Investigating of Cyber-Crime with OSINT

Prakash Jat

Mon, 23 Dec 2024

As the world becomes increasingly digital, the threat of cybercrime continues to grow. Criminals are using ever-more sophisticated methods to steal data, infiltrate systems, and disrupt online activity. Investigators need to equip themselves with the latest tools and techniques to combat these threats. Open Source Intelligence (OSINT) can be an effective approach to investigate cybercrime, as it enables investigators to gather and analyze large amounts of data from publicly available sources.

In this article, I’ll discuss how OSINT can be used to investigate a range of cybercrime activities. So let’s get started…

Ransomware Attacks

Ransomware is a type of malware that encrypts the victim’s files and demands payment in exchange for the decryption key. We can use OSINT to identify the sources of ransomware attacks, track down the individuals behind them, and analyze the payment methods used. For example, investigators can use OSINT to search for bitcoin addresses associated with ransomware payments, and analyze patterns in the payment data to identify potential suspects.

So, some of the tools for investigating ransomware attacks:

1. ID Ransomware: a free online tool that can identify the type of ransomware that has infected a device.
2. VirusTotal: a tool for checking files or URLs for malware, including ransomware.
3. Maltego: a data mining tool for visualizing relationships between data, which can be useful for identifying the source of ransomware attacks.
4. Bitcoin Abuse Database: a database that tracks Bitcoin addresses associated with ransomware attacks, which can help identify the perpetrators.
5. Shodan: a search engine for internet-connected devices that can be used to identify vulnerable systems that are at risk of being targeted by ransomware.

Identity Theft

Identity theft is a type of cybercrime that involves stealing someone’s personal information, such as their name, address, and social security number. OSINT can be used to identify the sources of identity theft, track down the individuals behind them, and analyze the data that has been stolen. For example, investigators can use OSINT to search for online profiles and social media accounts associated with the stolen data, and monitor online marketplaces for the sale of stolen identities.

So, some of the tools for investigating identity theft are as follows:

1. Have I Been Pwned: a website that allows users to check if their personal data has been compromised in a data breach.
2. Social Catfish: a tool that allows users to search for people using their name, email address, phone number, or username to identify potential cases of identity theft.
3. Google Alerts: a free service that allows users to set up alerts for specific keywords or phrases, such as their name or personal information, to monitor for potential identity theft.
4. Pipl: a people search engine that can be used to search for individuals based on their name, email address, phone number, or username.
5. DataSploit: a tool that can be used to collect and analyze data from various sources to identify potential cases of identity theft.

Malware Attacks

Malware attacks are a type of cybercrime that involves the use of malicious software to infiltrate computer systems and steal data. OSINT can be used to identify the sources of malware attacks, track down the individuals behind them, and analyze the data that has been stolen. For example, investigators can use OSINT to search for malware samples on public repositories, monitor underground forums for discussions about malware campaigns, and analyze the network traffic associated with the attacks.

So, some of the tools for investigating malware attacks are as follows:

1. VirusTotal: a free online tool that allows you to upload files or URLs to check for malware using dozens of different antivirus engines.
2. Hybrid Analysis: a malware analysis service that provides detailed reports on the behavior of malware.
3. Malware Information Sharing Platform (MISP): a free, open-source platform for sharing malware samples and other threat intelligence.
4. Cuckoo Sandbox: a malware analysis system that allows you to run malware samples in a safe, isolated environment.
5. Malwarebytes: an antivirus and anti-malware software that can detect and remove malware from infected systems.

Social Engineering Attacks

Social engineering is a type of cybercrime that involves tricking people into divulging sensitive information or performing actions that are harmful to themselves or their organizations. Using OSINT, investigators can identify the sources of social engineering attacks, track down the individuals behind them, and analyze the data that has been stolen. For instance, they can monitor social media and online forums for discussions about social engineering techniques, and analyze the phishing emails and messages used in the attacks. They can also use tools like Sherlock and Social-Searcher to search for social media profiles and analyze their activity.

