves because they using the stolen credentials to do

their activities. So for that reason we'll be using session cookies because they are much more much stronger signal the session cookie that they have signed into the the target platform and then u the platform also has a criteria we have to be able to find the user or we have to be able to map from the session cookie to the cyber criminal uh profile on the site. So going back to this sample set, all nine of these uh uh are criminal platforms designed to um amplify people, give them instruments to commit cyber crime. Uh all of them pass our criteria. Uh we move on to the criteria number two. I want to be since we're running an experiment, we want to

be able to have we want to have enough volume so the experiment is is helpful uh or actually proves value to us. So that will leave us only three of these platforms that have uh that had over 10,000 uh um info steeler uh victims in in in in our or in my visibility at least. And then thirdly uh we want to be able to as I mentioned go from a session cookie to a user ID on the platform. Um a lot of these platforms are running on different uh content management systems. So it might be my BBB, it might be IP board, it might be senoro. Um, additionally a lot of them have have been you know installed or amp they have

installed loads of different u uh plugins to amp up their security. And as I was considering this the target for this case, I looked at the way that they store and uh they they uh they use session cookies. And in at least one of these cases, the session cookies were encrypted, which was helpful for for them because I couldn't take the user ID from the session cookie and map it to the user on the platform because the cookie itself was uh was encrypted. So that left us just with altern.is. It is a mainly Arabic speaking Turkish uh cyber crime community revolving around providing access to stolen Netflix accounts. Uh providing access to malware source codes

and and stuff around really like on the skill level they are looking they are on the like beginner and advanced between that but uh but there is great um history with that forum. it's really known in that region and and if we're looking for cyber criminals that's definitely a place we can find them. So to actually identifying them now I've talked a lot around uh different platforms. I've talked around uh a lot about different infraers and the way they operate. Our entry point now is the infra stealer raw log file. The criteria here is that this infection uh has relationships to the target. So in our case alternatesis. So the machine that had the infection

uh had at some point in time a session login session to alternance.is. This will be in the info steeler ro file. Uh additionally for uh in my case these log files have been normalized. So I'm not looking at the directory tree as I was showing before, but I'm looking at the big JSON blob where I have uh uh you know the basic information, the session cookies, the user login, passwords, uh saved form data and so on all in one big JSON file. So I can really easily work with that. So this is the entry point. This is the raw log file and on the left hand side we have the criminal alias that we will

be building from this log file and on the right hand side we have the real identity. So we will have two different baseball cards as we as we like to call them in law enforcement. One reflecting the criminal identity and the other one reflecting the uh the real identity behind that alias. So as I was saying first step we will be extracting the session cookie uh from the log and then we will be extracting a user ID from that session cookie. So in the case of alternates.is as this is a excerpt from the from the raw log file. Uh we can find the session cookie and it will look like some something like this. So it's going to be a array of of

parameters. But there is one very specific thing that's helpful for us here. It's the XF user and then the user ID. So and by the way you don't need uh a AI to get to that. you can simp simply parse JSON and then extract the uh extract the user ID between the uh tab uh and the and the separator there. So now we have the user ID and we can also tell that it this alternates is running on uh comm uh content management system. Next step from that is we'll take this uh user ID and as we want to reach the uh the profile of the cyber criminal the easiest way to do that is now just to

take this user ID and put it into a browser and see um what is the profile that's going to be looking at us. So, as I was doing this on a scale, I was running through all of these Infosstealer logs, uh, I just scraped um, a lot of these uh, a lot of these different profiles uh, in in a one getgo. And this is this is a small excerpt of uh, of me scraping around uh, 15 different users in in in a few minutes. Um, and I will be scraping not just their user profile, but I will be also looking into their postings and their created thread history. So from all of that information, we can create

something that I'm I'm going to be calling here the criminal alias card. Um, so in in an example for an alternance, we are going to be getting something like this. So example case uh Adrian here. Uh so we we get the session ID, we get the uh sorry session cookie, we get the user ID from there, we go visit the user profile, we go visit the postings, the thread history and we put together a uh JSON file like that. uh the topics uh and activity for that I used LLM uh because there's a lot of u a lot of text there and uh and too little time to write the XM4 HTML browser uh parser. So uh this is all filled in with

the help of uh LLM but this will be the baseline for our criminal alias. So this is what we will be uh building. Uh now on the other side uh we will be shifting to the real identity. We're going to be working more heavily with the ro file. So in the ro file um there is as I mentioned before there is the usernames there's passwords there is the system information there is the um you know credit card numbers uh phone numbers and so forth. We're going to be doing uh entity extraction on that and then uh with after the entity extraction we're going to assign confidence to each entity. And the reason we're doing that is as I

