Maltego Blog RSS Feed

OSINT CTF Challenge Walkthroughs

Thu, 28 May 2026 07:52:07 +0000

From Open Sources to Answers

On May 9, we hosted our third Maltego Community OSINT CTF, and it delivered exactly the kind of intensity and unpredictability that makes competitive investigations so engaging. Some teams stayed near the top of the scoreboard for most of the event, but a few unexpected teams quickly moved up the rankings later on. The fight for third place was very close until the last minutes, with teams solving challenges and positions changing constantly throughout the event.

After an intense competition filled with investigative ups and downs, breakthrough discoveries, and constant scoreboard changes, the teams Lv1x, RinggitPower, and WillHackForBeer secured the top three spots.

The competition may have ended, but the discussion certainly did not. Following the CTF, our Discord community remained highly active as participants continued analyzing investigative approaches, discussing dead ends, comparing methodologies, and breaking down the tools and workflows used during each challenge. These post-CTF discussions are often where some of the most valuable learning takes place.

Capture the Flag (CTF) remains one of the most effective ways to develop investigative thinking, technical creativity, and problem-solving skills under pressure. In this walkthrough, we will break down all 26 challenges step by step, from the initial reconnaissance phase to the final flag submission, while exploring the investigative mindset, tools, and methodologies used throughout each stage.

Whether you completed the challenge successfully or found yourself stuck midway through, the purpose of this write-up is not simply to provide the answer, but to demonstrate the investigative process itself. The real value of OSINT CTFs lies in learning how to approach unfamiliar problems, adapt investigative methodologies, and build repeatable workflows that can also be applied in real-world investigations beyond the competition environment. Follow along!

Name: Account Attribution – 1 | Category: SOMINT | 11 pts

Challenge: We were able to intercept an email address: davidjs1@deliveryotter.com, but we do not know which social media account belongs to the suspect. Identify the associated social media profile and retrieve the flag string hidden in the account bio.

Flag format: Th1s_i5_fl4g

The investigation starts with the intercepted email address: davidjs1@deliveryotter.com, from which the username ‘davidjs1’ is extracted and used for username enumeration through OSINT tools or manual dorking across platforms. This leads to a matching profile on Bluesky at https://bsky.app/profile/davidjs1.bsky.social, where the bio contains the string synt{L0h_t0g_z3}. Recognizing that synt is indicative of ROT13 encoding (which decodes flag), the entire string is decoded using ROT13 to reveal the actual flag: Y0u_g0t_m3.

Flag: Y0u_g0t_m3

Name: Account Attribution – 2 | Category: SOMINT | 5 pts

Challenge: Analyze the tweet thread posted by the suspect. Identify the image within the thread and determine the name of the hotel where the meeting took place (i.e., the location from which the image was captured).

Flag Format: Hotel NameOfHotel

After identifying the suspect’s Bluesky profile, the next step is to analyze their activity. Within a thread discussing a meeting, a reply contains a shortened link: https://shorturl.at/b6Lpf, which redirects to an image hosting site (https://imgshare.cc/fedswxfu), containing the challenge image.

The objective is to determine the hotel name from where the image was taken. One effective approach is to perform a reverse image search, which reveals a recognizable landmark — the Hungarian Parliament Building in Budapest. Using this clue, participants can switch to map services and street view to analyze the viewing angle and approximate location from which the photo was captured, eventually narrowing it down to nearby hotels with a similar perspective.

An alternative and more OSINT-focused method involve enumerating publicly accessible webcams in the identified area. By searching platforms like EarthCam or similar webcam aggregators, participants can locate feeds matching the same view of the parliament. This leads to a specific camera hosted at Hotel Victoria, where the visual perspective aligns with the challenge image. The same webcam is also referenced on the hotel’s official website, confirming the location. Thus, the correct flag is: Hotel Victoria.

Flag: Hotel Victoria

Name: Account Attribution – 3 | Category: SOMINT | 20 pts

Challenge: Based on the image from the previous challenge, determine the time range during which the picture was taken. Please select the corresponding choice.

A. 6:00 AM – 8:00 AM

B. 8:00 AM – 10:00 AM

C. 1:00 PM – 3:00 PM

D. 6:00 PM – 8:00 PM

After identifying the location in the previous step, the next objective is to determine when the image was taken. From the suspect’s Bluesky post, investigators can extract the date of the meeting, which serves as a key input for further analysis.

To estimate the time, a chronolocation approach is used, analyzing the position of the sun and resulting shadows in the image. Since the image clearly shows the Hungarian Parliament Building in Budapest, it can serve as a reference point. By inputting the location (either coordinates or place name) and the known date into tools like SunCalc, participants can simulate the sun’s position throughout the day.

To refine the estimate, the shadow length and direction visible in the image are compared against the simulated outputs. The approximate height of the Parliament building (around 95–100 meters, easily obtainable via a quick search) helps in judging how shadows would fall at different times. By adjusting the sun position in the tool and matching the observed shadow angle and length, the most accurate time window can be determined.

Through this analysis, the image aligns with a morning timeframe, specifically between 8:00 AM and 10:00 AM.

Flag: B. 8:00 AM – 10:00 AM

Note: The original challenge image also contains a timestamp, which can be used for cross-verification of the estimated time.

Name: From the archives | Category: Cyber Threat Intel | 10 pts

Challenge: A suspicious outbound connection was detected during malware traffic analysis. Network telemetry revealed repeated communication with the following IP address: 47.96.17[.]237. Your task is to identify the ZIP archive associated with network activity involving the IP.

Flag Format: filename.zip

The investigation begins with the provided IP address 47.96.17[.]237. The first step is to search the IP within VirusTotal to gather intelligence related to its infrastructure, communications, and associated artifacts. Once the IP intelligence page is opened, navigate to the Relations tab, which contains linked indicators such as communicating files, contacted URLs, domains, and behavioral associations.

Within the Relations section, review the list of files that have historically communicated with or been associated with the IP address. Among the listed artifacts, you will find a ZIP archive named Microsoft.AppRuntime.5017.214.zip. This file appears as a communicating artifact tied directly to the IP infrastructure, making it the required answer for the challenge.

Since the objective is to identify the ZIP file communicating with the provided IP, the discovered archive name becomes the final flag.

Flag: Microsoft.AppRuntime.5017.214.zip

Want to join our next OSINT challenge?

Our Discord community is where the real action happens: challenge announcements, CTF prep, team discussions, memes, post-CTF analysis, and hands-on learning sessions. It’s also a space to exchange OSINT techniques, investigative workflows, and learn from other investigators.

\[Join the community now!](https://discord.com/invite/fhhU4q7CFe)

Name: Whose Signature Is This? | Category: Cyber Threat Intel | 20 pts

Challenge: Threat analysts discovered a suspicious reverse proxy instance hosted at: reverse.wcsset[.]com. Your task is to determine which company signed the certificate used by the reverse proxy tool.

The investigation begins with the provided domain reverse.wcsset[.]com, which is suspected to host a reverse proxy tool. The first step is to analyze the domain using threat intelligence platforms, malware reports, or Indicator of Compromise (IoC) analysis sources to gather contextual information about the hosted infrastructure. By searching for the IoC across public intelligence repositories and security reports, you can uncover references tied to the domain and the services operating behind it.

During the analysis, reports linked to the domain reveal that the hosted tool is identified as SOC.MOD, a suspicious reverse proxy utility commonly discussed in threat research. Reviewing the associated report in detail provides additional attribution data related to the binary or hosted component. Within the report, it is specifically mentioned that the suspicious tool was digitally signed by the Qisheng Information Technology Service Department. Since the challenge throws light on the company that signed the certificate associated with the reverse proxy tool, the identified organization becomes the final answer.

Flag: Qisheng Information Technology Service Department

Name: Domain Pivot | Category: Cyber Threat Intel | 15 pts

Challenge: Threat analysts recovered the following file hash during an investigation into an active malware campaign: 40df05b4f04ad093b31c9ca07a559be56a700e49f6051b5cb7462db5f85be8c3. Intelligence reports indicate that one of the most recent domains linked to the malware also hosted a malicious ZIP archive associated with the same campaign. Determine the name of the malicious zip.

Flag Format: Samplefile.zip

The investigation begins with the provided file hash: 40df05b4f04ad093b31c9ca07a559be56a700e49f6051b5cb7462db5f85be8c3. The first step is to analyze the hash using VirusTotal. Search for the hash to access the malware intelligence page containing behavioral indicators, communication infrastructure, and associated relationships.

Within the analysis results, review the network communication details and related indicators. Among the communicating infrastructure, the top associated domain identified is: 7051.gsm.360safe.company.

The next step is to pivot into the discovered domain by searching 7051.gsm.360safe.company inside VirusTotal. Once the domain page loads, navigate to the Relations tab to inspect linked artifacts and communicating files. In this section, you can identify a ZIP archive named IPanyVPNsetup.zip, which appears as a communicating file associated with the domain.

We don’t stop here. To further validate the finding, you can cross-reference threat intelligence reporting related to the PlushDaemon campaign. Reports discussing the campaign mention the same ZIP archive in connection with the identified domain, confirming the infrastructure relationship. Since the challenge asks for the malicious communicating ZIP file linked to the campaign, the identified archive becomes the final answer.

Flag: IPanyVPNsetup.zip

Name: Sail Away | Category: Geolocation | 15 pts

Challenge: Your task is to identify the exact port from where the image was taken.
Image Link: https://imgshare.cc/q3gfepxc.
Flag Format: Port of ABC

The goal of this challenge is to identify the port from which the image was taken using visual OSINT techniques. At first glance, the image appears to show a harbor area with a vessel docked near a waterfront. A close inspection of the image reveals an important clue: the name ‘FRAM’ is visible on the ship.

The term ‘FRAM’ is a strong starting point for investigation. Searching for the vessel name leads to the ferry and tourism operations connected to western Norway, particularly routes operating around the Fjord regions. This significantly narrows the geographic search area. After identifying the likely operating region, the next step is to examine port cities where these vessels commonly appear. Since multiple ports exist in the region, additional visual clues became important.

Looking closely at the right side of the image reveals a bakery (“bakeri”) shop sign along with a recognizable storefront logo. Scandinavian architecture, waterfront layout, and bridge positioning provides additional geolocation indicators. Therefore, the correct flag is: Port of Ålesund (Port of Aalesund).

Flag: Port of Ålesund

Name: Showboarting – 1 | Category: Maritime | 10 pts

Challenge: As part of the investigation, the agency has provided an image of the yacht. Your task is to determine who captured the photograph. Only use their first name.

Image Link: https://imgshare.cc/uekuibfl.
Flag Format: John

A reverse image search of the provided yacht image reveals that the vessel is called the Dilbar. Once the yacht’s name has been identified, the next step is to investigate maritime records to obtain the associated International Maritime Organization (IMO) number. This identifier becomes useful for pivoting into ship photography databases and historical vessel records.

Using the IMO number, searching on Shipspotting.com helps locate matching images of the yacht. By reviewing the indexed results and comparing the exact image, you can find the original upload page containing additional metadata such as photographer credits, upload details, and vessel information.

Another approach is to search directly using keywords related to the yacht and image source, such as ‘Dilbar Shipspotting’ or by combining reverse image search results with maritime photography websites. This leads to the exact image record, where the photographer attribution identifies the person who captured the photo. The final answer is Daniel F., which can also be accepted as Daniel.

Flag: Daniel

Name: Showboarting – 2 | Category: Maritime | 10 pts

Challenge: Find the MMSI number of the yacht shown in the previous picture during the time period of 2015–2016.

Once the yacht’s IMO number has been identified through the image investigation, the next step is to determine the Maritime Mobile Service Identity (MMSI) associated with the vessel. This can be done by checking AIS-based maritime databases, where vessel identifiers such as the IMO and MMSI, along with historical ship records, are commonly linked.

To find the historical MMSI specifically for the 2015–2016 period, one effective approach is to use Global Fishing Watch. Search for the yacht using its IMO number, which will display historical vessel information along with associated MMSI numbers and name records over time.

By reviewing the timeline and matching the correct date range, you can identify the MMSI linked to the vessel during 2015–2016. The historical record shows that the correct MMSI for that period is 211708190.

Flag: 211708190

Name: Gone fishing – 1 | Category: Maritime | 20 pts

Challenge: Intelligence reports suggest that the vessel, ‘Jing Yuan 626’, is involved in suspicious activity, and you have been tasked with investigating the movements. According to available reports, the vessel displayed unusual movement patterns during a specific time period. Your objective is to determine the port where the vessel was located between 07/18/2024 and 07/19/2024(MM/DD/YYYY).

Challenge Format: Port of ABC

Once the name of the vessel, Jing Yuan 626, is identified, the first step is to gather its maritime identifiers, specifically the IMO and MMSI numbers. These identifiers are essential for tracking historical vessel activity across multiple maritime intelligence platforms. Searching public ship registries or AIS-linked databases helps establish the vessel’s identity before pivoting into timeline analysis.

To investigate activity during a specific period, historical AIS data is required. Many public tracking platforms, such as MarineTraffic or VesselFinder, provide only limited historical access under free accounts, making deeper timeline analysis difficult. A more effective approach is to use Global Fishing Watch, which maintains long-term historical movement data and event-based reporting.

After searching the vessel using its IMO number on Global Fishing Watch, open the vessel activity timeline and review the reported events. Under the Activity by Type section, navigate to Port Visits and match the timeframe provided in the challenge. By correlating the reported dates with the vessel’s movement history, the port associated with that timeline can be identified as the Port of Busan.

Flag: Port of Busan

Name: Gone fishing – 2 | Category: Maritime | 18 pts

Challenge: As part of the ongoing investigation into the movements of Jing Yuan 626, analysts identified a notable vessel encounter that occurred on 17 December 2025. Your task is to determine the IMO number of the ship involved.

To investigate the encounter event, the first step is to open Global Fishing Watch and review the Encountered Events section for the vessel. Since the challenge provides a specific timeline—12/17/2025—you can filter or navigate directly to that date within the activity timeline to locate the relevant encounter.

Once the event is identified, the encounter record reveals the second vessel involved. In this case, the ship encountered by Jing Yuan 626 is Lurongyuanyuyun177. Initial event details may only display limited information, such as the MMSI number, requiring an additional pivot to gather full vessel intelligence.

The next step is to search the vessel name or MMSI across maritime databases and AIS-linked sources to obtain its registry information. By correlating the vessel identity with public ship records, the associated IMO number can be identified. The investigation confirms that the IMO number for Lurongyuanyuyun177 is 9860130.

Flag: 9860130

Name: Gone fishing – 3 | Category: Maritime | 15 pts

Challenge: As part of the continued investigation into the activities of Jing Yuan 626, analysts reported a loitering event on 15 June 2025, lasting approximately 4 hours. Following this event, the vessel resumed movement. Your task is to determine the next port visited by the vessel after the reported loitering activity.

Flag Format: Port of ABC

To investigate the reported loitering activity, the first step is to use Global Fishing Watch, which provides historical event-based vessel tracking data. Within the vessel’s activity timeline, navigate to the Loitering Events section to review all recorded instances of suspicious stationary or slow-moving behavior.

The challenge specifies a date of 15 June 2025, which helps narrow the search to events occurring on that day. Multiple loitering events may appear in the timeline, so the second clue for a 4-hour duration becomes important for identifying the correct record. By filtering or reviewing the listed events for matching timestamps and duration, the exact loitering activity can be isolated.

Once the correct event is identified, the associated metadata reveals the nearby port or location connected to the vessel’s movement after the event. The matching record indicates that the vessel was linked to the port of Iquique. Therefore, the correct answer is Iquique (Chile) or Iquique. So the flag is the Port of Iquique.

Flag: Port of Iquique

Name: Crude Oil – Port of Inspection | Category: Maritime | 20 pts

Challenge: MMSI number is 273257030. Your task is to analyze the vessel’s historical activity and determine the port of inspection associated with the vessel on 24/11/2015.

Flag Format: Port of ABC

Once the MMSI number of the vessel is provided, the first step is to identify the ship’s name and IMO number. Using public maritime databases or a simple search query, the MMSI can be linked to the vessel KRASNOYARSK, with IMO number 9312896. These identifiers are important because most inspection and registry databases are indexed by IMO rather than MMSI.

After obtaining the IMO number, the next step is to investigate inspection records. One of the most useful resources for this is Equasis. Access to the platform requires a free account, after which you can search directly using the vessel’s IMO number.

Within the vessel profile, navigate to the Inspection section and review the historical inspection timeline. Matching the provided date, 24 November 2015, reveals the corresponding inspection location. The inspection record shows that the vessel was inspected at Whitegate, located in Ireland. Therefore, the correct answer is Whitegate, Ireland. So the flag would be Port of Whitegate.

Flag: Port of Whtiegate

Name: Crude Oil – Managing Logistics | Category: Maritime | 22 pts

Challenge: MMSI number is 273257030. Analysts require additional historical context regarding operational activity. Your task is to identify the company responsible for managing the logistics for the vessel on 20 April 2024.

Flag Format: Do not add the type of company. For example, if the answer is ‘Maltego Technologies GmbH,’ put ‘Maltego Technologies.’

To identify the company responsible for managing logistics, the investigation again pivots to Equasis using the vessel’s IMO number. After searching for the vessel profile, navigate to the Ship History section, which contains historical ownership, management, and company association records.

Within the Ship History tab, review the Company section and focus on the specific date provided in the challenge. Historical records often show changes in management, operators, and logistics responsibilities over time, so matching the exact date is important.

By locating the entry corresponding to 20 April 2024, the listed role under Ship Manager / Commercial Manager identifies the company responsible during that period. The historical record shows that the company responsible was Sun Ship Management.

Flag: Sun Ship Management

Name: Crude Oil – Inmarsat | Category: Maritime | 20 pts

Challenge: MMSI number is 273257030. You are to determine the Inmarsat satellite number associated with the vessel.

Flag Format: 123456789

This challenge requires pivoting from the vessel identifiers already gathered during earlier steps. Once the vessel name, IMO number, and MMSI are known, the next step is to investigate its communication and radio registration records. These details are often stored in international maritime communication databases rather than standard AIS platforms.