So, some of the tools for social engineering attack investigations are as follows:

1. Social-Engineer Toolkit (SET): an open-source tool for creating and executing social engineering attacks.
2. TheHarvester: a tool for gathering email addresses, usernames, and other information from public sources.
3. Recon-ng: a tool for information gathering and reconnaissance on targets.
4. Shodan: a search engine for finding Internet-connected devices and identifying vulnerabilities.
5. OSINT Framework: a collection of OSINT tools and resources for social engineering investigations.

Hacking and Data Breaches

Hacking and data breaches are types of cybercrime that involve the unauthorized access to computer systems and the theft of sensitive information. Investigators can use OSINT to identify the sources of hacking and data breaches, track down the individuals behind them, and analyze the data that has been stolen.

For example, they can search for stolen data on underground marketplaces, monitor social media and online forums for discussions about the breaches, and analyze the network traffic associated with the attacks. Additionally, tools such as Shodan, Censys, and ZoomEye enable them to search for vulnerable devices and analyze network activity.

So, some of the tools for investigating hacking and data breaches are as follows:

1. Have I Been Pwned: a free online service that allows you to check if your email address has been involved in a data breach.
2. Shodan: a search engine for Internet-connected devices that can be used to identify vulnerable systems.
3. Censys: a search engine for Internet-connected devices that can be used to identify vulnerabilities and misconfigurations.
4. Hunter.io: a tool for finding email addresses associated with a specific domain name, which can be useful for identifying potential targets for hacking attacks.
5. TheHarvester: a tool for gathering email addresses, subdomains, and other information about a target domain, which can be useful for identifying potential vulnerabilities.

Investigating Phishing

Phishing scams are a common type of cybercrime in which attackers use deceptive emails or messages to trick users into revealing sensitive information. To investigate phishing attacks, you can use OSINT to analyze the email headers, domain name, and message content. Additionally, you can use tools such as PhishTank, Virus Total, and DomainTools to identify phishing domains and analyze their activity.

So, some of the best tools for investigating Phishing are as follows:

1. PhishTank: a community-driven database of known phishing URLs.
2. Maltego: a data mining tool for visualizing relationships between data.
3. VirusTotal: a tool for checking files or URLs for malware.
4. Google Safe Browsing: a service for checking URLs for potential phishing or malware attacks.
5. WHOIS Lookup: a tool for identifying the owner of a domain name.

Online Fraud

Online fraud can take many forms, including fake online stores, investment scams, and romance scams. First of all to investigate online fraud, analysts can use OSINT to analyze websites, social media profiles, and financial transactions. Similarly They can identify fake websites and profiles, as well as analyze financial transactions for suspicious activity, using tools like Whois, SocialCatfish, and Scamalytics.

So, some of the best tools for investigating online fraud are as follows:

1. FraudRecord: a platform for reporting and tracking fraudsters and scammers.
2. Scamadviser: a tool for checking the reputation of websites and online sellers.
3. Trustpilot: a platform for reviewing and rating online businesses.
4. Reverse image search engines: Reverse image search engines help to identify if online advertisements or product listings are using images stolen from elsewhere on the web.
5. Social media search tools: tools for searching social media profiles and posts for evidence of fraudulent behavior.

Online Harassment and Stalking

Online harassment and stalking can take many forms, including threatening messages, unwanted contact, and doxxing. By analyzing the attacker’s online activity, social media profiles, and communication channels, investigators can use OSINT to investigate online harassment and stalking. They can use tools like Spokeo and Pipl to search for the attacker’s personal information and analyze their online activity.

So, some of the best tools for investigating online harassment and stalking as follows:

1. Google Search: search for online profiles, posts, or images associated with the harasser or stalker.
2. Social Catfish: search for a person’s social media accounts by email, phone number, or username.
3. Tineye: reverse image search tool to identify where else an image has been posted online.
4. StalkScan: a tool for gathering information from public Facebook profiles and pages.
5. Maltego: a data mining tool for visualizing relationships between data, which can help identify connections between the harasser/stalker and their target.