mentioned before a lot of these people in uh are also working with stolen credentials. So we want to really be sure that these credentials that we're extracting from there belong to the criminal not to other victims of them. So we will be running entity extraction and this is kind of the again a small excerpt from the raw infra log file. In this case an entity would be uh the the username of the machine. So Audrey in this case and this is the same log file as we were showing before uh in the in the on the left hand side. So we're still operating with the same log file here. Once we have extracted entities and

assigned confidence to them, we will do one layer of enrichment what we would call in in the domain of Osin. So we will take these high confidence entities that we believe belong to the criminal and then we will enrich these with any data source that we have available. So it it can be breach data, it can be again info steel or log data, it can also be you know IP lookup, geolocation and stuff like that. So various different data sources and we come together with a big uh big kind of JSON blob or a or a text blob that we will then feed to the uh LLM again and ask them to uh apologies for the typo here.

Ask the LLM to create us or map us a uh real identity card. So in this case it's going to look something like this. In some cases we can get more high confidence information, some cases less. But in this case we got a name, email address, nationality and phone number which we can claim with high confidence belong to the same guy. So in essence um this is what we have. So, we have raw data on the criminal alias, the the skill skills, the topics they're interested in, the time they've been active, uh what's their username, and the domains that they're operating in, but also on the second hand side, the country they're from, um what's their

email address, what's their full name, what's their phone number. Um see if this plays. Um, and as I said, I ran this one in uh in in in higher volume. Some of this has been blurred out by black boxes. This is the uh personally identifier information. Uh, but these are all the uh the the the threat actors on alternates.is as uh that uh I think this was the first pass I did uh that uh we were able to map from criminal profile to the uh real world identity and uh and the really uh cool thing part about this is that it it actually works and uh uh I ran it just for three three and a

half hours to prove that uh uh this is a efficient way to um do large scale attribution within these communities. Uh throughout these three and a half hours uh I was able to put together 546 criminal alias and real world identity pairs. Uh so in average it takes like 20 seconds to go from a row of infos stealer log file to who is that cyber criminal uh uh online and what's the real world identity right um again this could be made much more efficient but as a PC uh this worked very well uh additionally uh interesting findings here as I was also looking at different domains where these cyber criminals are registered at you could see that uh uh

around quarter of these uh people active in alternates.is also had accounts in different uh cyber crime forums. So by looking into that you can actually uh you know again raise the confidence that you're working with uh uh you're working and you're looking at real threat actors who are sophisticated and actually you know the the the output of this job actually has a measurable impact. So to you uh I think the main takeaway here is that next time you will see hopefully not your own organization but if you see a a breach happening or a disseminated online then the time the moment you see the alias attached to that forum post uh then it might be that uh this guy

actually has infected themselves and it might be that it only takes 20 seconds to uh figure out who the guy is. Um, and I'll be leaving you with that.

>> Thank you very much. Now, it's time for questions as well. Uh, yep. I already see a hand. We don't have the throw box anymore. I'm just going to hand you the microphone. So, let's uh get over here and give you the mic. >> Yeah. Thank you for the great presentation. Um, in the movies, we see that the villains are quite smart. They're thinking about their operational security as well. the the thing that you show on the screen can only work in cases where the operational security of a villain is a really poor one. So you essentially log into your personal Gmail from the same computer where you do your whatever malicious activities based on

your real experience from the criminal police or from the company that you're working on right now which is more true in real life? Are they mainly well stupid and do these kind of operational security mishaps or are they clever ones and these kind of things in reality usually don't work but they might work in unique cases so to say. Thanks. >> Yeah, I think what is unique in this case is that we're approaching the problem from the other side, right? So we're not approaching the problem from the from the case that something has already happened and we're trying to work back the pretty much that normally you would work back the career of somebody until the point that they were

making these mistakes, right? So nobody of us is is born uh born with all the operational security knowledge in in their heads and and this it doesn't only apply to cyber crime but it also applies to you know bank robberies for instance. There's there's still common mistakes that uh that criminals do and and uh with vast amounts of data available online nowadays, it makes it much more easable easier to identify these uh single points and it it can often just take one single mishap where you when you're able to connect the you know the opera 100% operational security a criminal has thought about setting up this identity and and um distance the identity from their you know previous