A useful source for this is the International Telecommunication Union maritime ship station database. By searching the vessel’s details through the ITU Ship Station search portal, you can retrieve communication-related information tied to the vessel’s registration. After querying the database using the vessel identifiers, the results page displays satellite communication records, including the associated Inmarsat satellite numbers. In this case, the entry appears as 427315325-26, indicating a range. This means the vessel is associated with two satellite numbers: 427315325 and 427315326.

Flag: 427315325 and 427315326

Name: Crude Oil – EPIRB Hex ID | Category: Maritime | 20 pts

Challenge: MMSI number is 273257030. Your objective is to identify the EPIRB Hex ID associated with the vessel.

Flag Format: 12345A67BCDEFGH (15-character long string).

Subsequently, within the vessel’s registration details, additional identifiers related to onboard safety equipment are displayed. One of these fields includes the Emergency Position Indicating Radio Beacon (EPIRB) Hex ID, which is used for distress signaling and emergency identification. By examining the ITU ship station record, the associated EPIRB Hex IDs for the vessel can be identified as 22247D80DEFFBFF and A229905C35034D1.

Flag: 22247D80DEFFBFF and A229905C35034D1

Name: Unknown Flight – 1 | Category: Aviation | 20 pts

Challenge: We intercepted this audio. Your task is to analyze and decode the audio and identify the flight number. The flag is the flight number.

The link to the audio file: https://drive.google.com/file/d/1Nh1DosJfKGDj1DsMRvNehr89Jpw78of_/view?usp=sharing

Flag Format: 6-alphanumerical characters

Once the WAV file is downloaded, listening to the audio reveals that it contains Morse code. You can then use a Morse code decoder to extract the hidden data from the audio. After uploading the audio file, you can obtain the following string: 8DAA8499213B7DF74C182003F0F9. As described in the challenge, we need to investigate aviation-related data. The extracted string is an ADS-B frame with CRC coding. We can decode it using an ADS-B decoder to retrieve the embedded aircraft information, including the registration number. After decoding the packet, the identification field reveals: N777SA.

Flag: N777SA

Name: Unknown Flight – 2 | Category: Aviation | 10 pts

Challenge: Search the flight records for the previously found flight on 15 April 2026. You need to identify the origin of the airport for the flight that arrived at Kentucky International Airport. The flag for this challenge is the ICAO code of the origin airport.

Once we identify the flight registration number as N777SA, we can begin investigating its flight history. Aviation tracking platforms maintain historical flight records, and one useful source is FlightAware. You can review the aircraft’s historical flight activity.

Search through the flight records for 15 April 2026. Locate the flight entry that traveled from Ted Stevens Anchorage International Airport to Cincinnati/Northern Kentucky International Airport. From the record, the origin airport is identified as: Anchorage Intl with the ICAO Code, PANC.

Flag: PANC

Name: Signal Decoding | Category: Aviation | 20 pts

Challenge: While intercepting a signal during an investigation, the following frame was captured: /QUKAXBA.ADS.G-VIIM07253457F7124540C8751F9C84. Analyze the frame and identify the Mode S hexadecimal code associated with it.

Flag Format: 123456

The intercepted stream of data is an ACARS/VDL Mode 2 transmission. By analyzing the frame structure, we can identify the aircraft registration number embedded within the message. From the frame, the registration number is: G-VIIM.

Once we have the registration number, we can search aviation tracking platforms such as Flightradar24 or other ADS-B data sources to gather additional aircraft details. By reviewing the aircraft information, we can identify the associated Mode S hexadecimal code: 400685.

Flag: 400685

Name: Lemon | Category: Vehicle | 10 pts

Challenge: Analyze the image provided and identify the seller’s name associated with the listing. The flag is the seller’s name.

Image link: https://imgshare.cc/4eb5gl6f

Flag Format: Do not add the type of company. For example, if the answer is ‘Maltego Technologies GmbH,’ put ‘Maltego Technologies.’

For the provided image, perform a reverse image search to identify where the image appears online. The results lead to a salvage or vehicle auction listing containing the same image. The matching listing can be found here: https://bid.cars/en/lot/0-43894600/2022-Mercedes-Benz-GLE-350-4JGFB4JB0NA578981. On the listing page, the seller’s information is displayed. The seller’s name shown is: Progressive Casualty Insurance.

Flag: Progressive Casualty Insurance

Name: A Bird’s Eye View – 1 | Category: GEOINT | 20 pts

Challenge: You are an analyst, and intelligence in the form of satellite imagery has been provided to you. Your task is to determine the exact coordinates of the location shown in the imagery, accurate to one decimal place. The flag is the coordinate pair.

Image link: https://imgshare.cc/44tkjqmk

Flag format: 12.7, 24.1

For the provided image, the first step is to determine the source of the imagery. The red hotspot blocks concentrated in a specific area indicate that the image originates from NASA FIRMS thermal mapping data.

By closely analyzing the image and performing a reverse image search, we can narrow down the geography. The visible coastline and waterway patterns suggest the location is near the Strait of Hormuz, close to Oman.

Next, navigate to the NASA FIRMS global map and select the date March 18th, 2026. In the same geographic area, the thermal activity dots visible on the map match the hotspots shown in the challenge image. By hovering over the matching hotspot location, the coordinates can be identified as: 26.4, 56.4.

Flag: 26.4, 56.4.

Name: A Bird’s Eye View – 2 | Category: GEOINT | 15 pts

Challenge: Analyze the image provided in the previous challenge and identify the name of the ship involved in the incident. Intelligence reports suggest that the vessel visible in the imagery had previously been involved in an earlier incident on March 4th before being targeted again later. The flag is the vessel’s name.

The key clue in this challenge is the reference to the ‘March 4th incident.’ This indicates that the investigation should focus on maritime incidents that occurred during the Iran–US/Israel conflict around that date.

By searching news reports related to maritime attacks in the region during early March 2026, we can identify vessels involved in incidents near the Strait of Hormuz. Recent reports show that the container ship Safeen Prestige was struck on March 4th and later appeared to have been hit again around March 18th during the escalation of attacks in the region. (Source: SAFETY4SEA)

By correlating the timeline mentioned in the challenge with the incident reports and imagery, we can determine that the ship involved is Safeen Prestige

Flag: Safeen Prestige

Name: Warning States | Category: GEOINT | 15 pts

Challenge: Analyze the provided image and determine the geographic coordinates of the marked red box location. Your answer must be accurate to three decimal places. The flag is the coordinate pair.
Image link: https://imgshare.cc/tybzfye8
Flag format: 12.345, 67.890

With the provided image, begin by performing a reverse image search to identify the location shown. The results indicate that the image is associated with the Natanz Nuclear Facility in Iran. Once the location is identified, use mapping platforms such as Google Maps or satellite imagery tools to inspect the facility in detail. The red box in the challenge image highlights one of the buildings within the complex that was reportedly damaged.

By placing a marker directly on the highlighted structure and reading the coordinates, the exact location can be determined as: 32.728, 51.723. These coordinates align with the broader location of the Natanz nuclear complex in Isfahan Province.

Flag: 32.728, 51.723

Name: Bad Manners – 1 | Category: Vehicle | 30 pts

Challenge: You have been provided with a new case to investigate. The only input available is the following: 4T1BF1FK1DU676960. Your task is to determine the type of violation that was charged on 23 March 2023.

Flag format: Violation Type

In the first challenge, we are provided with the sequence: 4T1BF1FK1DU676960. This is a Vehicle Identification Number (VIN). Decoding the VIN alone will not directly reveal the violation information, since VIN records are not always publicly linked to traffic citations. The first step is to search the VIN online to identify additional vehicle details. By doing so, we can locate auction or public vehicle records that associate the VIN with a registration plate and state. One useful source is the auction listing document from the New York City Department of Finance.

After matching the VIN to its corresponding registration number and state, the next step is to search for public violation records, using the recovered registration number and state information. This returns a list of recorded violations associated with the vehicle. By filtering the records for the specified date, 23 March 2023, we can identify the matching violation entry. The violation type listed for that date is: Obstruction Driveway.

Flag: Obstruction Driveway

Name: Bad Manners – 2 | Category: Vehicle | 15 pts

Challenge: Using the previously identified violation record, determine the exact location where the incident occurred. The flag is the location of the violation.

Flag format: street number, street name, city name.

Using the same violation record database from the previous challenge, continue reviewing the entry associated with the recovered registration number and the specified violation date. Within the violation details, the incident location is listed alongside the charge information. The location recorded for the violation is: 346, 39th Street, Brooklyn.

Flag: 346, 39th Street, Brooklyn

Name: Major Tom | Category: Aviation | 25 pts

Challenge: You have been selected for a special orbital mission. As part of the investigation, you are provided with a PDF file containing satellite data that is not immediately readable. Your task is to analyze the data and determine the maximum EPS sensor temperature recorded by the satellite on 21 April 2026. The flag is the EPS temperature value.

Image link: https://drive.google.com/file/d/1OdyHfyGrCSTMP20eazMsa2bcjq6CRg98/view?usp=drive_link

Flag Format: 12.3

In this challenge, you are provided with a PDF file containing unreadable data. Upon closer inspection, the embedded content is revealed to be Morse code. The first step is to decode the Morse code using an online translator such as a DNS Checker Morse Code Translator.

After decoding, the extracted content reveals TLE (Two-Line Element) satellite data. By carefully reviewing the TLE information, we can identify the NORAD catalog number associated with the satellite. The extracted NORAD ID is: 41789. Next, use the identifier to search the satellite database maintained by SatNOGS. satellite’s sensor, battery, and telemetry data. From the telemetry dashboard:

Select the date range for 2026-04-21
Review the EPS temperature data panel
Locate the reading corresponding to the required timeframe

The maximum EPS temperature value shown for the selected period is: 26.7

Flag: 26.7

Conclusion

That wraps up this walkthrough. Hopefully this gave you not only the solution, but also insight into the thought process and investigative techniques used along the way.

If you approached the challenge differently, found alternative paths, or discovered additional artifacts, share them with our Discord community! Different perspectives are what make CTFs valuable learning experiences.

More challenges, tips & tricks, and weekly OSINT exercises are coming soon. If you have any questions, reach out to community@marketing.com. Until then, stay curious, document your findings, and trust your investigative process.

Tracing the Nexus Between Forced Scamming and Child Sextortion

Fri, 22 May 2026 08:54:19 +0000

This blog was written by Chris Conrad from International Justince Mission (IJM). IJM is part of the Maltego Grants Program, and Chris works as an ILED Program Specialist supporting global programs focused on protecting and keeping communities safe.

International Justice Mission (IJM) combats violence by partnering with local authorities to rescue victims, support survivors, and strengthen justice systems. We address crimes of trafficking and slavery, violence against women and children, and police abuse of power by implementing our community protection model around the world. 

One of the crime types IJM seeks to address is an expanding form of labor trafficking called “Forced Scamming”. Over the past several years, IJM teams in Southeast Asia have observed the proliferation of scam compounds, in which trafficking victims are coerced into carrying out online fraud schemes. The scam operations are estimated to generate billions of dollars annually, and the organized crime groups behind these operations have subjected trafficking victims to grave abuses such as sexual exploitation, torture, and murder as a means of control. 

IJM assists forced scamming survivors who have escaped from these locations or were released after paying a ransom, and advocates for their rights within the justice system. This includes participation in formal victim identification processes and working closely with relevant embassies and agencies to facilitate the safe repatriation of survivors to their home countries. Through survivor interviews, IJM has also supported authorities with investigations into the criminal networks behind forced scamming operations throughout the region. 

Following the Digital Trail

In 2025, IJM received funding from Safe Online and the Thomson Reuters Social Impact Institute to conduct research into suspected ties between forced scamming and another emerging online threat, the financial sexual extortion of children. Through IJM’s work on forced scamming, analysts encountered repeated use of shared scripts in scam operations, resembling chat logs from child sextortion cases reported to the National Center for Missing and Exploited Children (NCMEC). Our research sought to answer the question: Can we identify cases of child sextortion linked to forced scamming compounds in Southeast Asia? 

NCMEC receives CyberTipline Reports from electronic service providers whenever they encounter evidence of online sexual exploitation or abuse of children. Through an analysis of more than 1.18 million CyberTipline Reports that included suspect IP addresses and internet connection timestamp data, IJM identified more than 18,000 CyberTipline Reports that shared IP addresses used by devices in 40 identified scam compounds. 

Our research team also compared internet connection timestamp data as part of the study to identify approximately 500 CyberTipline Reports most likely to be linked to forced scamming operations. The study has highlighted the need for investigators and researchers to continue exploring this nexus between forced scamming and sextortion cases and work together across crime types to address these growing online threats. 

Continuing the Investigation Using Maltego

IJM is part of the Maltego Grants Program, receiving access to Maltego products, including Data Pass. As a continuation of the investigation into forced scamming operations, we took 434 IP addresses linked to CyberTipline Reports and forced scamming compounds, then mapped them into a graph to visualize the connections and gain a clearer overview of the linked infrastructure.

Figure 1 IP address linked between child sextortion cases and forced scamming compounds

Some IP addresses also appeared in data leaks, raising a new question: “Could we identify these IP addresses in any data leaks, and pivot on additional information to identify specific entities tied to these incidents?”

Using DarkOwl’s Transform within Maltego, we pulled in matching data leak records for the IP addresses and examined the associated online services. Scam compounds in Southeast Asia are known to use online dating platforms, gambling services, and AI-generated imagery as part of their operations, which was reflected in several of the data leaks we observed. We focused on data leaks from these types of online services to get a picture of the connections.

Figure 2 IP addresses from IJM's research found in data leaks from online services plausibly used in forced scamming operations

This process has allowed IJM to triage IP addresses and continue investigating the associated email addresses, phone numbers, and online identities. The goal was to continue generating a multi-layered picture of how forced scamming compounds operate, and provide credible leads to our partners in government and technology so they can address the nexus between human trafficking and online scams. 

Conclusion

IJM’s research highlights how online scamming networks are closely tied to human trafficking and child sexual extortion incidents. With support from the Maltego Grants Program, IJM can continue investigating these networks by turning single leads from internet infrastructure data into meaningful investigative insights.

For more information and to read IJM’s full report, please visit: https://www.ijm.org/nexus-financial-sextortion-children-forced-scamming

Case Study: BASF Protects People, Brand, and Corporate Assets with Maltego

Thu, 21 May 2026 09:49:48 +0000

Corporate security teams play a critical role in helping large organizations protect employees, safeguard assets, and reduce financial, reputational, and compliance-related risks.

At BASF, one of the world’s largest chemical companies, the Investigations team supports corporate security efforts by helping the organization understand incidents, act on findings, and protect what matters most.

How Maltego Became Part of BASF’s Investigation Toolkit

Before adopting Maltego, investigators relied on largely manual OSINT processes. Research depended heavily on each investigator’s individual methods, source familiarity, and experience, which made it harder to work in a consistent and structured way across cases.

With Maltego, BASF gained a more flexible and reliable way to bring internal context and open source intelligence together. The platform helps the team build a clearer picture of incidents, identify relevant relationships, and document findings in a way that is easier to communicate and defend.

“Maltego stood out to us as the all-round solution we were looking for. It brought together different capabilities in a way that worked neatly for our investigative needs."

— BASF Investigations

Download the full case study to learn more about how BASF uses Maltego to:

Address investigative challenges in corporate security
Support better-informed decisions in internal investigations
Apply Maltego solutions in real-world investigation examples

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Enjoy exploring the resource!

How Maltego Shaped the Work of ItalianCyberTeam

Tue, 05 May 2026 15:49:24 +0000

This blog was written by Flavio Critelli of the University of Perugia and co-founder of Italian Cyber Team. He is part of the Maltego Grants Program and works at the intersection of OSINT, threat intelligence, and investigative training for academic, law enforcement, and military audiences.

There is no shortage of data in modern investigations. If anything, the challenge is the opposite. For those of us working in OSINT and cyber investigations, the real problem is fragmentation. Signals are scattered across platforms, buried in webpages, and hidden behind layers of noise. The task is not about finding more information, but about connecting it, structuring it, and making sense of it. For us at Italian Cyber Team, this challenge became a turning point.

Before adopting Maltego Graph, our investigations relied on a combination of tools, manual processes, and analyst intuition. Valuable insights were often there, but difficult to surface consistently. Maltego introduced something fundamentally different. It allowed us to see data as a network rather than isolated fragments. Relationships became visible, patterns began to emerge, and what was once a scattered collection of findings transformed into structured results.

This shift reshaped how we approach investigations. It is no longer about chasing individual data points, but about building and navigating the intelligence cycle.

Building a Methodology, Not Just Using a Tool

As our work evolved, Maltego Graph became more than part of our toolkit. It became the foundation of our methodology.

We introduce it at the very start of our training programs, using it as the core framework for OSINT, Information Gathering, and Threat Intelligence. While the learning curve can feel steep at first, once the logic and goal become clear, the transformation is immediate. Analysts begin to think differently. The question shifts from “Where do I search?” to “How are these elements connected?” We did not stop at using Maltego out of the box. We built on it.

Recognizing that data collection is only one part of the intelligence process, we developed custom capabilities to push deeper into analysis and insight generation. One of our key developments was creating custom Transforms using the open-source TRX library to pull full webpage text directly into the Maltego canvas as Entities. This adds a new layer of analytical depth. Once the full content of a page is embedded into the graph, we can then run refined queries against it using Transforms, to extract specific information, identify key data points, or evaluate the relevance of the content to an investigation.

Figure 1: Connecting the Dots Across Multiple Sources

This allowed us to move beyond collecting data from disparate sources into something far more powerful: systematic analytical reasoning in one place.

Figure 2: Custom Transforms for ICT Investigations Querying Article Details

From Classroom to Operations: Real-World Intelligence Impact

In the classroom, students learn to approach investigations visually and analytically, developing skills that reflect real-world investigation work. In operational environments, investigators can navigate complexity with greater clarity, reduce noise, and focus on what truly matters. The result is faster, more confident decision-making.

Perhaps most importantly, Maltego has allowed us to scale our thinking. What was once limited by human bandwidth can now be expanded through structured workflows and automation. Thanks to the open-source framework, the ability to design custom data integrations, and the freedom to develop our own databases, it offers unmatched capability to support a wide range of specific intelligence objectives.