Cyberbullying

Cyberbullying is a form of online harassment in which individuals use technology to harass, intimidate, or humiliate others. Analyzing the attacker’s online activity, social media profiles, and communication channels using OSINT can help investigate cyberbullying. To monitor online activity related to the victim, one can use tools like Google Alerts and Mention.

So, some of the tools for investigating cyberbullying are as follows:

1. Hootsuite Insights: a social media monitoring tool that can be used to track mentions of
   specific keywords or phrases related to cyberbullying.
2. Talkwalker: a social media listening tool that can be used to track mentions of specific keywords
   or phrases related to cyberbullying.
3. Google Alerts: a free service that sends email alerts whenever new content related to a
   specific keyword or phrase is published online. This can be useful for tracking mentions of cyberbullying in news articles or blog posts.
4. Reverse Image Search: a tool that can be used to identify the source of an image. This can be useful for tracking down the origin of a cyberbullying image or meme.
5. Wayback Machine: an online tool that allows you to view archived versions of websites. This can be useful for tracking down deleted or modified content related to cyberbullying.

Distributed Denial of Service (DDoS) Attacks

DDoS attacks are a type of cyberattack in which attackers use a network of compromised devices
to overwhelm a target server or network with traffic. To investigate DDoS attacks, analysts can use OSINT to analyze the attacker’s network activity and communication channels, and they can capture and analyze network traffic using tools like Wireshark and tcpdump.

So, some of the tools for investigating Distributed Denial of Service (DDoS) attacks:

1. Shodan: A search engine for Internet-connected devices can identify potential targets of DDoS attacks.
2. DDoS Map: a real-time map of DDoS attacks happening around the world.
3. NetFlow Analyzer: The tool can monitor network traffic and identify potential DDoS attacks.
4. Wireshark: The network protocol analyzer can identify abnormal traffic patterns that may indicate a DDoS attack.
5. Black Lotus Labs: a threat intelligence platform that provides insights into DDoS attacks and other cyber threats.

Intellectual Property Theft and Piracy

The unauthorized use or distribution of copyrighted or patented material involves intellectual property theft and piracy. Analyzing online activity using OSINT can investigate intellectual property theft and piracy,
social media profiles, and communication channels. Users can use tools like Copyright.gov and Tineye to search for copyright infringement and identify pirated content.

So, some of the tools for investigating intellectual property theft and piracy are as follows:

1. Google Alerts: a tool for monitoring the web for mentions of specific keywords, including brand names or product names. This can be helpful for identifying instances of trademark or copyright infringement.
2. TinEye: The reverse image search tool TinEye enables users to identify instances of image theft by uploading an image or entering its URL to see where else it has been used online.
3. Copyright.gov: the official website of the United States Copyright Office. You can use this site to search for copyright registrations and to learn more about the copyright registration process.
4. Copyright Clearance Center: a global rights broker that provides licensing services for copyrighted materials. You can use the site to obtain licenses for copyrighted content or to learn more about copyright law.
5. Anti-Piracy Tools: there are several anti-piracy tools available for tracking and taking down illegal downloads of copyrighted material. Some examples include DMCA.com and Copyright Alliance.

Conclusion

In conclusion, OSINT tools and techniques play a crucial role in investigating cybercrime,
including phishing scams, ransomware attacks, online fraud, identity theft, malware attacks, and other types of cyber threats.

Additionally, by utilizing these tools and techniques, investigators can gather and analyze data from a variety of online sources,
including social media, public records, and other publicly available information. Hence, using these tools and techniques responsibly and ethically is important to ensure secure handling of personal information and respect for any legal restrictions on data scraping.
So, with the right approach and the right tools, OSINT investigations can help to prevent and mitigate the harmful
effects of cybercrime, protecting individuals, businesses, and organizations from online threats.