For years, Russian cybercriminal Wazawaka operated in anonymity. His internet handle was infamous for the cyber attacks he helped facilitate on countless companies, but as long as his true identity was shrouded in secrecy, what could be done?
Enter Constella Intelligence. Data collected from Hunter, our cybercrime investigation software, provided the intel necessary to track Wazawaka and his crimes to the resident of a town in southern Russia.
He’s untouchable as long as he doesn’t leave Russia, but thanks to our cyber investigation services, he no longer has anonymity to hide behind. And once you know who your opponents are, it becomes easier to defend your company against their attacks.
Erin Brown
Sr. Product Manager
How Cyber Attacks Have Changed
Traditional cybersecurity safeguards are essential, but the nature of cyber attacks is changing, becoming less solo-driven and more collaborative. Hackers work together in groups to share resources and labor. This has made it easier for them to scale up their attacks and target more prominent organizations.
However, for the victims, the security challenge has become one of attribution, identifying all players and understanding their roles in an attack.
Cybercrime investigation has become a critical piece of the cybersecurity puzzle. By deploying cyber investigation services, businesses can track down the source of an attack, collect the evidence needed to prosecute those responsible, and prevent future attacks from happening again.
In this article, we will take a closer look at the motivation behind modern-day cyber attacks and how investigative software can be used to help businesses defend themselves.
See how Constella Hunter changes the game with a free demo webinar.
What Are the Motivations Behind Cyber Attacks?
Knowing the motivations behind a cyber attack can be incredibly valuable for businesses looking to protect their networks. For example, if the attackers are after money, companies can take steps to protect their finances and limit the damage they can do. On the other hand, if the attackers are politically motivated or looking to disrupt operations for another purpose entirely, then businesses may need to take deeper, more far-reaching security measures.
Today’s cyber attacks are often motivated by one or more of the following, and financial gain isn’t always at the top of the list:
- Espionage
- Competitive advantages
- Ideological or political extremism
- Revenge
- Hacktivism
- Collateral damage
Attackers may seek additional assistance from dark web services or hire professional hacking groups to achieve their goals. These services make it easier for them to carry out more extensive and sophisticated attacks than they could on their own.
Remember Wazawaka? He’s an initial access broker who provides access to a range of hacked servers and makes money from selling this access to other criminals. Criminal intermediaries like him muddy the waters further since they may not even be interested in personally infiltrating the servers they hack.
It has become increasingly difficult for businesses to attribute attacks and understand their motives. As a result, companies must take a proactive, investigative approach to their cybersecurity efforts to better protect themselves.
How Do People Use Cyber Investigation Technology to Solve Crime?
In the aftermath of a cyber attack, it’s vital for businesses to take a step back and figure out what led to the event. By comprehending the parameters of an attack and pinning down the individuals involved, businesses can take steps to stop future attacks from happening.
At this stage, cybercrime investigation technology becomes incredibly valuable. Law enforcement agencies and businesses use cyber investigation technology to sift through an event’s data to identify important clues and patterns. This data can come from various sources, including social media, the dark web, traditional news outlets, and the digital breadcrumbs attackers leave behind as they conduct their operations.
The primary goal of cyber investigations is to establish a clear timeline of events, understand the methods used in an attack, and, most importantly, attribute any bad actors to particular hacktivist organizations or known cybercriminals. Without this information, preventing future attacks or even catching the perpetrators is challenging.
Babam: A Case Study
Constella Intelligence’s Hunter Cybercrime investigation software was instrumental in tracking down clues to the identity of the network access broker called Babam:
- Email addresses
- Online account registrations
- Usernames
- Passwords
- Domains
- Data breach information
An investigation of this scale wouldn’t be possible to manage without supporting technology that replaces hundreds of hours of research and helps solve these crimes significantly faster.
Get the facts on Constella Hunter cybercrime investigation software.
Why Research Investigations Are Important
Crimes don’t usually just happen. There is a chain of events and preparation that culminates in lawbreaking. In most cases, if this chain is investigated and the evidence adequately gathered, it can help law enforcement prevent similar crimes from happening in the future.
The same can be said for cybercrime. There is usually a wealth of information gleaned from an investigation into the methods, motives, and opportunities of would-be criminals. This information can then be used to better protect against future attacks.
Investigators look at what the criminals want, how they try to get it, and what might happen if they succeed. To discover this information, investigators use a variety of techniques, including:
1. Data Analysis: This involves looking at data to find patterns and trends, either manually or with the help of software.
2. Forensics: Investigators use forensics to examine evidence from the crime scene. This can include examining computers, phones, and other devices.