Each connection not only improves our workflow, but deepens our understanding of how intelligence is constructed and connected. Maltego is no longer just a tool in our process, it is the environment in which our investigations take shape, where data becomes insight, and where analysts learn to think in connections rather than fragments.

From academic research to real-world investigations, it has fundamentally reshaped how we work and, in a landscape, defined by complexity, that clarity is everything. We are grateful to the Maltego Grants Program for their support, which has enabled us to expand our work, enhance our methodologies, and continue training the next generation of investigators.

References:

You can explore some of our course materials here
Our full contribution is published here on Github

7 Practical OSINT Lessons from the Ukraine War

Mon, 20 Apr 2026 12:12:10 +0000

How Open-Source Intelligence Is Applied in Modern Warfare—and What Investigators Can Learn

The war in Ukraine has marked a turning point for open-source intelligence (OSINT). What was once seen as a supplementary or less trusted discipline within military intelligence has rapidly evolved into a critical component of the modern information environment. Driven by unprecedented volumes, OSINT has proven its value in providing early indicators of military activity, supporting both strategic planning and operational decision-making when integrated with other intelligence streams. It enables analysts to monitor events in near real time and extends beyond the battlefield, empowering journalists and investigators to shape public understanding, document conflict, and support the attribution of war crimes.

At the same time, this shift has introduced new challenges. Analysts must navigate information overload, counter manipulation, and manage cognitive bias in an increasingly complex landscape. Drawing on lessons from the Ukraine war, this paper distills seven practical lessons, each paired with a clear takeaway, to help military analysts apply OSINT more effectively in their work.

DOWNLOAD WHITEPAPER

The First Digitally Transparent War

Modern conflicts now unfold across both physical and digital battlespaces. The war in Ukraine has generated an unprecedented volume of publicly and commercially available information, from social media and messaging platforms to satellite imagery and crowdsourced reporting. At the same time, the rise of advanced OSINT platforms has made this data more accessible and actionable, enabling analysts to produce near-real-time threat assessments across government, commercial, and independent communities.

This constant flow of information has created a new reality. Battlespaces are persistently observed, but information moves faster than it can be verified. Narratives spread as quickly as facts, forcing analysts to operate in a contested environment where data is both an advantage and a vulnerability.

As a result, OSINT is shifting from a supporting role to a foundational layer of intelligence. However, this evolution brings new challenges, including information overload, manipulation, and cognitive bias. To remain effective, analysts must adopt new tradecraft by moving from collection-centric models to validation-centric workflows, from linear analysis to iterative synthesis, and from isolated work to networked collaboration.

Social media platforms have become critical sources of open-source information in modern conflicts. During the war in Ukraine, soldiers, civilians, journalists, and military bloggers continuously shared images, videos, and commentary from the battlefield. In some cases, units such as the Kadyrovtsy revealed their own locations through posts on platforms like TikTok and Instagram, enabling analysts to geolocate and track their movements, even if the extent of direct operational use remains unclear.

Platforms like Telegram and VKontakte generated particularly large volumes of data. Telegram emerged as a central hub due to its channel structure and limited moderation, while VKontakte supported recruitment, propaganda, and also exposed geotagged information useful for identifying troop positions and logistics. Other platforms such as TikTok, YouTube, and X contributed additional streams of high-resolution footage and analytical insights.

Together, these platforms act as a distributed sensor network, producing vast amounts of real-time information on battlefield activity.

Tips

Best practices for collecting, analyzing, and verifying social media begin with treating it as a structured intelligence discipline rather than an informal or retrospective source. OSINT collectors, collection managers, and analysts should work together to define priority platforms, channels, hashtags, and accounts as formal collection requirements, supported by continuous monitoring instead of ad hoc searches. If you want to find out more about best practices for analyzing and verifying social media, download our whitepaper.

Download the Whitepaper

This whitepaper distills seven practical lessons from the Ukraine war on how OSINT is used in hybrid warfare. It goes beyond highlighting successes and instead provides best practices to help analysts overcome key analytical and verification challenges.

What’s included:

Why the Ukraine war is the first digitally transparent conflict
What effective intelligence analysis looks like in the modern era
Seven key lessons from the war
How analysts should integrate OSINT into their workflows

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Stay up to date with the latest news and events on LinkedIn. To take part in Community OSINT CTF, OSINT101, and weekly challenges, join our Discord.

Enjoy exploring the resource!

Cybersecurity as Strategic Security: How Investigative Platforms Must Evolve

Tue, 17 Mar 2026 10:48:47 +0000

In February 2026, Munich once again became a focal point for global security dialogue. The Munich Cyber Security Conference and the Munich Security Conference brought together policymakers, security leaders, and technology experts to examine the rapidly evolving security landscape.

Across both conferences, one theme stood out: cybersecurity is no longer viewed solely as a technical or risk management challenge. It is increasingly treated as a matter of national resilience and strategic security.

For organizations building security and investigative technology, these conversations carry growing strategic importance. As a platform used by investigators worldwide, Maltego closely follows how global security priorities are evolving and what they mean for the future of open-source intelligence (OSINT), investigative workflows, and the tools analysts rely on to make sense of complex information environments.

Following the conference, investigative OSINT reporter and professor Gisela Pérez de Acha, formerly with the UC Berkeley Human Rights Center, spoke with Maltego CEO Philip Mayrhofer to discuss his key takeaways from the event and his philosophy on designing and governing what is ahead for Maltego. If you’d rather read the script instead of watching the video, click here.

Since 2008, Maltego has supported mission-critical investigations worldwide, helping investigators across law enforcement, defense and military intelligence, government agencies, and the private sector turn complex data into actionable intelligence.

Over time, this mission has driven the continuous evolution of the platform. The launch of Maltego One in late 2025 reflects that direction, helping investigators focus on analysis and uncover the truth faster and with greater clarity in the browser through built-in data access, end-to-end encryption, guided workflows, and an AI Assistant.

These advancements have been made possible thanks to the Maltego community—researchers, journalists, investigators, and public institutions who use the platform and continuously push the boundaries of what investigative technology can do. We believe the future of investigations will continue to be driven by this collective effort. If you are part of the OSINT community, we invite you to join the conversation, share your expertise, and help advance investigative work.

New to Maltego? Try it for free and see why more than 200,000 investigators worldwide rely on Maltego for their investigations.

Key Questions and Answers

Gisela: What do you enjoy most about your job?

Philip: What drew me to Maltego was the product, the team, and the community. I love that the platform helps investigators make sense of complex information, and it is exciting to support people doing meaningful work. I also use Maltego myself to organize investigations and map out possibilities, so I understand its value firsthand.

Gisela: How did the key topics at the conference influence your thinking about building technology?

Philip: A major takeaway was the speed of change, especially with generative AI. It is creating both new threats and new opportunities, and that is accelerating everything. It feels like an arms race between threat actors and defenders, not only in cybersecurity, but also in misinformation and influence operations. Another important shift was how openly state actors were being called out, especially around attribution. There was also a stronger push for proactive rather than purely defensive security.

Gisela: How do you see the boundary between supporting journalists and investigators, and influencing public policy?

Philip: I do not see these groups as having very different goals. Whether it is governments, journalists, or researchers, the core objective is the same: to uncover the truth and separate fact from falsehood. The technology needed to do that is often the same. Our role is to help level the playing field so that democratic institutions, public bodies, and independent investigators have access to strong investigative tools.

Gisela: Where is the biggest disconnect between high-level geopolitical discussions and the daily work of investigators?

Philip: There is always political rhetoric at the top, but what reassured me was the strong willingness among researchers, investigators, and intelligence communities to keep collaborating. That practical cooperation matters a lot. At Maltego, we believe in supporting that collaboration through community, events, and the platform itself.

Gisela: Where does AI genuinely help investigations, and where does it create risk?

Philip: AI is already very useful for extracting information from unstructured sources like PDFs, media, and large volumes of content. It also helps with summarizing and analyzing information faster. Where we are heading next is recommendation systems that suggest what investigators should look at next. But AI must support the workflow, not replace judgment. The risk is overconfidence, noise, or losing sight of the evidence behind a conclusion.

Gisela: How do you handle attribution and transparency when AI is involved?

Philip: Source transparency is critical. In cases where AI helps analyze unstructured content, investigators still need to see where the outputs came from. In Maltego, this is especially important in the Graph, where data lineage shows how entities and connections were built. That traceability is a major priority because investigators need to verify, explain, and defend their findings.

Gisela: What decisions should remain human?

Philip: Final judgment must remain human, especially when it comes to attribution. In investigations, attribution can lead to serious consequences, so a human has to stay in the loop. We also draw clear red lines around areas like autonomous weapons and mass surveillance. AI can support the process, but not replace accountability.

Gisela: What does digital sovereignty mean to you?

Philip: To me, digital sovereignty is about transparency and control. It means knowing what the software is doing, having control over your data and results, and deciding where the infrastructure and investigative work are hosted and operated. Security and interoperability are also key parts of that.

Gisela: What kind of investigations did you do before Maltego, and how does that shape your work now?

Philip: I come from a research background and did a PhD in economics, which involved a lot of data analysis. That experience gave me a strong appreciation for how hard it is to work through large, messy datasets and how important good tools are for helping researchers stay focused and effective.

Gisela: Does digital fragmentation undermine investigative effectiveness?

Philip: Yes, but that has always been part of the challenge. Investigators rarely get neatly packaged information. The real challenge is defining the haystack before finding the needle. What has changed now is the scale and speed of information. AI is making that volume even larger, which means investigators need better tools to handle it.

Gisela: What strategic qualities will define cybersecurity companies that last?

Philip: The biggest differentiator will be trust. Access to AI is becoming easier for everyone, so the technology itself is not enough. What matters is whether a company can deliver reliable outcomes, work responsibly with experts, and build tools people trust. Human connection also matters. Strong communities, real collaboration, and openness will become even more important.

Gisela: What makes a platform truly support investigations instead of just aggregating data?

Philip: A meaningful platform helps patterns emerge. It allows investigators to see connections, outliers, and insights that matter. It also supports precise pivots rather than overwhelming users with endless data. At the same time, it needs to stay open and extensible so the community can build on it. Going forward, platforms also need to work well with AI agents, while keeping human judgment at the center.

Gisela: What advice would you give OSINT researchers today?

Philip: Stay curious and keep using strong judgment. Those are the qualities that will continue to matter most. At the same time, stay open to new tools and new ways of working, because the field is changing quickly.

Continuing Online Trade of Monitor Lizard Body Parts

Wed, 25 Feb 2026 15:33:45 +0000

An OSINT and Maltego Case Study from India

This blog was written by the Wildlife Crime Control Division of Wildlife Trust of India (WTI), a valued partner in the Maltego Grants Program, working at the intersection of conservation and digital investigation to combat wildlife crime.

The investigation did not begin with a raid, a whistleblower, or a tip-off. It began with something subtler: a design pattern. While monitoring online spaces for illegal wildlife trade (IWT), our team at WTI, noticed that three separate websites selling so-called “spiritual” products looked almost identical. Two of them even used the exact same product photograph. All three claimed to offer “Hatha Jodi,” a rare plant root believed to bring prosperity. But what was being sold was not botanical at all.

The items matched the appearance of dried hemipenies of the Bengal monitor lizard — a protected species under Indian law (Schedule I of the Indian Wildlife Act, 1972). The trade in these body parts has long been documented in India, often masked as spiritual or ritual artefacts to obscure their true origin. Over a 12-month monitoring period, we tracked 1,245 social media and e-commerce posts linked to illegal wildlife trade. Approximately 9% were associated with Bengal monitor lizard body parts.

From Open Advertising to Concealed Networks

In the early phase of monitoring, sellers operated with surprising openness. Phone numbers were publicly displayed. Some even included postal addresses in website contact sections. Transactions were initiated through visible WhatsApp numbers.

As enforcement efforts by Indian authorities intensified, behaviour shifted. Phone numbers and addresses disappeared from public listings. Sellers increasingly moved conversations to private direct messages. On websites, visible contact information was reduced to generic email addresses.

This evolution created a significant challenge: surface-level monitoring was no longer sufficient. We needed to move from observation to structured open-source intelligence (OSINT) collection and analysis.

The Digital Thread: Pivoting Through Infrastructure

The three visually similar websites became our entry point. Closer inspection revealed that all three were powered by the same e-commerce platform provider. Two reused the same product image. This strongly suggested operational overlap rather than coincidence.

From earlier monitoring, we had collected three phone numbers linked to these sites. These became our initial pivot points. Through the Maltego Grants Program, we used Maltego to query those phone numbers and surface additional identifiers. From just three initial numbers:

Two returned rich results
Three additional phone numbers were uncovered
Four previously unseen email addresses were identified
Five total phone numbers were linked to one specific website

One email address, used repeatedly as a “support” contact, became a critical anchor. It was connected to multiple domains, phone numbers, and communication channels. What began as three suspicious websites evolved into a growing digital infrastructure map.

Geographic Spread: Not a Local Operation

Prior contextual clues suggested that the traders were operating from a specific Indian city. However, by correlating:

Telecom provider data
Location fields from mapping services
Profile metadata
Platform-linked identifiers

We identified connections extending into two additional Indian cities in entirely different regions. This was not an isolated local seller. It was a distributed operation. The geographic spread pointed to organized networks operating across urban centres, increasing both scale and complexity.

The Human Layer Behind the Network

Digital infrastructure tells only half the story. By combining caller ID labels, communication platform profiles, and professional networking traces, we identified three likely individuals behind the activity — two women and one man. In one case, a professional networking profile linked to a key email address revealed employment details that helped us understand how legitimate and illicit digital footprints intersected.

Multiple phone numbers, multiple emails, overlapping social accounts — these patterns pointed toward an organised and adaptive structure rather than opportunistic selling. The actors were not merely listing products. They were managing infrastructure.

With these findings, WTI works closely with law enforcement agencies to disrupt illegal activity and protect vulnerable wildlife. In our investigations, Maltego significantly reduced investigative time, playing an essential role in identifying networks and supporting enforcement action.

Maltego and Mercyhurst University’s CIRAT Collaborate on OSINT Challenge Development for Community CTF

Wed, 04 Feb 2026 07:21:05 +0000

February 4, 2026

Mercyhurst University’s Center for Intelligence Research, Analysis, and Training (CIRAT) has been a partner in Maltego’s Grants for Education and Research programs for the past two years. Building on this ongoing collaboration, CIRAT and Maltego have strategically partnered to co-deliver an Open-Source Intelligence (OSINT) Capture the Flag (CTF) challenge designed to strengthen applied investigative skills.

The Maltego Community OSINT CTF will take place on February 7, 2026, running for four hours starting at 09:00 ET (15:00 CET), and will be accessible online to participants worldwide. This collaboration brings together CIRAT’s renowned academic expertise with Maltego’s role as a global platform for investigators, providing the stage for practitioners worldwide to apply, test, and share investigative methods.

“We are honored to partner with Maltego in providing our expertise in open-source intelligence for this event,” said Brian Fuller, Executive Director of CIRAT. “The Mercyhurst University Intelligence Studies Program graduate students, led by Brandon Mazzei, contributed the open-source dataset for the Maltego Capture the Flag event, demonstrating the depth of academic skill and practical application. We look forward to supporting Maltego in delivering a challenging and engaging experience for participants from the global intelligence community.”

As OSINT continues to mature as a discipline, CTF challenges have become a prominent feature of leading security conferences and industry forums, offering a practical and engaging way to develop investigative skills by placing participants in realistic, time-bound scenarios that bridge the gap between theory and practice. The Maltego Community OSINT CTF advances this approach through collaboration with CIRAT, mapping academic curricula and research initiatives into practical, real-world investigation scenarios for OSINT practitioners worldwide.

“Maltego has been part of the OSINT community from the start—we’ve supported frontline investigators and organizations like Bellingcat for years,” said Lukas von Grebmer, VP of Marketing & Growth at Maltego. “Our partnership with CIRAT builds on that. We’re designing challenges that reflect how investigators actually work, not just how they’re taught.”

He added, “The CTF brings together students, researchers, and professionals to test real methods, share insights, and learn from one another. It’s practical, collaborative, and exactly what this space needs.”

The Maltego OSINT Community CTF brings together investigators, researchers, and students worldwide in a collaborative environment built around real-world investigative challenges. Participants exchange expertise, work through complex scenarios, and form professional connections that extend beyond the event itself. Designed for all experience levels, the CTF supports skill development while reinforcing collaboration across the global OSINT community.

Those interested in testing and developing their OSINT and investigative skills can register for the event here. The event is open to participants of all skill levels and offers a chance to engage with a diverse, international network of investigators and OSINT practitioners.

About the Maltego OSINT Community CTF

Designed by CIRAT in collaboration with graduate students and faculty, the challenge content reflects industry best practices and applied research methods. Open to participants of all skill levels, the second edition of the event offers a global, interactive environment that brings the OSINT community together in one place.

The Future of OSINT

Thu, 08 Jan 2026 09:07:41 +0000

Analysts Are at an Inflection Point

Maltego is uniquely positioned to observe how the open-source intelligence (OSINT) landscape is evolving across industries, regions, and investigative use cases. The pace of change is faster than ever, driven not only by technological advances but also by the growing recognition and acceptance of OSINT’s value and relevance across a widening range of industries and applications.

At the heart of these changes is a fundamental shift in the role of the analyst. As AI and automation absorb much of the traditional analytical workload, the analyst’s role is being redefined. At the same time, the intelligence ecosystem is steadily converging, with OSINT increasingly integrated and consolidated with other intelligence domains—human, signals, imagery, geospatial, and more—toward a fusion-intelligence future.

The whitepaper examines the shifts of OSINT, how these changes are shaping analysts today and in the years ahead, and why they demand not just awareness, but concrete preparation and a clear understanding of where analysts add value, supported by a self-assessment checklist to help organizations evaluate their readiness. OSINT practitioners who understand what is changing and why it matters now will be better positioned to stay ahead of emerging challenges and innovations.