life. uh and it might just take one accident at some point along the lines uh to connect all that into the uh into the previous world and and then the the time goes back and I think what is one of the advantages or or what I showed here uh for example of this Adria guy he was uh active since 2018 until 2026 so very recently still active if he now decides to create a new user and an account, there's definitely something in that info stealer log file that he might not be able to get rid of. So maybe it's his credit card that he will still, you know, that will contaminate another identity of his. So uh and now with the

help of LLMs we can go through all of these data really quickly and also know to privacy people it's even better because now the the analyst is not looking at the sensitive data by eyes but the machine can actually uh find out what's important uh which much less privacy concerns. So um the mistakes are still there uh and now we have we just have the vast amount of data available and we can we can do these identifications even faster I would say. >> Thank you. Uh any more questions? Uh yep let me run to that side. >> Thank you for the excellent presentation. I want to build on the last question that was asked. So about

the operational security you also mentioned that they are using different platforms and different CMS and out of curiosity out of those CMS's uh that you saw did you also saw some trend that uh some of them are already running an outdated CMS or using outdated plugins which would actually allow the platform itself to be infected with a info steal. Um [clears throat] my I think my favorite case study is Bridge forums. Um Bridge forums is a platform that has been breached uh I think uh like four or five times by now. And ironically the last time that it happened uh Bridge forms got breached and the breach was published on Bridge forums itself. So yes this does happen quite often. Uh

sometimes it's the vulnerabilities, sometimes it's the insiders. uh uh for some reason they they they the vision doesn't align or something so they will just uh take the data and publish it online to kind of um lower the reputation of the platform. So yeah the the common cyber hygiene and security aspects also apply there. >> Okay. And the follow-up uh question also about the findings. Do you have some uh geographic attribution of top three? Uh when I worked in fraud, it was always either Brazil, Vietnam or China. >> This in this case uh it's a bit biased because I I chose a Arabic/Turkish uh platform. So uh a lot of that is um the demographics are really revolving

around people who are from that region or somehow connected to that region. So uh um so yes uh but mainly because the platform itself is the reasons of that demographics of that platform being Arabic and and Turkish. >> Okay. Thank you. Uh yes I can see one question here as well. Just a moment more steps for me. We're good. Yep. I have one uh legal question I guess. So all this leaked information uh getting sold on uh darknet forums and obviously that information is your bread and butter that you need to analyze like as a company. Do you have a dark budget like CIA uh with tons of cash that you can spend uh on the on purchasing this

information or how does it work from the legal perspective? We um our philosophy is that [snorts] you never play the pay the criminals and this is uh this is also that has held true through throughout my career in police if there's a ransomware case you never pay pay the criminal um and and also in the in the in the case of uh of this data uh as I mentioned there is an industry that already is doing the recapture and they do have various ways of collecting that a lot of that information is available for free but also I can only assume that in some cases it's actually being paid for um so we are not taking part of that uh that

these operations or that part of the industry we are relying on on the industry partners who are collecting the information so we don't actually run the the collection side ourselves and and in that case the uh the collection and the ethics we we choose our providers in a way that it aligns with our vision and our philosophies but we can never really be 100% sure how you know how a partner operates in that space and uh uh but we're just trying to uh do our best to stay on the on the side of not paying the criminals. >> Okay, thank you. We have enough time for maybe one more question if anybody wants to ask something. Oh yes, I see it now.

Thanks. Uh I have two questions like one is uh with the real name cards like you can also make a service to sell like the real ident real hacker info right and the other question is you said that you are using LLMs so does somebody actually have to verify that LLM was right this seems like a lot of work. Uh so yeah since we were I I was running this as a large scale experiment or experiment on on a large scale and I did pick some of these and I went over I think like 30 of them to verify that it actually is correct. But of course in a real world scenario if we were looking

to take action on these cards we would actually um go over all of them and validate our findings actually u actually uh hold true and this is also why we built this multi kind of multi-layer mechanism. So we're not just relying on the LLM but we're also uh extracting some of these entities manually. We are uh assigning confidence to them. So we're trying to make as much as possible to get true output. But of course on top of that you could build a verification layer that actually takes the claims in the in the output JSON and tries and maps it back to the raw JSON to to see if the provenence holds true. So you could build another layer on top

of that but this wasn't really in the scope of of of this experiment. And to your first question then uh I think the criminals are already doing uh quite a bit of work on the on the doxing industry. So uh this kind of business they can if they want to do it they can do it themselves but we we we are only operating with law enforcement partners and and by private industry to make a world safer place not to attribute somebody for fun. >> Thank you very much. That's all the time we have. So please round of applause for a >> Thank you.