3. Data Recovery: In some cases, investigators will need to recover data from a device or computer that has been damaged or destroyed, using techniques like data carving.
4. Channel Monitoring: Criminals often use social media and the dark web to communicate and coordinate their activities. Investigators can use social media to track down leads and gather evidence.
5. Law Enforcement Agencies: In many cases, investigators will work with law enforcement to access criminal databases and help prosecute those responsible for the crime.
When an organization becomes victimized by cybercrime, the immediate reaction is often to counter the situation and minimize the damage. This can be likened to how firefighters respond to a burning building—putting out the fire becomes a higher priority than knowing who lit the flame.
However, without knowing the specifics of how and why a fire was started, it is challenging to put measures in place to prevent it from happening again.
Discovering the true identity of a cybercriminal can be difficult, but it is not impossible. In many cases, criminals use methods to hide their tracks, such as using proxy servers or TOR. However, with the right tools and techniques, investigators can often uncover the real identity of a criminal. Accomplishing this step is often a considerable victory in the fight against cybercrime, as it can lead to the arrest and prosecution of those responsible.
Why Your Company Needs a Cyber Investigations Platform
When preventing and fighting cybercrime, your organization needs to be proactive. This means you need to have an investigative system in place. Without an investigation, it isn’t easy to understand what happened, how it happened, and how to prevent it from happening again.
Using Motive to Predict Attacks
Hacking group Lapsus$ breached major companies like Microsoft, Samsung, and Ubisoft with a variety of classic tactics. They are proud and vocal about their accomplishments, even asking their supporters for advice about who to target next.
Identifying and keeping tabs on groups like Lapsus$ means being better prepared before they come after you. Once you understand what motivates them, you can assess the likelihood of winding up in their crosshairs.
Understanding the Vector of Attack
But knowing who may want to attack you is only part of the puzzle. Understanding the vector of attack is just as important. This can be done by looking at past attacks by the same group and understanding the methods used.
Criminal groups now use various sophisticated tools and techniques to carry out their attacks. They may use malware, social engineering, or a combination of both. Your organization will be severely disadvantaged if you don’t have a plan to investigate and defend against these attacks.
Outside of standard attack vectors, criminal groups use other methods that aren’t as noticeable. For example, APT, also known as an advanced persistent threat (a group of hackers), is where a criminal group uses various methods to gain access to an organization’s systems. Once they’ve gained access, they use a combination of techniques to stay active and carry out their objectives without making their presence known. This can be done by planting backdoors, exfiltrating data, or carrying out DDoS attacks.
Tackling these challenging problems requires a cyber investigations platform that can give you visibility into all aspects of an attack while giving you the insight you need to turn your defensive security posture into offensive mitigation strategies.
Constella Hunter vs. Bomb Threats
Constella Hunter is a cybercrime investigation platform that enables you to take an offensive stance against today’s sophisticated cyber threats. It provides you with the visibility and insights you need to understand all aspects of an attack while also helping you identify its motivation.
A global financial services customer received threats targeting an employee, from an anonymous social media account. The customer’s in-house cybersecurity team tried using their investigation tools but came up empty, so they turned to Constella Hunter.
Within an hour, Hunter allowed for a more detailed search which connected random data to other accounts and identified one of the social channels used to communicate the threat. It then conducted an open-source investigation to confirm redacted email and phone numbers.
By conducting further advanced searches on the suspected threat actor’s name and comparing it to the redacted phone number, Hunter allowed us to discover other connected sources that provided even more detail about the threat actor. All of this information gave the customer invaluable information to set their course to revealing more information regarding the attack vectors, motives, and methods of the assailant—information they could share with law enforcement and ultimately use to thwart future attacks.
Constella Hunter Drives Your Cybercrime Investigations
Using Motive to Predict Attacks
Constella Hunter lets you quickly investigate and attribute malicious activity, fraud, and potential insider threats. Providing data analysis from thousands of sources, Hunter helps companies resolve anonymous activity, connecting it to real identities and physical locations. This advanced cyber investigation software solution provides you with the speed and flexibility you need to stay ahead of today’s sophisticated cyber threats and allows you to build mitigation strategies that address attacks at the source.
Next steps:
- Discover more detail about how Hunter works with our free demo webinar.
- Request a demo from Constella Intelligence to see how our software can benefit your company.
Don’t wait until you have a breach to take action. Check your exposure risk today with our Risk Assessment Tool.
“With Hunter, we uncovered the real identity of a bad actor that led us to a criminal group selling credentials from our financial institution in a matter of hours, saving us +$100M from identifying fraudulent credit cards.”
– Top 5 Global Bank