DOWNLOAD WHITEPAPER

The Current State of OSINT

The defining shift in modern OSINT is the move beyond traditional collection and analysis toward AI-enabled, automated, and increasingly consolidated intelligence environments. Analysts now operate in an ecosystem where social media platforms restrict access, data appears and disappears in real time, and content spans text, images, video, and live streams. The growing volume of synthetic and AI-generated content further complicates verification and attribution.

At the same time, the expansion of investigative tooling, combined with automation, machine translation, and AI capabilities that can process slang, emojis, mixed languages, images, and video at scale, has fundamentally lowered the cost of analysis and increased speed. Together, these developments have reshaped OSINT into a new generation of intelligence practice, significantly increasing efficiency for analysts. But this does not mean the role of the analyst has become easier. It is precisely this reality that motivated us to write this whitepaper on the future of OSINT.

Why Predicting the Future is Difficult

What makes this moment particularly unsettling is that OSINT is evolving in ways that make it increasingly difficult to define. The field is complex, fluid, and often obscured, and the future promises even greater complexity. While current trends may offer useful signals, paradigm-shifting developments are challenging long-held perceptions of OSINT. The explosion of publicly accessible data and the ongoing digital revolution have the power to redefine the field almost overnight.

This whitepaper does not claim to present a single, definitive vision of what comes next. Instead, it provides a clear breakdown of how OSINT has evolved, identifies the core characteristics shaping its trajectory, and offers practical guidance for analysts, including a ready-to-use checklist, to help organizations prepare for an increasingly fast-changing and uncertain environment.

Download the Whitepaper

This whitepaper is designed as a preparation tool for the future of OSINT. Whether you’re new to the field, a seasoned investigator, a long-standing leader in the OSINT community, or responsible for teaching and training analysts, it equips you with the insights and practical tools needed to navigate these changes with confidence.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Too busy to read the full whitepaper? Watch a 30-minute live briefing here with the author, covering key insights and answering audience questions during the live Q&A.

Stay connected with us on X and LinkedIn, and subscribe to our email newsletter to stay updated with the latest news and developments.

Enjoy exploring the resource!

17 Leadership Lessons from 17 Security Leaders

Tue, 02 Dec 2025 16:55:42 +0000

The Human Element Podcast was created to share the stories of security leaders who put people at the center, something our industry can always benefit from. In each episode, our CTO, Ben April, sits down with industry leaders who have faced high-stakes challenges, made decisions with incomplete data, and navigate real-world consequences.

These conversations go beyond technology to highlight the people, stories, and lessons that drive the industry forward. Whether you’re guiding a team today or preparing to step into leadership tomorrow, these conversations are designed to inspire, inform, and empower security leaders at every stage.

Today, we’re sharing an eBook that brings key insights from each episode into one place. Rather than repeating generic leadership advice, it offers practical, experience-driven guidance on making difficult decisions, leading teams under pressure, and navigating real-world crises. These lessons come from lived experience, not theory, practical insights that current and emerging leaders can adapt to strengthen their teams and build more resilient organizations.

Download the eBook for free below. No sign-up is required.

DOWNLOAD EBOOK

Discover the full stories and insights from more security leaders shaping success — listen to the podcast here.

Introducing a New Investigation Platform: Maltego One

Mon, 27 Oct 2025 10:04:13 +0000

We have exciting news to share! With Maltego One, more users can now solve complex cases directly in their browser. In the video below, hear from Maltego’s CEO, Philip Mayrhofer, and CTO, Ben April, as they introduce Maltego One and explain how it makes investigations more accessible and intuitive, helping you solve cases with ease.

Born from Investigators’ Needs: The Story of How Maltego One Came to Be

The OSINT landscape is evolving rapidly, emerging as a critical data category defined by its dynamic and diverse nature. As the volume and complexity of investigative data continue to grow, analysts increasingly need tools that allow them to work seamlessly across a wide range of use cases-from complex, high-stakes investigations to real-time monitoring.

With Maltego One, we are bringing these capabilities together in a single, unified platform.

The initial launch focuses on Person of Interest (POI) investigations, marking a major milestone in making advanced OSINT analysis accessible to a broader range of investigators and serving as a foundation for what’s to come in 2026 and beyond.

Future updates will introduce deeper integrations across Maltego’s product suite, enhanced tools and features, and expanded data sources that extend far beyond POI use cases. Together, these advancements will support comprehensive, end-to-end investigative workflows across diverse domains, disciplines, and levels of expertise.

Watch the Video Now!

Too busy to watch the video? Just remember this! From link analysis in the browser to built-in data, guided Transforms, and an AI Assistant, Maltego One is designed for those who want to:

Investigate faster and smarter—access all Maltego browser tools with a single login (Maltego ID), anytime and anywhere.
Stay consistent and confident in a unified workspace that supports investigators of all levels with intuitive workflows and reliable outputs.
Skip the initial setup: no manual installations on desktops or integrations needed to access high-quality, relevant data for complex, high-stakes investigations.
Keep the investigations safe and compliant with end-to-end encryption and secure case management.

To get started with Maltego One and see firsthand how it simplifies Person of Interest investigations, watch the recording of our latest webinar here.

Exposing Pig Butchering Operations with Maltego

Wed, 01 Oct 2025 10:11:37 +0000

What began as an investigation into an investment scam reported on the State of Wisconsin Department of Financial Institutions’ Investment Scam Tracker portal led to a deeper discovery: numerous scam scripts, guides for scripted conversations, Telegram channels with hundreds of users, and the identification of a broader scam operation offering “scam-as-a-service” businesses, potentially involving countless victims.

This report does not aim to retell what pig butchering scams are. The topic has already been widely covered in articles, reports, and the media. Instead, the report analyzes the tactics, techniques, and procedures (TTPs) revealed through Maltego and provides clear investigative tips and workflow for these scams. Rather than just naming the scammers, we examine how they operate so investigators can reproduce the process, adapt it to their cases, and work across sectors to better disrupt scam networks. Get the report for free below, no sign-up needed.

If you’re a Maltego customer or work in law enforcement, submit the form using your business email here. We’ll send you the Maltego graphs and compiled scam scripts to support your further investigation.

GET REPORT FOR FREE

Part of the investigation was carried out on Maltego’s new web platform, which combines investigation and admin tools, including link analysis, into one browser-based workspace under a single Maltego ID. To see how Maltego One makes Person of Interest investigations simpler, watch the recording of our webinar here.

Stay safe out there!

Why Modern Person of Interest Investigations Struggle at Scale

Thu, 18 Sep 2025 12:11:46 +0000

In every cybercrime unit, Person of Interest (POI) investigations are at the core of daily casework. A POI might be a suspect, a victim, or even a witness, but in every case, investigators need to map their connections, behaviors, and digital traces to move a case forward. These investigations start in two ways: proactively, by watching digital spaces for early warning signs, or reactively, after an incident where speed and accuracy matter most.

What looks simple on the surface is one of the most resource-intensive and complex parts of modern law enforcement. The fragile nature of digital evidence, easily altered, deleted, or lost, combined with today’s overwhelming data volumes, makes these investigations particularly challenging. In this article, we’ll explore the trends shaping POI investigations, the challenges they create, why it matters now, and how agencies can prepare for the future.

Executive Summary

Person of Interest investigations are becoming increasingly complex as law enforcement navigates massive digital footprints, rising information noise, and systemic resource constraints. Many agencies face challenges not only in the investigations themselves but also in how units are staffed, trained, and supported. These hurdles, ranging from skills gaps to technology shortfalls, directly impact the quality and timeliness of case outcomes. At the same time, global trends such as encrypted communications, synthetic media, and overloaded investigators are raising the stakes. Recognizing these challenges is the first step toward building more resilient, scalable, and future-ready investigative capacity.

Understanding Modern Person of Interest Investigations

A Person of Interest (POI) investigation focuses on gathering, analyzing, and connecting information about an individual who may be relevant to a case, threat, or incident. A POI is not always a suspect. They might also be a victim, a witness, or someone who can provide crucial context to an investigation.

Today, these investigations are inherently digital. They involve identifying a person’s online presence, mapping their connections with other people, organizations, or networks, and analyzing their digital footprint across platforms such as social media, forums, breach data, public records, internal data, and other open sources. The goal is to assess risk or relevance: Does this person pose a security threat, have ties to criminal activity, or hold valuable intelligence?

Social media and online platforms are now central to almost every criminal case, but the digital landscape has never been harder to navigate. In 2025, more than 35 platforms and forums each attract over 100 million monthly users. Posts and accounts can disappear in seconds, fake or automated profiles distort reality, and AI-generated content fuels waves of fake news and disinformation.

Beyond social media, investigators face encrypted messaging apps that conceal communications, massive breach datasets that are nearly impossible to filter for relevance, and public records scattered across outdated or fragmented systems. In just the first six months of 2025, organizations reported 1,732 data breaches — more than eight every single day. All of this is compounded by overwhelming data volumes, making it increasingly difficult to separate meaningful intelligence from digital noise. Continue reading to learn more!

Watch the video to see how Maltego helps uncover the full story of a person’s digital presence. Starting from a single clue and expanding into their entire network of connections:

The Complexity Slowing Down Today’s Cybercrime Units

The fundamentals of investigative tradecraft haven’t changed, but the environment around them has. Several trends are converging:

Overwhelming scale and speed: Almost every POI leaves behind a massive and fragmented trail across the surface web, like social media, messaging apps, and public forums, as well as the dark web, where encrypted platforms and hidden marketplaces conceal critical activity. This scale makes it easy to miss critical signals and find relevant intelligence.
Information quality crisis: Open sources are powerful but noisy, blending reliable intelligence with disinformation, synthetic media, and deliberate obfuscation. Generative AI now acts as a force multiplier for these campaigns, flooding investigators with viral falsehoods and increasing the risk of chasing dead ends. This is where a trusted investigative platform makes the difference: by integrating high-quality internal and external databases directly into the workflow, analysts can anchor their work in verified intelligence.
Time pressure: Digital evidence is fragile. It can be altered, deleted, or disappear entirely within minutes. Yet modern POI investigations are anything but fast. Analysts must sift through data from dozens of platforms, verify the authenticity of each piece, and preserve it in a way that will hold up in court. These steps take time, and every delay increases the risk of losing key leads, missing critical context, or ending up with evidence that cannot be used in prosecution.
Legal restrictions: Different privacy and data protection laws apply across jurisdictions. In Europe, GDPR requires investigators to demonstrate a lawful basis before processing or storing data. In the U.S., a patchwork of federal, state, and contractual rules, plus risks under the CFAA or website terms, can stall investigations or trigger legal challenges. As a result, analysts spend valuable time on compliance hurdles instead of connecting leads.

These factors create a paradox: analysts have more data than ever, but less clarity and certainty in their work. So far, we’ve looked at challenges during investigations caused by external factors like today’s digital environment. But there are also systemic problems, such as limited resources and an unprepared workforce for a digital-first world, that begin before an investigation even starts and affect every stage of the casework.

The Systemic Hurdles Undermining Person of Interest Investigations

The success of a cybercrime unit is often decided before an investigation even starts. Deep-rooted systemic issues inside law enforcement create constant shortages of people, skills, and resources, that slow down, weaken, and limit the quality of their work.

Lack of adequate resources and skills: Chronic underfunding and ongoing staffing shortages prevent units from adopting new tools or building deep expertise in specific platforms, criminal methods, or geopolitical regions. A 2024 Europol and Eurojust report on common challenges in cybercrime confirmed that many EU agencies lack sufficient staff, especially in specialized roles. As a result, analysts are forced to act as generalists, constantly jumping between disparate, complex cases. This constant switching takes a heavy mental toll, leading to fatigue and errors. A 2023 study found that 41% of fraud cases and nearly 97% of sextortion spam incidents were interconnected when case data was correlated.
Staffing misalignment: Many OSINT analysts or investigation experts are staffed through internal transfers rather than skills-based recruitment. This means investigators often arrive without the necessary technical or digital literacy, such as social media or advanced cryptocurrency tracing, creating steep learning curves and stalled casework.

With a fast-changing digital environment and persistent systemic hurdles, investigations may succeed on a small scale but break down when stretched across hundreds of POI. Without a platform that scales investigations with automation, connects to diverse and reliable data, integrates high-quality internal databases, and enables teams to capture and share insights, collaboration stalls, and knowledge stays siloed at the individual level. Even with intuitive tools, if they are not designed to scale with the complexity of person-of-interest investigations, analysts end up juggling demands and requests, jumping between cases, and missing critical connections.

Why Addressing These Challenges Can’t Wait

Left unaddressed, these challenges don’t just slow investigations. They create serious risks, and the stakes are clear: cybercrime damages are projected to reach $10.5 trillion by 2025 and could reach as high as $15.63 trillion by 2029. The bigger issue is that missed leads and prematurely closed cases leave offenders free while victims lose faith in the system. Overworked investigators can’t maintain high performance — leading to burnout, fewer results, and lost trust from management. Meanwhile, criminals move faster with encrypted platforms, burner accounts, deepfakes, and social engineering, while law enforcement struggles to keep pace. The cost of inaction is not just inefficiency; it is mission failure.

Preparing for the Future of Person of Interest Investigations

Recognizing these challenges is not about pointing fingers, but rather about building readiness for solutions. Cybercrime units that acknowledge the complexity of the digital world and systemic barriers in POI investigations are better positioned to:

Advocate for skills-first staffing and digital training.
Shift budget priorities to automation and scalable platforms that lighten the load on small teams, cut tool complexity, and speed up both adoption and the path to the truth in high-stakes investigations.
Explore emerging technologies, such as centralized investigative workspaces, AI-assisted case development and analysis, and structured collaboration tools that can turn overload into manageable clarity.

Person of Interest investigations are no longer routine background work; they are the cornerstone of proactive crime prevention and modern cybercrime response. Yet as the challenges scale, traditional methods and tools are straining under the weight of digital complexity, time pressure, and systemic constraints.

The way forward is to strengthen investigative capacity in cybercrime units by bringing in new platform expertise and adopting scalable technologies with automation, reliable data integrations, and shared workspaces to break down silos, reduce overload, and ensure critical connections aren’t missed.

Some agencies are already showing what this looks like in practice. In one European national cybercrime investigation agency, the OSINT team expanded from three officers to nearly ten. They secured better resources, like modern hardware, high-speed connectivity, and secure VPN access, and enhanced their capacity by bringing in external specialists such as social media experts, linguists, and psychologists. With the right investigative platforms and workflows, the unit was able to support other divisions more effectively and contribute directly to solving real cases.

Agencies that act now, by acknowledging these barriers and preparing to adopt innovative approaches, will be the ones to reclaim the investigative advantage. Those who delay risk losing pace not just with technology, but with the very criminals they are tasked to stop.

One truth is clear: the way we investigate persons of interest must evolve — and it must evolve now.

Expert Insights by

Sergio Leal Rodriguez

Sergio is an experienced and dedicated professional with more than 20 years of invaluable experience in coordinating, investigating, modeling data, and researching cybercrimes with a focus on the critical field of Child Sexual Abuse at Europol’s AP TWINS. His expertise lies in coordinating multi-agency efforts as well as conducting thorough investigations, and he has actively contributed to the development of innovative methodologies for data analysis and modeling in the context of child sexual abuse.

Want to see how Maltego One overcomes common pitfalls in Person of Interest investigations and makes them scalable? Catch the replay of our latest webinar to discover the new Maltego One here.

Case Study: Crisis24 Protects Businesses Beyond Cyberattacks with Maltego

Fri, 11 Jul 2025 13:13:41 +0000

Hybrid threats, once the concern of governments and militaries, now pose serious risks to the commercial and private sectors. Cyberattacks, influence operations, and physical sabotage are no longer confined to the geopolitical sphere. These threats are often subtle, difficult to attribute, and affect both virtual and physical worlds, which makes them particularly dangerous. Increasingly, industries connected to national resilience and public trust are being targeted. Recent incidents, such as the MOVEit breach, have demonstrated how private firms can become collateral damage in geopolitically motivated cyber campaigns, facing not only operational disruption but also reputational and compliance risks. Given this evolving landscape, the private sector must reconsider its security posture and adopt integrated strategies to remain resilient against hybrid threats.

Read on to discover how Crisis24 recalibrated their customers’ defense posture in response to sophisticated and blended attacks that extend beyond traditional cyber threats.

DOWNLOAD CASE STUDY

Maltego as the Core Intelligence Hub for Daily Operations

Crisis24’s Crisis & Security Consulting has a team of dedicated threat analysts and Associate Consultants who deliver detailed, actionable insights across various threat types and all dimensions of risk. From continuous global threat monitoring to on-the-ground response teams, Crisis24 supports clients during immediate crises and through long-term projects aimed at enhancing safety and operational resilience.

Since switching to an Organization plan in April 2023 and adopting a full-platform experience, the team has redefined industry standards for end-to-end risk management. With Maltego as the core intelligence hub, it now extends protection beyond cybersecurity to a broad spectrum of business threats. The most common use cases, which also align with high-impact business goals, include:

Person of Interest Investigations
Enhanced Due Diligence
Cyber Threat Intelligence

The associate team lead stated that Maltego’s main advantage is its account management.

One of Maltego’s key advantages is their exceptional account management, which we’ve been incredibly satisfied with. Their team has been responsive and proactive in driving product adoption, ensuring our needs are always met. With Maltego seamlessly handling training and support, our team could stay focused on the work that mattered most, confident that everything else was in the expert’s hands."

— Cybersecurity Consultant Team Lead

Download the Case Study

Maltego is proud to work with organizations like Crisis24 and its Crisis & Security Consulting to help protect customers from a wide range of threats. Download this case study now to learn why Crisis24’s Crisis & Security Consulting team chose Maltego and how they use it to protect businesses from hybrid threats!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Beginners' Guide | Setting up Maltego Graph Community Edition (CE)

Wed, 11 Jun 2025 23:00:02 +0000

The Community Edition (CE) is the free variant of Maltego Graph and the fastest way to start investigating with Maltego. Whether you’re working on personal investigations, using it for academic training, or simply testing the tool, it gives you a great starting point.

CE is available through the Basic plan, Maltego’s free tier, which includes 200 monthly Credits to explore built-in data. While it has some limitations compared to variants on paid plans (such as access to breach data and higher results limits), it remains a powerful tool for many OSINT use cases.

