“Finding the Right Solution for OSINT and Investigations”

Join deep dive: Tue, Nov 12, 18:00 CET
28 Jun 2024

Utilizing Maltego for Various Dark Web Investigations

Mario Rojas

The dark web is often seen as a mysterious and impenetrable part of the internet, accessible only to cybercriminals and law enforcement. However, its hidden forums and marketplaces hold valuable information that companies can use to protect their assets and understand emerging threats. Despite the belief that dark web investigations are too complex for anyone but law enforcement, tools like Maltego are making these investigations more accessible and effective for businesses.


Understanding the Dark Web πŸ”—︎

The dark web is a part of the internet that isn’t indexed by search engines and requires specific software, like the Tor browser, to access. Its hidden nature makes it a hub for illicit activities and a valuable source of intelligence for those who know how to navigate it.

Key forums and marketplaces on the dark web are where many of these activities begin. These sites are often the starting points for trading stolen data, selling insider information, and offering access to compromised systems.

In the above example, we see a threat actor using a dark web forum to offer access to hacked instances of various organizations. For organizations aiming to protect themselves, monitoring these posts for mentions of their infrastructure is crucial.

Use Cases for Dark Web Investigations πŸ”—︎

Investigating dark web forums involves navigating the dark web and manually searching for specific keywords to uncover information that may be relevant to your organization. This can be daunting and risky, exposing investigators to malware, phishing attacks, and other dangers. Maltego functions as a protective barrier between the investigator and these threats, providing access to essential information without direct interaction.

INVESTIGATOR NOTE

Maltego provides a layer of anonymity for users accessing data, masking their identity from external data vendors. Typically, data providers can identify users and their searches through their API keys. However, with Maltego Graph (ISO certified), we act as a middleman between the user and the diverse range of data sources. In this way, all queries first go to Maltego servers, which then forward the requests to various API providers. This ensures anonymity, particularly for law enforcement and intelligence agencies, while still offering access to the most relevant data for investigations.


Below is a practical use case demonstrating how Maltego can assist in minimizing potential business risks by proactively responding to any mentions or activity involving your organization. We will provide step-by-step guidance on where to start and how to attribute results. Continue reading!

Access Brokers πŸ”—︎

Access brokers are individuals or groups that sell access to compromised systems. They often operate on dark web forums, offering Remote Desktop Protocol (RDP) access, VPN credentials, and more.

  • Starting Point: A keyword relevant to the investigation.

  • Keywords: “RDP sale,” “VPN access,” “buy accounts,” “admin rights,” “server login,” “network entry.”

  • Goal: To identify key brokers and their networks for active monitoring of their activities and communication.

  • Example Scenario: A threat analyst is tasked with preparing reports that include a list of threat actors and forums likely to purchase confidential information from potential insider threats, for active monitoring and insights. Below you can find the typical workflow for this example scenario.

  • Workflow:

    1. Search: Use Maltego to search for posts mentioning any of the keywords mentioned above.
    2. Extract Information: Gather details about the threat actors and forums involved in these sales.
    3. Extract Identifiers: Look for other identifiers like TOX IDs, email addresses, and phone numbers.
    4. Pivot: Use this information to pivot into additional searches, expanding the network of connected organizations.
    5. Entity Mapping: Visualize connections between access brokers, buyers, and other related organizations.
    6. Pattern Analysis: Analyze communication and transaction patterns to identify key players and networks.
    7. Validation and Correlation: Cross-reference the collected data with internal threat intelligence and external sources to ensure accuracy.
    8. Reporting and Actionable Insights: Generate detailed reports and provide actionable recommendations based on the findings.

Let’s start our investigation by searching for a keyword related to access brokers. In the following example, a threat actor is selling access to multiple Remote Desktop hosts belonging to a German organization for only $1,000.

