02 Nov 2023

Analyzing Threat Actor Profiles Using Social Media Intelligence

Mario Rojas

We live in a world that is becoming more interconnected by the day. The vast amount of information shared on social media platforms offers a treasure trove of insights for the discerning eye. This is where Social Media Intelligence, also known as SOCMINT, steps in.

SOCMINT refers to the collective tools and solutions that allow cyber threat investigators to systematically organize, analyze, and interpret data from social media sources. This data, ranging from tweets, posts, images, links, and more, can be invaluable in understanding threat actors’ behaviors, patterns, and intentions.

In this article, we will delve into the world of SOCMINT and uncover its importance, applications, and challenges.

The Significance of SOCMINT for Analysis πŸ”—︎

For cyber threat intelligence analysts, SOCMINT is not just a supplementary source of information; it is a critical component of their investigative toolkit. The digital footprints left on social media platforms often contain a wealth of information that can reveal patterns, behaviors, and even intentions for analysts.

In a world where threats evolve rapidly, real-time insights from platforms with billions of interactions can be the difference between spotting a threat proactively and reacting to a breach.

The Broad Scope of SOCMINT πŸ”—︎

Source: datareportal

Although the image above only covers traditional platforms, you should expand your perimeter to cover other sites like:

  • Forums and Blogs: These spaces often host in-depth discussions, code-sharing, and sometimes covert planningβ€”anything from hacking forums to sites like 4chan.
  • Non-traditional Platforms: Sites like GitHub or Stack Exchange can be goldmines for spotting malicious code or discussing vulnerabilities.
  • Region-Specific Platforms: If you are investigating a threat from Russia, Vkontakte should be on your radar. The same goes for Weibo, one of the biggest social media apps targeting the Chinese market.

Strategies for Effective Use of SOCMINT πŸ”—︎

With so much data at our disposal, it’s sometimes challenging to sift through it all to find meaningful connections and focus on what’s most relevant at a given moment in our investigation.

Here’s what you can do to harness SOCMINT effectively:

  • Broaden Your Horizon: Beyond mainstream platforms, delve into forums, blogs, and region-specific sites.

  • Prioritize Quality: Although some tools can gather substantial amounts of data, manual exploration is often necessary to uncover subtle details. A comment on a niche forum or a discussion on a lesser-known chat group can sometimes provide the most revealing insights.

  • Define a Workflow: Creating a workflow for investigating specific social media platforms or specific types of information like email addresses or phone numbers helps to reduce the risk of missing vital information and ensures a standard quality of analysis across the board. I highly recommend the OSINT Attack Surface Diagrams shared by the OSINT Dojo to help you define a custom workflow for your investigations.

    Source: osintdojo

To take this a step further, you can use a mapping tool that will help you combine and analyze all the data from a single interface. This is where Maltego stands out in the SOCMINT landscape, as it allows investigators to gather intelligence from a wide range of diverse sources. Maltego also streamlines tasks like deduplication, visualization, automation, and report generation, which can be beneficial when collaborating with other investigators.

Profiling Threat Actors with SOCMINT πŸ”—︎

Now that you have your strategy and tools in place, you can start leveraging the available SOCMINT sources that you consider relevant for your investigation. Here is a quick breakdown of how you can use them to profile threat actors:

  • Profile Identification: Analysts can identify profiles or accounts associated with known threat actors or suspicious activities.

Example: A user on a forum discussing specific hacking techniques or sharing malware code snippets.

  • Communication Patterns: By monitoring conversations and interactions, analysts can discern communication patterns, helping identify networks of malicious actors.

Example: Tracking interactions between suspicious accounts on platforms like Twitter or Telegram to uncover a network of collaborators.

  • Sentiment Analysis: Analyzing sentiments can provide insights into threat actor’s motivations, intentions, or potential targets.

Example: A surge in negative sentiments towards a specific organization might indicate it as a potential target for hacktivist groups.

  • Content Analysis: Reviewing shared content, such as images, videos, or links, can give clues about a threat actor’s capabilities, tools, or methodologies.

Example: A user sharing screenshots of a compromised system or tutorials on exploiting specific vulnerabilities.