In this guide, we’ll walk you through a quick way to get started with Maltego Graph Community Edition.

Get started with Maltego Graph Community Edition

Register for Maltego ID

To start using the product, you first need to create an active Maltego ID account. Maltego ID is the secure login you’ll use to access Maltego tools like Maltego Graph and services such as Maltego Academy.

You can register for a free Maltego ID here.

After providing your registration details, you’ll receive an activation email. Check your inbox to activate your account.

Law enforcement or government user?

If you register with a government or organizational email, you may be considered for a free upgrade to the Basic+ plan.

We review each application to support investigators involved in high-stakes cases by unlocking more capabilities – including access to Maltego Search (a powerful OSINT tool for person of interest investigations) and 2,000 Credits per month at no additional cost!

Complete your profile

After activating your account, continue your journey in the browser by completing your profile.

Next, you’ll be taken to the Maltego browser app, where you can access Maltego Academy, manage your account in Maltego Admin, or check your eligibility for Basic+.

If you decide to upgrade to the Professional or Organization plan, you can also use the browser app to access more tools such as Maltego Search, Maltego Monitor, and Maltego Evidence.

But since you’re reading this tutorial, you probably want to jump right into exploring Maltego Graph.

To do that, click ‘Download Maltego Graph (Desktop)’ from your browser app.

Open Maltego Graph (Desktop)

Once installed, open the desktop application and choose to activate it with your newly-created Maltego ID.

During setup, agree to the License Agreement and choose ‘Browser Login’ to log in using Maltego ID.

Once authenticated, your Maltego Graph will be ready to go!

Start investigating with Maltego Graph Community Edition

You’re now ready to use Maltego Graph Community Edition! Every free plan now includes commercial data via Maltego Data Pass:

200 Credits/month on Basic
2,000 Credits/month on Basic+ (for eligible users)

Check what data is included in your plan on Maltego Academy.

In Maltego Graph Community Edition, you can also:

Activate Connectors using your own API keys to access more data
Explore community-built integrations
Run Transforms to return up to 24 results

How to make the most of Maltego Graph Community Edition

If you’re new to Maltego, check out the beginner learning path on Maltego Academy, including weekly live sessions to help you maximize the tool.

For more technical info, visit our official documentation.
If you need help, reach out through our Support Portal.

Happy investigating!

Investigating Örebro School Shooting with Maltego

Tue, 27 May 2025 06:01:16 +0000

We originally presented this case study at the Digital Experience Nordic 2025 event earlier in April. Given the positive feedback from the audience and requests from the customers, we decided to share it with our broader network and community. This article reflects on the role of OSINT in incidents like the Örebro school shooting, focusing on incident response and how tools like Maltego can assist in high-risk public safety scenarios. Before we begin, our thoughts are with the victims and all those suffering their loss.

The Role of OSINT in Responding to Hybrid Threats

Open Source Intelligence (OSINT) is not a silver bullet; it won’t solve an incident on its own, nor can it replace traditional investigative methods or frontline policing. However, with the rise of emerging hybrid threats, which often span both the digital and physical realms, relying solely on conventional approaches is no longer sufficient. These threats blend cyberattacks, disinformation campaigns, and online radicalization with real-world violence, infrastructure sabotage, or coordinated unrest, requiring a systematic and adaptive response.

This is where OSINT plays a crucial role. By integrating OSINT into investigative workflows, law enforcement and security professionals can respond more swiftly and effectively. OSINT helps identify and profile suspects, map their digital footprints, uncover their networks, and gather corroborating evidence across open sources, all in near real-time. When used alongside traditional methods, OSINT strengthens situational awareness, shortens investigative timelines, and enhances the ability to anticipate and mitigate complex threats. In rapidly evolving situations that threaten public safety, it’s critical for law enforcement agencies to respond with speed and broad intelligence coverage. Let’s explore in detail how OSINT helps them to act fast.

How OSINT Helps LEAs

Law enforcement agencies worldwide are increasingly leveraging OSINT, especially during high-profile incidents that pose risks to public safety. OSINT plays a vital role in enhancing real-time decision-making, improving situational awareness, and supporting post-incident investigations. For example, since the start of the Russian invasion of Ukraine, OSINT has been key in tracking troop movements, verifying missile strikes, and uncovering war crimes, including widespread cyberattacks. Let’s dive into how real-time situational awareness—before, during, and after incidents—can make all the difference. To learn how the Ukrainian Cyber Police use OSINT and Maltego to protect their citizens, click here.

Real-Time Situational Awareness: Before, During, and After the Incident:

Before the Incident: Proactive monitoring of open sources can alert LEAs to emerging threats. By analyzing patterns in online chatter, event planning posts, or suspicious activity in forums and social platforms, investigators can detect potential risks before they escalate. Keyword alerts, geospatial data, sentiment analysis, and features like Echo—the AI case assistant in Maltego Monitor— enable agencies to anticipate incidents and prepare appropriate responses in advance.
During the Incident: In the midst of crises, such as terrorist attacks, natural disasters, or mass shootings, OSINT delivers critical, real-time information to LEAs. Social media posts, live-streamed videos, and geotagged images from eyewitnesses on the ground often provide faster, more granular insight than traditional intelligence channels. For example, monitoring keywords like “breaking,” “first visuals,” or “shooter spotted” can help surface first-person views and footage, offering immediate situational awareness.

OSINT can also support the geolocation of visual content to confirm the location of events, validate reports, and track movement patterns. In parallel, LEAs can use OSINT to detect and counter disinformation campaigns or harmful narratives, such as deepfakes or fake news, that can spread quickly during the chaotic events and heighten public panic. For example, within the first 20 minutes of an incident, Maltego Monitor surfaced the first visuals of the shooter, captured by a bystander through their window. This provided critical intelligence, including the type of weapon used and the potential direction of movement, helping agencies respond faster and more effectively.
After the Incident: Following an event, OSINT becomes vital in the investigative phase. LEAs use it to identify suspects, uncover motivations, and trace digital footprints. It aids in verifying alibis, mapping relationships between individuals or groups, and understanding whether the incident is part of a broader organized effort. OSINT also plays a key role in gathering legally defensible evidence, helping agencies build stronger cases that can stand in court. By preserving and contextualizing digital traces, investigators can establish timelines and corroborate findings with other sources.

Post-incident OSINT investigations also help analyze the long-term impact of events. Agencies can monitor signs of online radicalization or community polarization that may increase the likelihood of future incidents. Understanding how narratives evolve after an attack enables authorities to address root causes and prevent recurrence.

In the demonstration below, we’ll walk you through how this type of post-incident investigation unfolds, showing how one piece of a clue can lead to a wider network of insight. A single thread may spark the weave, but only a full tapestry tells the whole story. With Maltego, that first lead can unravel a broader truth. Keep reading!

Integrating Maltego into Hybrid Threat Response

So, how does Maltego fit into this, and how does it enhance real-time situational awareness at every stage of an incident?

To start off, you can use Maltego Monitor to mine information from social and non-social media sources about the evolving situation. Based on location parameters or specific keywords and hashtags, LEAs can gather first-person accounts of the incident to crowdsource critical information. Using Key Insights ML models, such as those trained on physical attacks, analysts don’t need to spend hours deriving actionable intel. They can receive summaries of key developments within seconds, effectively gaining those crucial few minutes to focus on higher-priority tasks. Ongoing monitoring capabilities also enable LEAs to stay alert to emerging threats, such as a rogue shooter elsewhere or online chatter about similar incidents developing in other locations.

Simultaneously, you can use our Search and Graph capabilities to quickly deanonymize or map the digital footprint of an individual. Despite being online, a surprising amount can be uncovered, revealing someone’s activities and potential motivations. In the case of Taleb Amhedousen, who drove his car into a Christmas market crowd in Magdeburg, Germany, on December 20, 2024, within minutes of identifying his name, investigators were able to access forums he participated in, websites he had registered, and threats he had been making for months. This also opens the door to identifying influence networks—both what may have motivated the attacker and whether they’re connected to groups that could pose future risks.

To further expand the picture, it’s often essential to understand the attacker’s immediate environment—who they were in contact with, and what their online social network reveals. Maltego Evidence supports this by identifying shared connections, most frequent interactions, and communication patterns, helping investigators trace relationships that might otherwise remain hidden.

Investigating the Örebro School Shooting with Maltego

Now that you’ve read how Maltego’s all-in-one platform supports LEAs at every stage of an incident, let’s take a closer look at how it can be applied to post-incident analysis of the Örebro school shooting.

As law enforcement officials, in the aftermath of the incident, your focus shifts to identifying the perpetrator and understanding their network and motivation. You will work to address key questions such as: Who is the shooter? What might have motivated them? Are there any ideological drivers behind the attack? Could others be involved? What networks are linked to the perpetrator? Are there signs of threats, manifestos, or attempts to preserve evidence?

This is where Maltego’s investigative capabilities become especially valuable. It is well known for its strength in Person of Interest investigations and has supported many high-profile and sensitive cases for governments around the world. Starting from a single breadcrumb—such as a name, email address, or limited digital footprint—Maltego helps uncover hidden connections and build a full context of the case.

With those key questions in mind, we immediately initiated a monitoring case as soon as the shooting was reported. Using just two basic parameters, a geographic location block and a few targeted keywords, we began tracking real-time developments as thousands of messages started flooding in from various platforms on Maltego Monitor.

We quickly observed videos and images through applied filters and began identifying first-person accounts of the incident. For law enforcement agencies, this kind of direct insight from individuals on the ground offers immediate operational value.

Once the shooter’s name was made public through media reports, we pivoted to Maltego Graph to investigate his digital footprint. Starting with the name, Maltego Graph identified associated social media profiles and potential indicators such as email addresses and phone numbers linked to the target. One notable finding was a series of runs logged on Strava in Örebro, near the location of the shooting. However, in a classic OSINT pitfall, we soon realized that we had misidentified the individual. There was another person with the same name—Rickard Andersson. This is where the investigator’s skillset becomes critical: knowing how to stay focused on the objective and avoid getting lost in rabbit holes. Without a clear investigative direction, following misleading leads can result in significant time lost and potentially delay actionable outcomes.

As more details emerged in media reports, it became clear that the actual perpetrator led a reclusive life, making a direct investigation into his digital presence less fruitful. This led us to redirect our efforts toward his immediate network and family. Using Publicly Available Information (PAI), we identified several family members, some of whom had already begun scrubbing their digital footprints, likely to avoid public scrutiny or further association with the case.

Due to the sensitivity of the investigation and privacy considerations, we cannot share many of the specific findings presented during the event. However, we hope this gives you a clear sense of how OSINT supports high-stakes investigations, particularly in post-incident person of interest cases, and how Maltego enables you to uncover the full story starting from a single lead. This case illustrates both the power and the caution required in OSINT investigations and how Maltego’s tools enable flexible, multi-angle investigative workflows.

Happy investigating!

About the Author

Nitish Chandan

Nitish is a Senior Subject Matter Expert at Maltego with a background in trust and safety, product risk and compliance, and investigative work. At Maltego, he works closely with customers to understand their challenges and demonstrate how the platform supports their investigative goals. He helps teams unlock their full potential by developing tailored use cases and end-to-end workflows. His interests include the dark web, CSAM, cryptocurrency, and cyber threat intelligence. He also conducts investigations in response to emerging incidents. Follow him on LinkedIn to learn more.

Maltego Welcomes Hunchly to Expand OSINT Capabilities

Mon, 19 May 2025 12:00:15 +0000

Munich, Germany - May 19, 2025

Maltego, the world’s most widely used platform for OSINT and investigations, is proud to welcome Hunchly into its ecosystem. Hunchly is a trusted tool for capturing and preserving online evidence. Together, Maltego and Hunchly provide investigators with a more complete workflow, pairing in-browser evidence collection with deeper data analysis and insights powered by industry-leading APIs.

This partnership delivers a seamless investigation experience for professionals who need to move faster, go deeper, and uncover the truth with confidence.

Since 2008, Maltego has supported high-profile, high-stakes investigations around the world, establishing itself as the go-to platform for investigative teams. More recently, Maltego has brought its proven capabilities to the browser, focusing on easier access to data and helping investigators of all experience levels work more efficiently.

Earlier in 2024, Maltego expanded further by acquiring PublicSonar and Social Network Harvester, now known as Maltego Monitor and Maltego Evidence. These additions brought new capabilities for social media monitoring and deep social network analysis, pushing Maltego closer to its goal of delivering a complete, end-to-end investigative platform.

With the addition of Hunchly, Maltego continues to strengthen its commitment to building powerful, integrated solutions that support investigators from the first click to the final report.

Maltego x Hunchly

Maltego and Hunchly have long shared a mission: to empower investigators with tools that enhance efficiency and effectiveness. Maltego helps users connect and enrich diverse data sources to generate meaningful intelligence. Hunchly complements this by automatically capturing and preserving online evidence—every URL, timestamp, and cryptographic hash—ensuring investigations are well-documented and legally defensible.

These tools have already been used side by side by law enforcement and intelligence teams around the world. Now, by bringing Hunchly into the Maltego ecosystem, we’re making that connection seamless. Investigators can move from collection to analysis to reporting without losing context or breaking their workflow.

This integration means stronger evidence, faster insights, and more confidence in the results. Whether you’re building a case or tracking digital threats, the combined use of Maltego and Hunchly helps you uncover the truth and facilitates informed action.

Investigator-First: The Path Ahead

This next chapter reinforces our commitment to equipping investigators with the tools they need to work more efficiently and uncover critical insights.

“With the acquisition of Hunchly, we’re taking a decisive step toward covering the entire investigative workflow, remaining true to our ‘investigator-first’ philosophy. Our vision has always been shaped by the real needs of those who use our tools every day, and I am confident this integration will offer a comprehensive experience that truly reflects how investigators work.”

Philip Mayrhofer CEO, Maltego

Hunchly’s product and longstanding support of the OSINT community will further strengthen Maltego’s position as the world’s most widely used investigation platform.

“Maltego is known and respected among investigative professionals for its ability to uncover connections across complex data,” said Brock Lupton, Vice President of Product and Innovation at Hunchly. “We are excited to become part of this trusted ecosystem. This strategic decision enhances seamless investigative workflows and brings together capability, community, and mission for greater impact. Hunchly has earned the trust of investigators by focusing on what matters most to them, and together with Maltego, we will take that mission even further, making investigations more efficient while preserving depth, accuracy, and control.”

In the coming months, Maltego and Hunchly will work closely to ensure a smooth integration of products, teams, brands, and services. Our priority is to deliver continuity and a seamless experience for customers while expanding the value of our combined offerings. Maltego believes this strong ecosystem of tools and expertise will accelerate investigations both on the front lines and behind the scenes, ultimately helping to make the world a safer place.

If you have any questions regarding this press release or the transition, please contact us at communications@maltego.com.

About Maltego

Maltego’s all-in-one platform has empowered over one million investigations worldwide since 2008 by streamlining and accelerating the investigative process through a suite of powerful tools and a rich data offering. Solutions like Maltego Search, Graph, Monitor, and Evidence enable users to collect and analyze data from trusted sources, helping keep organizations and individuals safe. Headquartered in Munich, Maltego has grown to over 150 employees across six continents and works with customers including the Federal Bureau of Investigation, INTERPOL, and major financial and private companies, including half of the DOW 30.

About Hunchly

Hunchly is a web capture and evidence preservation tool that helps investigators securely collect, organize, and preserve online content from websites and social media. It captures complete page data, including the full-page content, metadata, and timestamps, to ensure transparent and legally defensible investigations. Launched in 2015 by Dark River Systems and later supported by Sapper Labs, Hunchly quickly gained global adoption among investigative professionals. In 2022, the two companies merged to form Sapper Labs Group. Hunchly was acquired by Maltego in May 2025.

How OSINT Helps Find Missing Persons

Fri, 02 May 2025 09:38:44 +0000

Trace Labs is a nonprofit organization established in 2015 with the mission to be “a catalyst for improving the state of missing persons location and family reunification.” The organization created the Search Party platform to crowdsource OSINT and empower the global community to use their cyber skills for good.

In this blog post, I’ll share my experience participating in the Search Party CTF, focusing on the event’s format, recommended tools, and effective tactics and strategies. Read on to see how I approached the challenge.

Introduction to the Trace Labs Search Party CTF

The Trace Labs Search Party is a four-hour Capture the Flag (CTF) event where participants compete to gather open-source intelligence (OSINT) on real missing persons cases. This initiative was created to support law enforcement around the world by bringing hundreds of fresh sets of eyes to each case. The collected intelligence is reviewed and then passed on to law enforcement, who can take appropriate action based on the findings. To get started, visit the Trace Labs website and join their Discord community.

How the Challenge is Structured

Search Party stands out from other CTFs because participants are not expected to find a specific set of predetermined answers. Instead, organizers define categories of information that contribute varying point values based on their relevance and usefulness to the investigation. For example, a submission like “Social media profiles of friends shown to interact with the missing person (MP)” may earn 10 points, while “Relevant information pertaining to the current location of the subject” can earn up to 5,000 points.

At the start of the event, participants are provided with an advisory page issued by local law enforcement. This typically includes details such as the MP’s name, general location, photo, physical description, clothing last seen wearing, and the circumstances surrounding their disappearance. Participants then have four hours to submit as much relevant and verifiable information as possible.

Essential Tools for OSINT Investigations

Below are some tools that can be used during this CTF. While the paid versions offer advanced capabilities, all of them also provide a free version or community edition suitable for OSINT investigations. Please note that this is not an endorsement of any specific tool; this list is provided for informational purposes only.

Corporate Data

To better understand an MP’s whereabouts, it’s important to consider their corporate footprint: did they register a company, and if so, where? While this approach is not as frequently applicable as strategies like searching for social media accounts tied to the MP, it can provide valuable information. For example, it may reveal connections to other entrepreneurs or lead to business addresses that could aid in the investigation. Here are two tools you can use:

North Data: It allows you to look up company ownership structures or search for a person’s name in the corporate registries of European countries. You can access the data through their website or query it directly on Maltego Graph, presenting the results in an easily understandable graph.
OpenCorporates: This tool operates similarly to North Data but covers a broader range of jurisdictions. It includes over 160 million companies across 130 jurisdictions, such as the US, UK, Switzerland, Panama, and more, all brought together into a standardized global schema. You can also query the data directly on Maltego Graph.