  1. Step 1 – Starting off

    • Overview: In this initial step, we will search for a keyword to determine the type and quantity of posts available. This will help us visualize the access broker’s entire network and business area.
    • Task in Maltego: Add a Phrase Entity to a new Maltego Graph. Enter a relevant keyword like β€œRDP access.” If you are searching for posts mentioning your organization, include your organization’s name as well. For example, β€œRDP access maltego.”
  2. Step 2 – Searching for related posts

    • Overview: We will try to look for related posts that contain the keyword. We will use the same data source as the previous investigation.

    • Task in Maltego: Select the Phrase Entity and run the Transform:

      • Find Posts Related to Phrase [Cybersixgill]

      In this case, Maltego returned several Telegram posts offering infostealer logs. If you are in law enforcement, you would likely appreciate that this provides numerous posts with contact information.

  3. Step 3 – Reporting for mentions

    • Overview: If your company is mentioned in any of the posts, immediately take steps to secure the affected accounts, notify relevant stakeholders, and investigate the extent of the breach to mitigate further risks.

       **INVESTIGATOR NOTE**
      
       It's important to remember that cybercriminals often operate in their native languages. Some of the most prolific dark web forums are tailored to Russian-speaking individuals. However, you can still use Maltego to search for posts in other languages, even if you don't speak the language. 
      

Considering that access brokers operate globally and that many dark web forums target Russian-speaking individuals, let’s search for posts where access brokers offer VPN access on the dark web, specifically written in Russian.


  1. Step 1 – Starting off

    • Overview: Just like before, let’s add a Phrase Entity into a new graph and enter “VPN access”, but this time we will use the DeepL Transforms to translate the phrase into Russian before moving on to the Darkweb Transforms. You can modify the Phrase Entity to include your organization’s name.

    • Task in Maltego: Run the Transform below and put the target language as β€œRU.”

      • Extract Translation to Phrase [DeepL]

  2. Step 2 – Searching and translating related posts

    • Overview: Then, we will try to look for related posts that contain the Russian keyword. And then we will translate the interesting posts back to English to see what they are about.

    • Task in Maltego: Run the same Transform as previous steps to look for related posts and use DeepL to translate the selected posts back to English to facilitate the research.

      • Find posts related to phrase [Cybersixgill]

      • Translate [DeepL]

As before, if your company is mentioned in any of the posts, immediately take steps to secure the affected accounts, notify relevant stakeholders, and investigate the extent of the breach to mitigate further risks.

Please note that access brokers are known not only for selling access to compromised hosts but also for offering to buy access from other threat actors and even willing individuals who may work for potential victims (insider threats).

Check Out the Full White Paper for Insights on Dark Web Investigation πŸ”—︎

By integrating the workflows with Maltego’s capabilities, organizations can conduct thorough dark web investigations, uncover critical insights, and take proactive measures to enhance their security posture. In our white paper, we outline workflows for five additional use cases where you can benefit from utilizing Maltego for dark web investigations:

  • Insider Threats
  • Data Breach Detection
  • Counterfeit Goods and Intellectual Property Theft
  • Fraud and Scam Detection
  • Threat Actor Profiling

Early detection is crucial in mitigating exposed assets and data, as well as preventing further information leaks. By enabling quick responses to such threats, organizations can significantly reduce their risk and protect their valuable information. Maltego’s powerful capabilities for dark web investigation play a vital role in this proactive approach, ensuring that threats are identified and addressed promptly to maintain a robust security posture.

Download the white paper to learn what types of dark web investigations you can conduct using Maltego!

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Stay connected with us on X and LinkedIn, and subscribe to our email newsletter to get updated with the latest news and developments.

Happy Investigating!


About the Author πŸ”—︎

Mario Rojas

Mario Rojas is a former Cyber Security and Threat Intelligence Subject Matter Expert at Maltego with more than 14 years of experience in the cybersecurity field. His expertise in open-source intelligence (OSINT) allows him to effectively map and visualize complex relationships and connections between entities, from IP addresses and domain names to social media profiles and dark web forums.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.