  • Temporal Analysis: Observing the timing of posts or interactions can provide insights into threat actors’ active periods, potentially revealing their time zones or operational hours.

Example: A threat actor consistently posts or interacts during a specific time, hinting at their location.

  • Geolocation Data: Some social media platforms provide geolocation data, which can be invaluable in tracking the physical location of threat actors.

Example: A tweet or post with location data enabled, pinpointing a threat actor’s location.

  • Network Analysis: Social media platforms are inherently about connections. Analyzing these can reveal affiliations, hierarchies, or group dynamics.

Example: Identifying followers or mutual connections of a known malicious account to uncover a broader network of threat actors.

  • Trend Monitoring: Monitoring trending topics or hashtags can provide early warnings about emerging threats or campaigns.

Example: A sudden spike in discussions around a specific vulnerability or exploit.

Beyond threat actor profiling, SOCMINT has many other applications. For example, analysts can predict threats by monitoring online discussions about vulnerabilities. Social media, a hub for information warfare, can be navigated using SOCMINT to counteract disinformation campaigns. Meanwhile, early detection of employees discussing sensitive issues online allows for prompt interventions, preventing potential security breaches or issues.

Challenges in the SOCMINT Arena πŸ”—︎

While powerful, SOCMINT is not without its pitfalls:

  • Volume Overwhelm: Every day, billions of posts, tweets, shares, and comments flood social media platforms. This massive influx of data can quickly overwhelm analysts. It’s like trying to find a needle in a haystack, but the haystack is constantly growing. Without the right tools and techniques, crucial information can be missed, or analysts can spend excessive time on irrelevant data, reducing efficiency.
  • Disinformation: Not everything on social media is as it seems. Fake news, altered images, and misleading narratives are everywhere. These are often intentionally planted to mislead or divert attention. Analysts must learn to distinguish between genuine threats and decoys. Misinterpreting disinformation as an actual threat can lead to wasted resources and incorrect threat assessments.
  • Ethical and Legal Hurdles: The digital world has its own set of ethical guidelines and legal boundaries. Techniques like using sock puppet accounts to gather information can be seen as deceptive or intrusive. Moreover, scraping data or accessing private information without consent can breach privacy laws and platform terms of service. Analysts must strike a balance between gathering comprehensive intelligence and respecting digital rights. Overstepping boundaries can lead to legal repercussions, damage to reputation, and potential loss of access to vital platforms.

Maltego: The SOCMINT Powerhouse πŸ”—︎

Maltego has emerged as a favorite tool for many analysts diving into SOCMINT. It facilitates the process by:

Maltego delivers detailed reporting ideal for stakeholder communication and further analysis. Moreover, it offers an all-in-one tool that aggregates information from diverse sources within a single interface, enhanced by its visual analysis that presents actional insights. This eliminates the need to toggle between platforms, providing users with an efficient and value-driven data analysis experience.

Conclusion πŸ”—︎

In the complex landscape of social media, every post, tweet, and like can be a potential lead. SOCMINT stands as a pivotal tool for cyber threat intelligence, transforming digital chatter into actionable insights. Recognizing the nuances of data, discerning genuine threats from disinformation, and navigating the ethical maze are all part of the process.

With powerful tools like Maltego, analysts can streamline the data analysis to find patterns, anomalies, and indicators that, when pieced together, reveal a comprehensive threat narrative. As cyber threats evolve in complexity, mastering SOCMINT isn’t just a recommendation, it is a must.

To learn more about using Maltego and SOCMINT in your investigations, download the handbook below.

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Discover more resources related to Social Media Intelligence here and follow us on Twitter, LinkedIn, and Mastodon, or subscribe to our newsletter.

Happy investigating!

About the Author πŸ”—︎

Mario Rojas πŸ”—︎

Mario Rojas is a former Cyber Security and Threat Intelligence Subject Matter Expert at Maltego with more than 14 years of experience in the cybersecurity field. His expertise in open-source intelligence (OSINT) allows him to effectively map and visualize complex relationships and connections between entities, from IP addresses and domain names to social media profiles and Darkweb forums.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.