Facial Recognition

Missing person advisory pages almost always include a picture of the missing person, for obvious reasons. A natural way to take advantage of this is to perform a reverse image search. However, this is likely to return results related to the person’s disappearance rather than personal profiles. To go beyond simply identifying where the picture was posted before the person went missing, we can use facial recognition technology. Below are two tools you can incorporate into the investigation:

PimEyes: This website allows you to upload multiple pictures of the MP to search for other instances of their images online. However, please note that the free version will only provide links to the websites where the pictures were posted, not the exact URLs.
FaceCheck.ID: This tool is straightforward and user-friendly. You can upload a photo of the MP, and it will suggest other images of the same face found online. Like PimEyes, the free version has limitations. It only provides links to the websites where the images appear, but not the specific URLs.

Social media profiles are often a treasure trove of insights into the life, relationships, and habits of the MP. But how do we find them? The tools below can help you discover social media accounts using a phone number, email address, or username.

Epieos: The free version allows you to check if an email address or phone number is associated with an account on a platform, but it won’t reveal the specific account details. If you’re a Maltego Professional or Organization user, you get the full platform experience and access to all Maltego Data Pass modules, including Person of Interest, which features Epieos and other trusted and secure data sources.
Sherlock and Holehe: Both command-line-based tools require installation, but they are highly efficient. Sherlock is designed to find accounts linked to a given username, while Holehe focuses on discovering accounts tied to an email address.

Maltego Graph

Maltego Graph is our flagship product, an all-in-one OSINT and investigation platform that the brand is best known for. It brings all intelligence into one place with advanced link analysis capabilities.

While I wear the hat of a SME at Maltego, I can confidently say that Maltego Graph is instrumental in uncovering the full story and the surrounding context of a person of interest. But it doesn’t stop there. You start with a single piece of information, such as an email address, name, alias, or social media account, and seamlessly pivot and scale your investigation to gain a comprehensive understanding of one’s online presence.

This is made possible through the flexible use of data credits, which provide access to high-quality, reliable data sources included in your plan (as mentioned above in the social media profile discovery section).

Note:

We have a very exciting product release coming soon. A powerful browser-based tool designed specifically for optimized workflows and intuitive navigation in person-of-interest investigations. Stay tuned!

Breaking Down the Challenge

Let’s walk through a real challenge to demonstrate how I approached it. The starting point was a MP case reported shortly before the CTF. We were provided with a physical description, a photo, and a list of the clothes and personal items the MP had at the time of their disappearance.

Disclaimer:

To respect data privacy, I will not disclose any specific details or personally identifiable information (PII) related to the MP. The purpose of this section is to illustrate the tactics and investigative methods I used, not to reveal private data of the MP.

Three other participants and I (a group of four) began the investigation by Googling the MP’s name. This initial search led to two notable findings: a private Instagram account and a Facebook profile. The Facebook account contained recent photos of the MP, as well as the names of their spouse and child. It also revealed the MP’s surname at birth, which could be helpful for further investigation.

Continuing the search, we looked into the spouse’s name and found documents related to a 2015 court case from a neighboring country involving a sexual assault charge. However, after verifying the details, we confirmed that the photo of the person convicted did not match that of the spouse, ruling out a connection.

Returning to the Facebook account, we used Maltego Graph to gather additional data. Starting with a Person Entity, we ran the [POI] Search Profiles (Facebook) Transform to locate the MP’s profile. We then applied [POI] Get Posts (Facebook) to collect their posts and [POI] Get Friends (Facebook) to obtain a list of their connections. Searching for the MP’s last name within this friend list helped quickly identify potential relatives.

After collecting nearly 1,500 posts, we performed a keyword search to identify content that might offer clues about the MP’s disappearance or provide insight into their personal situation. This analysis surfaced several posts from the early 2010s in which the MP discussed mental health struggles, offering important context to the investigation.

To supplement our investigation, we searched for the MP’s name in breached data. Starting from a person Entity in Maltego, we ran the Transform [POI] Leaked Records Search (person). Luckily, the MP’s name was distinctive enough that all the search results matched known details about the MP. Both contained the same Gmail address.

To confirm that this Gmail address belonged to the MP, we ran the [POI] Search Profiles Transform to look for associated accounts. This expanded our graph with accounts from various platforms, including Bible.com, Tumblr, and EA Games, giving us a broader view of the MP’s digital presence. Some of these profiles included valuable details such as date of birth and additional photos of the MP and their spouse. The results also revealed partial phone numbers and secondary email addresses tied to these accounts. A particularly notable finding was a Google account that had its last recorded activity just four days before the MP went missing.

Repeating the same process using the MP’s surname at birth yielded 18 breached records containing that name. The next step was to distinguish the records that truly belonged to the MP from others with identical names. To do this, we used the date of birth retrieved earlier from accounts tied to the MP’s email address to filter out unrelated Entities. This left us with 8 breached records, though they didn’t contain enough information to definitively confirm or dismiss a connection to the MP.

The most efficient way to assess their relevance was to link the data from these records to known social media accounts and compare the results with what we already knew about the MP. From the remaining breached record entities, we ran the Transform [POI] Extract ALL Personally Identifiable Information. This yielded 6 email addresses. We then used [POI] Search Profiles to investigate those addresses. One of them returned a Myspace account listing a city that matched the MP’s known location.

Assuming this email address belonged to the MP, we pivoted on it and searched for it in breach data using [POI] Leaked Records Search (email). This uncovered additional records, including a Myspace account with the MP’s spouse listed as a friend, strengthening the likelihood that the email address was accurate. We also found a LiveJournal account containing several public diary entries from the mid-2000s. These records revealed four new aliases and three unhashed passwords, which could be used to continue the investigation.

Key Takeaways from the Trace Labs Search Party CTF

While this was by no means an exhaustive investigation into the MP’s whereabouts, the time-limited nature of the CTF eventually forced us to move to another case. Nevertheless, the process demonstrated just how powerful OSINT can be in uncovering relevant information rapidly and ethically. And with the right tools and intelligence, such as Maltego at hand, investigators have the depth, breadth, and speed needed to confidently navigate the digital investigation.

Participating in the Trace Labs Search Party was both rewarding and eye-opening. It sharpened my investigative skills, reminded me of the investigative analytical mind, and highlighted how even small digital clues can lead to meaningful insights. The experience also emphasized the importance of collaboration, with teammates sharing findings and working in parallel to piece together complex puzzles.

I hope this blog post has sparked some ideas, introduced you to new tools and strategies, and maybe even inspired you to participate in a future Search Party CTF event. Whether you’re just getting started with OSINT or looking to enhance your skills, a CTF like the one from Trace Labs provides a unique opportunity to apply your knowledge in a way that truly makes an impact. #OSINTForGood

Stay connected with us on X and LinkedIn with the latest news and developments!

About the Author

Mathieu Gaucheler

Mathieu is a Senior Subject Matter Expert at Maltego, where he helps customers realize the platform’s full capabilities in support of their investigative missions. He specializes in designing investigative workflows and delivering hands-on training focused on OSINT and effective use of the Maltego platform. Since joining Maltego in 2021, following his work at a Cyber Threat Intelligence startup in Barcelona, Mathieu has been dedicated to enabling organizations to operationalize open-source intelligence. His core expertise spans SOCMINT, GEOINT, and internet infrastructure investigations.

Maltego Receives Frost & Sullivan’s 2025 Product Leadership Award for Global OSINT Solutions

Thu, 17 Apr 2025 01:47:28 +0000

Munich, Germany – April 17, 2025

With critical data points emerging across online platforms, social media, the dark web, and geospatial feeds, open-source intelligence (OSINT) has become critical to security strategies and modern investigations. Law enforcement, government agencies, and corporate security teams rely heavily on OSINT to detect threats, capture digital evidence, and make timely, informed decisions.

To meet their evolving demands, investigative tools must accelerate the analysis of high volumes of fragmented data, connect intelligence from diverse sources, and ensure privacy and compliance in a shifting regulatory landscape. Maltego has long anticipated these needs and built a platform for data-driven investigations.

We are therefore proud that Frost & Sullivan has acknowledged our efforts and named Maltego the 2025 Global Product Leader in OSINT Solutions. Frost & Sullivan is one of the world’s most respected research and consulting firms and is known for identifying market-defining companies.

“As a product leader in the OSINT space, Maltego has established itself as a key provider of cutting-edge solutions for investigators, security professionals, and intelligence analysts. With its powerful investigative capabilities, Maltego enables organizations to efficiently manage complex, high-risk investigations while maintaining control over critical intelligence.”

— Frost & Sullivan, 2025 Product Leadership Award Write-up

What set Maltego apart during the evaluation process was its platform’s versatility, depth, and performance across the full lifecycle of digital investigations. Frost & Sullivan highlighted our comprehensive OSINT portfolio, which supports every investigative stage.

Read the Frost & Sullivan Recognition Overview

With tools like Maltego Graph, Maltego Search, Maltego Monitor, and Maltego Evidence, users can map complex networks, uncover hidden connections, and analyze large datasets in a secure, visual environment. Real-time monitoring, automation, and compliance-ready features are built into the platform, while Maltego Data Pass offers secure access to relevant and reliable intelligence in one place.

Maltego Marks Another Milestone in Product Innovation and Growth

This honor also reflects another significant advancement in Maltego’s growth. Just one year ago, we announced the acquisition of PublicSonar and Social Network Harvester to strengthen our capabilities and bring more value to our users. Today, we are proud to be recognized for our product leadership in the OSINT solutions space.

“While many OSINT and digital intelligence providers have traditionally focused on more common investigation types, Maltego’s strategic expansion and innovation of its OSINT solutions highlight its commitment to addressing the growing demand for advanced investigative tools.”

— Frost & Sullivan, 2025 Product Leadership Award Write-up

This award reinforces our mission of delivering value through innovation, usability, and trust. In active use across more than 120 countries, Maltego is a trusted partner for investigative professionals in law enforcement, government, and the private sector as they navigate today’s complex digital threat landscape.

Read the Frost & Sullivan Recognition Overview

We are grateful to Frost & Sullivan for acknowledging the impact Maltego is making in the OSINT community. If you’re interested in seeing how Maltego can support your investigative work, our team is ready to connect.

Get in touch to see the platform in action!

How to Close Training Gaps and Use Investigation Tools More Effectively

Wed, 09 Apr 2025 05:13:39 +0000

Whether in cybersecurity, law enforcement, or the private sector, investigative teams face mounting pressure to deliver results. But often, these teams are up against limited staff, tight budgets, and very little time for structured training.

When analysts are handed new tools without the right preparation or support, those tools rarely get used to their full potential. At worst, they get abandoned completely, putting a dent in the initial investment, even if the tool was a perfect fit.

The key isn’t just better technology. It’s the right mix of training and tools that work for real people under real constraints.

This article explores five practical strategies teams can apply to maximize tool adoption and close training gaps, even in resource-constrained environments.

Table of Content

Strategy 1: Get Analysts Involved Early

Too often, leaders make tooling decisions without involving the people who will actually use those tools. If analysts or investigators aren’t consulted, or even made aware of a new tool, it’s unlikely to gain traction, especially if they’re already used to their current workflows. When that happens, adoption suffers, and the value of the investment is lost.

Analysts need to understand why a new tool matters and how it fits into their day-to-day work. The best way to make that happen? Involve them early. Ask what’s working, what’s not, and what they actually need.

Another simple but effective tactic is to appoint internal “champions.” These are team members who want to go deeper with a new tool and can serve as peer coaches to others. This builds buy-in and keeps learning going without reliance on vendor support.

Strategy 2: Training Isn’t Optional

When an organization invests in a solution, it does so with the belief that it will improve performance. But if end users don’t feel confident using the tool, it often goes underused, or ignored entirely, leaving potential performance gains unrealized.

New technology alone doesn’t solve problems—trained people do. Without proper training, teams default to old methods or only scratch the surface of what’s possible.

Let’s take Maltego as an example. Some parts of the platform, like Maltego Search, are extremely intuitive, simple, fast, and requiring little to no training. But advanced tools, such as Maltego Graph or Maltego Evidence, are more complex. While these tools allow investigators to conduct more in-depth analyses, they can be easily overlooked if an end user feels intimidated by them. That leaves potential performance gains on the table, which isn’t good for the organization.

This isn’t just a missed opportunity. It can lead to incomplete investigations, missed clues, or slower response times. Training is what bridges the gap between technology and outcomes.

I talk more about finding the right balance between training and tools in this conversation on the CyberWire Daily podcast:

Strategy 3: Find a Solution That Every Users Can Adopt

Many investigative tools are designed for expert users, but not every analyst is a technical specialist. Teams often include new hires, lateral transfers, or professionals with non-technical backgrounds.

If the tools you’re considering for your organization require niche skills like Python scripting just to run basic queries – and those skills aren’t common on your team – you’re creating unnecessary barriers.

Instead, solutions should be designed to help users move from question to answer quickly, regardless of their experience level. That could mean automating complex steps behind the scenes, offering clear templates, or making interfaces more visual and less code-heavy.

The bottom line? Technology should make investigations easier, not harder. Build for real-world users, not just power users.

Strategy 4: Train in Layers, Not All at Once

It’s tempting to try to train everything at once when you’ve just invested in a new tool. After all, you’ve spent considerable time researching the solution and set aside a budget for it. But this approach can backfire. It’s often overwhelming, especially for non-technical users. Instead, I encourage adopting a “scaffolding” approach to training.

Let your analysts start with the basics. Help them grasp simple concepts and practice core actions. Then, gradually introduce more complexity as their confidence grows.

For example, if you have a champion on your team who onboards new hires to Maltego, don’t jump straight into running full investigation workflows. Start by helping new users understand the building blocks: how to identify Entities, how to run simple Transforms, or how to share the case.

This method makes learning stick. It also enables users to understand the why behind each step, so they don’t just follow instructions, but build real skills and eventually explore the tool independently to run meaningful investigations.

We also encourage organizations and users to seek out the information they need directly from the vendor. Ask for resources, provide feedback, and take advantage of expert-led sessions whenever available.

In the context of Maltego, we support our users with personalized training, and we also provide Maltego Academy –our learning platform that offers both on-demand and live sessions focused on mastering the Maltego platform and applying best practices in digital investigations.

Strategy 5: Tame the Data Flood

Information overload is real! We live in the information age. There’s more data than you could ever possibly need, and most of it is irrelevant to a specific investigation. That’s why knowing what to exclude is just as crucial as identifying what to include.

On top of that, the number of data providers and sources makes it even more challenging to collect and analyze the data needed to draw meaningful insights. The real skill lies in filtering out the noise and zeroing in on what matters.

The right investigative platform should help with this. Instead of bouncing between dozens of tabs or tools, analysts need a single space to bring all their data sources together. That’s one reason users love Maltego Graph: It lets you visualize, combine, and explore data from different providers in one unified view.

Easily access curated data and integrate internal sources with Maltego Data.

But even comprehensive platforms can become overwhelming without the right approach. That’s why we always recommend starting with a clearly defined question. A tightly scoped investigation helps analysts stay focused, avoid rabbit holes, and make faster, more confident decisions.

Just as important is knowing what not to chase. For instance, if you’re mapping a person’s social connections, digging into IP addresses may not help… unless there’s a specific reason. Let the question guide the data, not the other way around!

Help Your Analysts Succeed Even with Limited Resources

Supporting analysts in resource-constrained environments doesn’t require a huge overhaul. It requires smarter decisions around training, tool design, and workflow support. Here’s what it comes down to:

Involve analysts in tooling decisions
Offer training that builds over time
Choose tools built for real users
Be selective with your data, don’t stack it
Partner with vendors who care about adoption

At Maltego, we’re committed to that last point. That’s why we offer custom training sessions designed for your team’s needs and a wide range of training through the Maltego Academy.

Interested in tailored training for your team? Contact us here.

Happy investigating!

About the Author

Joe Ryan

Joe Ryan is the Head of Customer Enablement at Maltego Technologies. With 10 years of law enforcement and government experience, he brings a working knowledge of digital investigations to his role, ensuring that users find value in the Maltego platform. Joe’s background in training and customer education highlights his commitment to development as the key driver of customer success.

How Users Shape Innovation in Our Ecosystem

Wed, 19 Feb 2025 16:28:28 +0000

Maltego has empowered over one million investigations worldwide since 2008, making it the most widely used cyber investigation platform. Trusted by a diverse range of users, from government agencies and commercial enterprises to cybersecurity professionals, penetration testers, forensic investigators, investigative journalists, and market researchers, Maltego helps make the world a safer place.

Following the impactful discussions at the Munich Security Conference 2025 and its side events, we take you behind the scenes of Maltego—rooted in the city of Munich, where our headquarters are located—for an exclusive look at what shapes our journey, straight from the top. Lukas von Grebmer, VP of Marketing and Growth, sits down with Philip Mayrhofer, CEO of Maltego, who has attended several side events, for an insightful conversation.

Curious about what drives innovation at Maltego, how we prioritize product development, and how we foster partnerships to strengthen our ecosystem? Watch the interview now! It is short, powerful, and gives you a direct understanding of what fuels our continuous growth.

“Those who know their destination fear no journey.”

We invite our customers, users, community, and ecosystem partners to join us on this journey with confidence and trust. With a clear vision and a defined path, the road ahead is one of innovation and success.

Discover how Maltego’s all-in-one platform supports thousands of users, including over half of the Dow 30 companies and governments worldwide. With a suite of investigative tools and unmatched access to reliable data, Maltego helps combat foreign influence, disinformation, geopolitical and transnational organized crime, while strengthening regional defense and democratic resilience. Explore our resources here or book a quick conversation today!

Key Questions and Answers

Lukas: What does the Munich Security Conference mean specifically for our community?

Philip: So, I think what becomes really clear is that the threats faced by nations and corporations are becoming increasingly evident and pronounced in relation to what Maltego is really about. These threats are international and hybrid, meaning they combine both real-world elements and social engineering, the social aspects of threats, with computer networks. They pose a very real danger to the West, and we need to consider how we as a community can support both nation-state actors and corporations to be best equipped to tackle these threats.

Lukas: What do its side events mean for our community and industry?

Philip: I think that is really encouraging because the overwhelming message here is that companies, players, and institutions want to cooperate and collaborate on these global challenges. As private businesses, we can contribute to this by building tools that not only solve the problem but are also open to collaboration with other partners from both sides of the Atlantic. This ensures that we truly provide our customers with the solutions they need to face these threats.

Lukas: What was your impression of this year’s conference compared to last year?

Philip: So, maybe a good thing is not too much change. I think all players recognize that it is a challenge in an environment where we need to collaborate, and on that level, we are very much looking forward to continuing to do that. What is increasingly a topic is how our businesses and the way we operate are influenced by regulation.

There are obviously important ongoing directives in the EU, but also with regard to US regulation that may influence how we can do business and how we need to develop our products. That’s certainly something we all need to take a look at and see whether our infrastructure and systems are well-equipped to serve players in different jurisdictions.

Regulation and volatility here are certainly topics that came up a lot. It’s a topic that we, as a company, cannot handle on our own in isolation, but we need to work together with other players, align, and try to contribute to that conversation in a positive way.

Lukas: What is Maltego’s approach to partnerships and their significance?

Philip: Yeah, Maltego really grew together with its partners, and those partners, first and foremost, are certainly data providers and companies that have unique and differentiated access to data sources.

As a data integration and analytics company, Maltego has always been very open and customizable to accommodate these different data sources, which is highly beneficial for the user, who remains our primary focus. I think that continues to be a major driver of why customers choose Maltego. They often say, ‘I have internal data stored in databases or workflow tools, but I also have external data from various providers—threat intelligence providers, company data providers—that I need to merge.’ They’ve found that Maltego is a strong platform for that.

We’re excited to push that forward, focusing on enhancing our internal technology to make data ingestion easier. We aim to provide our customers and partners with the tools to simplify this process and help merge these different data sets, so users can extract the essence from disparate sources. And that’s really what we’re focused on at Maltego.

Lukas: How does our partnership create a win-win for Maltego, customers, and partners?

Philip: I mean, it always comes down to what the customer wants and needs. I think this is where the mission often aligns. We have data partners, both existing and new, who approach us and say, ‘I’m working with this high-profile client, and they’ve mentioned that they need our data integrated into Maltego to fully benefit from it.’

Our partnership team then collaborates with that data provider to find the fastest path to integration. This creates a win-win: the customer gains the added benefit of another data source within Maltego, the data partner closes a deal and gains a new customer, and for us, it is an opportunity to expand the platform’s value, which naturally grows as we integrate more data sources out of the box.

That is a major focus for how we want to build Maltego, to be a platform that enables specialist and highly differentiated data providers to thrive, while ultimately delivering the best experience for the customer.

Lukas: How does the Maltego user community drive innovation on the platform?

Philip: Many talked about the tools that developers and data providers can utilize to integrate new data sources. We make sure to continuously improve on that, so the experience becomes easier. At the same time, users have incredible customization opportunities, especially when it comes to creating workflows. For example, they can set up a series of queries, what we call transforms, in a specific sequence to expedite repetitive tasks or even automate them.

We also have communities that share these machines and workflows with one another. Similarly, certain use cases require specific adaptations in how link analysis is displayed or how users tailor it to their needs. This level of customization is something that made Maltego stand out and continues to set us apart, especially for sophisticated users.

At the same time, we learn from this process by observing the ideas of our most advanced users regarding how Maltego can be further automated and improved. We then integrate these ideas into our product development. What I am particularly excited about is what we are currently working on and planning to release in the coming months. We are bringing these insights into our browser platform, which is a huge step forward. It will allow us to respond much faster to user inputs and feedback and will set Maltego on an entirely new trajectory for the future.

Lukas: How do you see Maltego’s future in community-driven development and its role for us?

Philip: Yeah, as a platform, you have a huge opportunity but also a responsibility, and that is something we are very aware of. We work closely with our partners, the wider community, and ultimately our users to understand what they need from Maltego to be successful. That is the ultimate challenge for us to solve, and when we do, everyone benefits.

So, the boat will rise with the tide, and that is what we are focused on right now. We understand that the specific and differentiating capabilities of the Maltego platform—bringing together various data sources, merging them in meaningful ways, and offering extensive customization—continue to be crucial for our most sophisticated users, and we remain committed to providing that.

At the same time, we recognize that the industry and the community are expanding into broader use cases that involve larger teams. In response, we are condensing the most important workflows and capabilities and repackaging them to be accessible to less technical users.

Over the past two to three years, we have seen massive adoption of this approach, especially in the public and government sectors. Now, we are increasingly seeing it spread into the commercial space, where larger teams focus on fraud and other trust and safety issues.

Our focus over the next 12 months is to balance these two needs—continuing to support advanced users with deep customization while also distilling the core functionalities to make them more accessible to a wider range of users.

Bridging Governance and Security in a Multipolar World

Thu, 13 Feb 2025 12:44:18 +0000

The Munich Security Conference (MSC) is one of the world’s most influential platforms for global security, uniting policymakers, thought leaders, and experts to tackle today’s most pressing security challenges. This year’s MSC takes place amid increasing multipolarization, where shifting power dynamics and complex international cooperation dominate the agenda. Topics like geopolitical tensions, disinformation, and transnational organized crime will shape the discussions, influencing policies that resonate across governments, organizations, and Maltego’s global community.

Looking ahead to the Munich Security Conference 2025, we’ve engaged with key voices to explore critical issues, including cross-sector collaboration, evolving geopolitics, and the fight against transnational organized crime. By gathering insights and reflecting on the recently published Munich Security Report 2025, we aim to highlight the conference’s pivotal role in driving impactful policy and security conversations worldwide. To stay ahead, follow the discussions and explore the latest insights in the report.

We had the honor of speaking with Ottilia Maunganidze, a leading voice in international security, governance, and human rights. As Head of Special Projects at the ISS and a member of the Munich Security Conference High-Level Taskforce, Ottilia brings unmatched expertise.

Watch the full interview with Ottilia Maunganidze for sharp insights into the topics driving MSC 2025!

The Munich Security Report 2025 emphasizes a crucial point: “The challenge of our time is not just to navigate a multipolar world but to ensure it does not become a fragmented one. Cooperation, even among competitors, is the only path to sustainable security.” The conversations at MSC 2025 are shaping the future of global security, governance, and international collaboration.

At Maltego, we are committed to empowering investigators, researchers, and organizations addressing today’s complex security challenges. Through our Grants Program, we provide access to Maltego’s all-in-one investigation platform, enabling NGOs, academics, thought leaders, and trainers to drive meaningful change in global security and governance.

Staying engaged with discussions like MSC ensures alignment with emerging threats, evolving policies, and the critical role of technology in modern investigations. Whether you’re in an NGO, government agency, private-sector intelligence, fraud team, or academia, Maltego empowers your everyday and complex OSINT and cyber investigations with a suite of investigative tools and unmatched access to reliable data.

Discover how Maltego supports thousands of users, including over half of the Dow 30 companies and governments worldwide, to tackle foreign influence, disinformation, geopolitical and transnational organized crime, and enhance regional defense and democratic resilience. Explore our resources here or book a quick conversation today.

Together, we uncover hidden truths and make the world safer!

Shining a Light: Empowering NGOs During National Human Trafficking Prevention Month

Tue, 28 Jan 2025 14:08:43 +0000

January is National Human Trafficking Prevention Month, a time to raise awareness and renew our collective commitment to ending human trafficking and cybercrime. These insidious threats impact millions globally, causing profound economic, social, and personal harm. According to Orphans Hands, human trafficking alone results in a staggering $21 billion loss to the global economy. However, this figure only scratches the surface, as the suffering of victims who endure unimaginable hardships is immeasurable.

While governments and law enforcement agencies are at the forefront of combating these issues, non-profit organizations (NGOs) play a pivotal, yet often overlooked, role. NGOs are instrumental in intelligence gathering, data collection, tool development, advocacy, awareness campaigns, and aiding victim recovery. Despite their critical contributions, these organizations encounter significant challenges in their mission to protect the vulnerable. Challenges Faced by NGOs

Resource Limitations: Many NGOs operate on shoestring budgets, limiting their ability to scale operations and deploy advanced technologies essential for effective cybercrime investigations.
Technological Barriers: The fast-evolving landscape of cybercrime requires NGOs to constantly update their technological capabilities. Accessing sophisticated tools for thorough investigations is daunting due to high costs and rapid advancements.
Expertise and Training: Conducting detailed cybercrime investigations demands specialized knowledge. NGOs often lack the necessary expertise, making ongoing training and support crucial for staying ahead of cybercriminals.
Collaboration and Information Sharing: Effective counter-trafficking and cybercrime efforts rely heavily on robust collaboration and information sharing among diverse stakeholders, including law enforcement and other NGOs.

How Companies Can Help

Providing Advanced Tools and Technology: Companies can significantly aid NGOs by granting access to advanced tools and technologies that enhance their investigative capabilities. For instance, Maltego offers powerful data visualization and analysis tools, enabling NGOs to uncover complex networks and patterns in their investigations.
Offering Training and Expertise: Bridging the expertise gap is essential. Companies can offer training programs and expert support, empowering NGOs to conduct more effective investigations and improve their overall impact.
Facilitating Collaboration and Networks: Companies can foster collaboration between NGOs, law enforcement, and other stakeholders, creating a more cohesive response to cybercrime and trafficking. Secure platforms for information sharing are vital for this cause.
Financial and Logistical Support: Beyond technology, companies can provide essential financial and logistical support, helping NGOs expand their operations, reach more vulnerable individuals, and sustain their efforts.

Maltego’s Commitment

At Maltego, we are proud to stand with our partners like Anti-Human Trafficking Intelligence Initiative in the fight against human trafficking and cybercrime. Guided by our core values, we empower meaningful work, act ethically and consciously, and care deeply about our people and partners.

Mission First, Impact Always: Through the Maltego Grants Program, we support NGOs with the tools, resources, and expertise needed to enhance their capacity to combat trafficking and cybercrime effectively.
Collaboration for Greater Impact: We foster partnerships between NGOs, law enforcement, and other stakeholders to facilitate a coordinated response. By providing platforms for secure information sharing, we amplify the impact of collective efforts.
Continuous Support and Innovation: We provide ongoing training and expert assistance to help NGOs stay ahead of emerging threats. Adapting and evolving our support ensures NGOs have the resources necessary for success.

Conclusion

National Human Trafficking Prevention Month reminds us of the importance of a united front in combating human trafficking and cybercrime. Companies play a critical role in empowering NGOs by providing technological support, training, collaboration opportunities, and financial assistance. At Maltego, we remain steadfast in our commitment to supporting these organizations, ensuring they have the tools and partnerships needed to protect the vulnerable and dismantle criminal networks. Together, we can make a meaningful impact in the fight against these global threats.

References:

Unlock Corporate Intelligence with Reflets and Maltego

Thu, 12 Dec 2024 10:17:10 +0000

In a world awash with data, the challenge isn’t a lack of information—it’s making sense of it. As decision-makers grapple with increasingly opaque corporate structures and jurisdictions with disparate transparency standards, the tools we use to uncover truth must evolve. Enter the Pappers.fr Transform, a collaboration between investigative journalism powerhouse Reflets.info and Maltego, the world’s most used OSINT investigation platform. This isn’t just another OSINT tool; it’s a scalpel for cutting through corporate opacity.

Unveiling Real-World Problems

Imagine you’re tasked with vetting a partnership in France, analyzing an investment portfolio, understanding the relationship between companies and their subsidiaries, or you’re a compliance officer unraveling ownership structures tied to potentially high-risk organizations. Now, picture having to do this with incomplete or siloed data across borders. The stakes? Multi-million-euro fines for regulatory non-compliance, reputational damage, or worse—funding inadvertently funneling into criminal or illicit activities.

For journalists, NGOs, and government bodies, the stakes are even higher. What happens when opaque ownership hides money laundering schemes or tax evasion? Traditional tools often lack the flexibility and depth needed to uncover these hidden connections. That’s the world the Pappers.fr Transform was built for—a world where connecting the dots could mean the difference between exposing corruption and letting it fester.

The Superpower of Data Integration: A New Lens on Corporate Transparency

So, what’s the secret sauce? The Pappers.fr Transform taps into Pappers.fr, a treasure trove of open corporate data covering France, Great Britain, Switzerland, and Belgium. Through Maltego Graph’s intuitive interface, this Transform goes beyond static spreadsheets, offering dynamic insights into capital links, shareholder structures, and the tangled webs of corporate relationships.

But this isn’t just about visualization. It’s about empowerment. By making these insights accessible to anyone with the skill to wield them, Maltego and Reflets.info are democratizing investigative intelligence. Whether you’re chasing profit or justice, the Pappers.fr Transform ensures you’re not flying blind.

Challenges It Tackles—And Why They Matter

Fighting Fraud and Corruption

Corruption thrives in opacity. With its ability to map out ownership networks, this Transform lays bare the hidden pathways of illicit activities. This is a game-changer for compliance teams, investigative journalists, and law enforcement alike.
Bridging Jurisdictional Gaps

While some countries embrace transparency, others shield information behind bureaucratic or legal barriers. By aggregating data across borders, the Pappers.fr Transform levels the playing field, making it possible to uncover connections that would otherwise remain invisible.
Empowering Decision-Makers

Whether it’s an executive assessing a merger or an investigator scrutinizing a suspicious organization, time is of the essence. The Transform enables rapid data mapping, empowering data-driven decisions to minimize risks and boost operational efficiency.
Supporting Ethical Business Practices

In an era where ESG (Environmental, Social, and Governance) metrics increasingly define corporate success, the Pappers.fr Transform provides the clarity needed to ensure partnerships and investments align with ethical and legal standards.

The Bigger Picture: Maltego’s Role in a Transparent Future

This isn’t just about solving today’s problems; it’s about redefining how we approach truth in the digital age. Maltego, widely recognized as the trusted platform for investigators is expanding its scope to tackle global challenges that extend beyond cybersecurity and crime-fighting.

By integrating data from Pappers.fr, Maltego is positioning itself as the go-to platform for decision-makers who need to act with precision in an uncertain world. The message is clear: If you want to stay ahead of the curve, you need tools that don’t just keep up—they set the pace.

The Call to Action: A Tool for Everyone?

The Pappers.fr Transform shines a spotlight on the kind of world we want to build: one where transparency isn’t optional, and accountability isn’t just for the headlines. But tools like these are only as powerful as the people who use them.

Whether you’re a journalist fighting for truth, a compliance officer protecting your organization, or an executive seeking clarity in complex markets, the Pappers.fr Transform is your partner in peeling back the layers of complexity.

In a world that grows darker with every hidden transaction, Maltego and Reflets.info are lighting the way forward. Are you ready to follow the data and lead the charge for a more transparent tomorrow? Catch the recent webinar to discover how Reflets and Maltego can help you unlock powerful corporate intelligence insights—watch it now!

DISCLAIMER

The views and opinions expressed in the webinar recording are those of the guest speakers and do not necessarily reflect the official position of the organizers or affiliated organizations. The content shared is for educational purposes only.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

From identifying potential investment opportunities to mitigating risks, the Pappers.fr Transform provides actionable intelligence in an instant. Explore how this powerful Transform, seamlessly integrated with Maltego, can give your organization a competitive edge!

Stay connected with us on X and LinkedIn, and subscribe to our email newsletter to stay updated with the latest news and developments.

Happy investigating!

Monitoring the 2024 US Election with Maltego Monitor

Tue, 05 Nov 2024 15:27:39 +0000

As the 2024 US election unfolds, the challenge of safeguarding democratic integrity is more pressing than ever. Disinformation campaigns, AI-generated content, and bot-driven networks are intensifying, posing serious risks to the credibility of election outcomes and public trust.

These can also sway public opinion, shaping narratives and influencing voter sentiment in unprecedented ways. Yet, identifying and counteracting these disinformation campaigns remains challenging. In this blog, we’ll discover how Maltego Monitor empowers you to detect these campaigns, trace false narratives, and ultimately help protect the integrity of democratic processes. Plus, stay tuned for an exclusive real-life demo, giving you a firsthand look at how these investigations unfold in action!

What is Maltego Monitor?

Maltego Monitor is an intelligence and monitoring tool within the Maltego platform. It is included in the Organization plan with other tools like Maltego Graph, Maltego Search, and Maltego Evidence. Designed for monitoring high-stakes situations, it empowers public safety and national security teams with real-time intelligence and AI-driven sentiment analysis for precise social media investigations.

With Maltego Monitor, teams can:

Identify and mitigate emerging risks: Track disinformation, AI-generated content, and bot-driven narratives before they impact public sentiment or escalate during critical events like elections.
Analyze vast datasets in real-time: Tap into social media, news, subreddits, and other platforms to spot potential threats and disinformation campaigns.
Deploy intuitive, cross-platform monitoring: Adaptable for both novice and seasoned investigators, it efficiently handles open-source data across high-risk locations to pinpoint disruptions during large-scale events, elections, or crises.

Maltego Monitor’s capabilities enable agencies to make swift, informed decisions and build actionable plans, protecting democratic processes and minimizing impacts on election integrity. Let’s find out how Maltego Monitor can be used for monitoring the 2024 US election. Continue reading!

Tracking Disinformation Spread and Botnet Activities with Maltego Monitor

Disinformation campaigns and botnet activities can undermine public opinion and disrupt democratic processes. With Maltego Monitor, you can track the origins and spread of disinformation, identify coordinated botnet activities, and uncover the network of sources fueling harmful narratives.

Ready to see Maltego Monitor in action? Watch the full demo now!

DISCLAIMER

The examples in this video are provided solely for educational purposes and do not imply or suggest support, endorsement, or alignment with any political party, policy stance, religious belief, or ideology. The keywords and views expressed are intended to illustrate the spread of disinformation and are not reflective of any specific affiliations or endorsements.

Discover More Powerful Use Cases in eBook

Maltego Monitor is an essential resource for commercial sectors, law enforcement agencies, and governments, enabling them to counter disinformation, safeguard corporate reputation, track illicit activities, and respond to diverse threats. It empowers teams to respond proactively to crises, allowing them to act swiftly and decisively in the face of emerging risks tied to elections and beyond.

See how Maltego Monitor meets your investigative needs! With unpredictable threats emerging online and escalating fast, comprehensive situational awareness is key. Get the insights you need with our latest e-book. Download now or request a demo to see how Maltego integrates seamlessly into your workflows—tailored to your cases!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Stay connected with us on X and LinkedIn, and subscribe to our email newsletter to stay updated with the latest news and developments.

Happy investigating!

About the Author

Mitch Chaiet

Mitch Chaiet, founder of Experiential Technologies, is a disinformation researcher and investigator dedicated to providing tools, intelligence, and content to track information across the internet. His team at Experiential Technologies, a technology prototyping partner for creatives, supports the OSINT industry with services and tools for image, video, audio, AI, and social media analysis. Reach out for social media OSINT services with Maltego Monitor.

Empowering the Fight Against Cybercrime: Maltego's Support for the Cybercrime Atlas

Wed, 23 Oct 2024 10:02:24 +0000

In a world where digital threats are growing at an alarming rate, it becomes essential for organizations to join forces and make a meaningful impact. At Maltego, we believe that our role goes beyond providing technology; it’s about giving back and supporting those on the front lines fighting the good fight. That’s why we’re incredibly proud to announce our latest support for the Cybercrime Atlas – an initiative hosted in the World Economic Forum that is dedicated to mapping, disrupting, and ultimately reducing global cybercrime.

Giving Back Through Our Core Values

Maltego’s core values drive everything we do: Empowering meaningful work, acting ethically and consciously, and fostering a culture where we care and commit to causes that make a difference. Our partnership with the Cybercrime Atlas reflects these values in action. It’s about contributing to a safer world by supporting organizations actively working to disrupt the cybercrime ecosystem.

“The Cybercrime Atlas is a collaborative research initiative by leading companies and experts, facilitated by the World Economic Forum, to map the cybercrime landscape,” said Tal Goldstein, Head of Strategy and Policy at the World Economic Forum’s Centre for Cybersecurity. “The insights generated are promoting opportunities for greater cooperation between the private sector and law enforcement to address cybercrime.”

Cybercrime doesn’t just affect corporations; it impacts individuals, critical infrastructure, and governments worldwide. The Cybercrime Atlas community, hosted by the World Economic Forum’s Centre for Cybersecurity, aims to build a shared knowledge base that tackles this problem head-on. By leveraging open-source research, the Atlas creates new insights into the cybercriminal ecosystem, equipping cyber defenders with the knowledge to disrupt cybercrime and mitigate attacks.

Our Commitment to the Global Good

Our support for the Cybercrime Atlas isn’t about showcasing Maltego or promoting our solutions. It’s about standing with those dedicated to making the world a safer place. The collaboration was made possible through the Maltego Grants Program for Education & Research, a program we hold dear as it embodies our goal to push boundaries and help solve society’s toughest challenges.

The Maltego Grants Program empowers academia, researchers, trainers, and non-profit organizations, fostering a community where collaborative intelligence thrives. Through this partnership with the Cybercrime Atlas, we can support the critical work they’re doing to map the cybercrime landscape, disrupt criminal activities, and shape public policy for a safer internet.

Maltego: Empowering Cybercrime Disruption with Maltego

While our mission here is to support, it’s worth highlighting how the Maltego platform can assist the Cybercrime Atlas community. Maltego is instrumental in:

Conducting Criminal Investigations: Uncovering the networks, infrastructure, and operations of cybercriminals.
Enhancing Cyber Threat Intelligence: Providing researchers with insights that lead to actionable disruption of cybercrime.
Protecting National Security and Public Safety: Equipping organizations with the means to safeguard critical infrastructures.

By providing support to the Cybercrime Atlas, we enable their community members to delve deep into open-source research, identify key threats, and share their findings effectively. Our all-in-one platform, tailored to enhance intelligence and counter cybercrime, align seamlessly with the Atlas’ mission of driving a global, united response to the ever-growing threat of cybercrime.

A Shared Mission: Making the Internet Safer

At Maltego, we’re driven by our beliefs and share these values with every NGO we support through our Grants Program. The Cybercrime Atlas’ approach to mapping, disrupting, and shaping the future of cybercrime resonates deeply with us. As cybercrime groups expand and exploit complex, cross-border infrastructures, collaboration and open research become crucial to outpace these threats.

The Cybercrime Atlas addresses key challenges in the fight against cybercrime:

Mapping: Bringing together a community to chart the landscape of cybercriminal networks and activities.
Disrupting: Offering actionable research to its members to dismantle criminal operations.
Shaping: Providing evidence-based recommendations to enhance public policy and operational collaboration, making the digital world increasingly hostile for criminals.

In a landscape where knowledge is fragmented and responses often disjointed, the Cybercrime Atlas seeks to unify efforts, breaking down the silos that hinder a coherent defence. This is why we are so happy to support this partnership – not because it benefits Maltego, but because it strengthens the global fight against cybercrime.

A Call to Collaborative Action

We believe that meaningful change happens when like-minded organizations come together to ask the big questions and chase solutions. By partnering with initiatives like the Cybercrime Atlas, we reaffirm our commitment to empower those who work tirelessly to make a difference. Whether it’s protecting national security, conducting criminal investigations, or combating cybercrime, we are here to support those tackling these challenges.

The road ahead is complex, and cyber threats will continue to evolve. However, through partnerships like this, we remain hopeful. We are driven by a simple belief: life is about giving back, and our support of the Cybercrime Atlas is just one way we strive to contribute to a safer, more secure digital world.

Let’s continue to empower meaningful work, act consciously, and support those on the front lines of the fight against cybercrime. Together, we can make the internet a safer place.

Overcoming Information Overload in Social Media Investigations

Thu, 17 Oct 2024 06:18:02 +0000

Social media is a central part of our lives—both personally and professionally. For investigators, the abundance of information it provides offers great potential, but as the volume of content explodes, it also leads to information overload.

This overwhelming amount of data makes it challenging to find actionable intelligence, understand a user’s intent, and move investigations forward, whether your team is working on fraud cases, criminal investigations, brand protection, or others.

In a recent episode of the N2K CyberWire Daily podcast, Ben April, Chief Technology Officer at Maltego, discussed these challenges and shared valuable insights on how organizations can leverage social media data as a critical source of intelligence for their investigations.

Read on to discover key takeaways, or listen to the full interview now!

LISTEN TO THE INTERVIEW

Takeaway 1: The Growing Complexity of Data Collection

What began as text-based communities has quickly evolved into images, videos, and now we’re starting to explore VR and immersive 360-degree content, creating a vast pool of self-published information. This surge in content offers new opportunities, but it requires investigators to adapt and stay alert to growing threats.

As new social media features emerge, so do novel risks, which bad actors quickly exploit. To keep up, investigative teams need the right tools to efficiently handle diverse data formats and evolving threats.

Social media platforms are also not one-size-fits-all when it comes to collection of that data. Each has its own policies, structures, and tools, which can make accessing intelligence a challenge.

Takeaway 2: Balancing Real-Time vs. Historical Data

Real-time data provides a snapshot of current events, while historical data offers essential context and patterns that are often critical for building a case. The decision between real-time and historical data depends on the investigation’s goals. As Ben put it in the interview:

You’ve got to look for whether you’re getting access to real-time only, or real-time plus historical, or maybe even historical only. And it’s not just about the type of data—it’s about how it fits your investigation. You need to align your data collection with what you’re actually trying to achieve, whether it’s immediate insights or building a long-term case based on patterns and historical behaviors.

Your choice guides the team’s investigations and ensures they use the best tools for the job.

Misinterpreting data is a common risk in social media investigations. It is easy to fall into the trap of confirmation bias, where investigators see something that aligns with what they expect while missing key context that might paint a different picture. Drawing conclusions about a subject’s intent from a single post or interaction can lead your team down the wrong path.

Given the volume of data, separating authentic content from noise is also difficult, and the intent behind posts can be hard to discern. Scrutinizing social media data and corroborating it with other sources helps build a more reliable narrative. For example, teams using the Maltego platform rely on Maltego Data to cross-reference information from various sources and integrate internal data to ensure the accuracy of their conclusions.

Hear more of Ben’s insights on the full podcast episode:

While Ben’s interview highlighted the challenges of collecting social media data and overcoming information overload, addressing these issues in practice requires teams to adopt technology that integrates data from diverse sources and helps uncover actionable intelligence more efficiently.

The Maltego platform provides investigators with an ecosystem of tools and data, allowing them to analyze and connect social media data with other intelligence sources to make sense of even the most complex cases. Organizations worldwide succeed in social media investigations through:

Mapping connections between individuals, organizations, and posts in a clear, visual format using Maltego Graph, making it easier to track relationships across social media platforms and uncover hidden links that might not be immediately apparent.
Running quick OSINT lookups across vast datasets with Maltego Search, enabling investigators, especially novices, to efficiently gather relevant social media information while maintaining clear data lineage. This helps prevent getting lost in large volumes of data.
Cross-referencing social media data with external sources and internal datasets to enrich investigations with broader context and ensure more accurate conclusions, all powered by Maltego Data.
Monitoring social media in real-time with Maltego Monitor, allowing investigators to track changes in posts, accounts, and interactions as they happen, keeping them updated on developing situations.
Conducting deep social network analysis and securing critical information with Maltego Evidence, which provides first-hand access to social media data before it is altered or deleted, preserving vital historical information for investigations.

Try Maltego for Your Next Investigation

Want to see how Maltego can help your team overcome the challenges of social media investigations?

Request a demo today:

GET A DEMO

In conversation with the winners of the Global Collegiate Penetration Testing Competition

Wed, 18 Sep 2024 08:19:42 +0000

Fall 2023 saw the exciting Global Collegiate Penetration Testing Competition (CPTC), organised by the RIT ESL Global Cybersecurity Institute, USA. In this recorded webinar, Maltego Grants for Education & Research speaks to students from the Princess Sumaya University for Technology, Jordan, the winning team who stood out from more than 400 elite cybersecurity students from 70 colleges. Get behind-the-scene insights on how their hard work, practice and determination helped them win CPTC9.

Maltego partnered with the Collegiate Penetration Testing Competition (CPTC) for the first time as one of the Gold Sponsors, to empower the world’s top cybersecurity students. CPTC focuses on mimicking the activities performed during a real-world penetration testing engagement conducted by companies, professional services firms, and internal security departments around the world. Through the Maltego Grants for Education & Research Program, Maltego provided the CPTC Team with its all-in-one cyber investigation tool, which accelerates and simplifies investigations through link analysis and seamlessly uncovers patterns and multiple order data connections.

We hope you enjoyed this webinar. Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter to stay updated on the latest tutorials, use cases, and webinars!

Happy investigating!

Boost Intelligence Operations: Save Thousands of Hours with OSINT Industries

Wed, 18 Sep 2024 07:27:31 +0000

Today’s investigator faces an information explosion. If you too are struggling to keep up with the information explosion, watch our recorded webinar and discover how you can investigate smarter with OSINT Industries’ cutting-edge toolkit. Learn how our tools provide 100% accurate, real-time data retrieval, turning hours of research into just 15 seconds of effort. Hear from experts Nathaniel Fried, CEO of OSINT Industries, and Mathieu Gaucheler, Maltego SME, on mastering these next-gen solutions.

We hope you enjoyed this webinar. Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter to stay updated on the latest tutorials, use cases, and webinars!

Happy investigating!

Driving Strategic Decisions through Actionable Threat Intelligence Reports

Thu, 12 Sep 2024 08:06:16 +0000

Given the relentless evolution of cyber threats, organizations face constant pressure to stay ahead of emerging threats. Decision-makers depend heavily on accurate and actionable threat intelligence reports to safeguard their assets and ensure business continuity through informed decision-making.

Consequently, they expect their Cyber Threat Intelligence (CTI) teams to produce more frequent and vigilant reports, including comprehensive monthly and quarterly threat analysis reports and daily bulletins that update on threat actors and phishing attempts. These reports are essential; serving as a critical bridge between raw data and strategic action, turning complex information into clear insights that guide security efforts. In this blog, we’ll focus on how to create actionable threat intelligence reports during the dissemination stage of the intelligence lifecycle. We’ll start by examining the importance of these reports for organizations and how they drive effective decision-making.

The Importance of Threat Intelligence Report

Given the increasing demand for actionable threat intelligence reports in many organizations, the accuracy and value of these reports have become key indicators of a CTI team’s effectiveness. This underscores the vital role they play in organizational security and strategic decision-making.

Therefore, CTI teams have adapted to meet the increasing demands of their organizations. Much like skilled journalists, they gather and analyze extensive information - particularly from diverse data sources - to cross-reference and validate potential threats. Moreover, they must possess the ability to present their findings in well-structured, comprehensive reports.

However, challenges in creating these reports can arise at any stage of the intelligence lifecycle, from data collection to analysis. But we all can admit that challenges in the earlier stages of the lifecycle, such as collection and analysis, are another big topic for another day.

A well-crafted threat intelligence report is more than just a collection of data; it’s a strategic tool that helps organizations understand the nature of the threats they face, prioritize their responses, and allocate resources effectively. For threat intelligence teams, the ability to produce these reports is not just about technical expertise; it’s about delivering the right information in the right way to support different stakeholders in protecting the organization.

Continue reading to discover the challenges threat analysts encounter during the dissemination phase, the essential components that make reports actionable, and how to turn gathered intelligence into strategic decision-making tools!

Key Challenges Faced by Cyber Threat Analysts In Reporting

Even the most skilled threat intelligence teams can face challenges when creating reports during the dissemination phase that are both actionable and relevant to decision-makers. Here are some of the most common challenges:

Lack of Standardized Guidance: Without clear guidelines or standardized formats, reports can vary significantly in structure and content. This inconsistency can lead to confusion, making it difficult for decision-makers to rely on the intelligence provided. A lack of uniformity may result in reports that are either too detailed, overwhelming the reader, or too vague, missing critical insights.
Lack of Process: When there is no established process for creating and reviewing threat intelligence reports, teams often struggle with inefficiencies and miscommunication. A well-defined process ensures that everyone on the team understands their role and the expectations for the final product. Without this, reports can suffer from delays, gaps in critical information, and lack of coherence.
Lack of Training/Knowledge on Creating an Actionable Report: Creating a report that drives action requires more than just compiling data; it demands analysis, insight, and a clear understanding of the audience’s needs. Team members lacking training in these areas may produce reports rich in data but poor in actionable recommendations. This knowledge gap can undermine the report’s value, leading to missed opportunities for proactive defense.
Manual Process and Inefficiency: Manual data collection and analysis are both time-consuming and prone to errors. These inefficiencies can delay the delivery of reports, reducing their relevance and impact. Moreover, the manual process can lead to inconsistencies in how data is handled and interpreted. Automating parts of the report generation process with a tool like Maltego Graph can help mitigate these issues, allowing teams to focus on analysis and strategy rather than data wrangling.

Although tackling these challenges could fill an entire paper, we’ve compiled a few key insights into this whitepaper specifically for CTI team leads to address common issues analysts encounter during the dissemination phase of report creation. These may seem basic, but it’s essential to ensure they’re solidly in place. Download now to explore these insights or read along!

DOWNLOAD WHITEPAPER

Translating Threat Intelligence to Actionable Report

For a threat intelligence report to be truly effective, it must be structured to communicate the necessary information while guiding decision-makers toward actionable steps. Discover the critical elements that should be present in every threat intelligence report:

Essential Elements of a Threat Intelligence Report

These components form the backbone of a threat intelligence report. When structured effectively, they ensure that the report not only informs but also drives strategic action. Now that we’ve covered what must be included in the reports, let’s dive into the most important part of a threat intelligence report: how to operationalize it.

NOTE

Depending on the type of intelligence you are writing about, additional components may need to be included. For instance, a threat actor profile should encompass identifiers, motivations, capabilities, and TTPs (Tactics, Techniques, and Procedures). For further guidance, refer to MITRE’s CTI Blueprints project for various examples of threat intelligence reports.

Download the Whitepaper to Get Hands-On Insights

The true value of a threat intelligence report isn’t just in the data it provides, but in how that data is interpreted and used to drive action. For the insights to translate into meaningful security improvements, analysts must include actionable recommendations—ranging from immediate and long-term actions to security controls and process changes—so the gathered intelligence can be fully operationalized.

Download our white paper to uncover solutions for overcoming key challenges in report creation. We’ve included the entire template of a threat intelligence report from an access broker investigation to clearly demonstrate how to translate threat intelligence into actionable steps!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Stay connected with us on X and LinkedIn, and subscribe to our email newsletter to stay updated with the latest news and developments.

Enjoy exploring the resource!

About the Author

Mario Rojas

Mario Rojas is a former Cyber Security and Threat Intelligence Subject Matter Expert at Maltego with more than 14 years of experience in the cybersecurity field. His expertise in open-source intelligence (OSINT) allows him to effectively map and visualize complex relationships and connections between entities, from IP addresses and domain names to social media profiles and dark web forums.

Unpacking NIS2: Leveraging the Power of Maltego to Enhance Your Cybersecurity Posture

Wed, 21 Aug 2024 07:59:11 +0000

The NIS2 Directive, officially known as the Network and Information Security Directive, is a significant piece of European Union (EU) wide cybersecurity legislation. It was introduced to bolster cybersecurity across the EU and protect critical infrastructure. Effective from January 2025, with transposition into national laws required by October 2024, the directive imposes stringent compliance measures, including financial penalties and potential consequences for C-level executives.

As the specific requirements remain unclear, organizations face uncertainty in preparing for compliance. This article explains how Maltego can support businesses in enhancing cybersecurity measures, including risk assessment, incident investigation, and information gathering, to help navigate the challenges posed by the NIS2 Directive. Get the complete picture now!

Evolution of the NIS2 Directive

To grasp the NIS2 Directive, let us first understand the original NIS Directive of 2016, the first EU-wide cybersecurity legislation. Enacted on July 6, 2016, as Directive (EU) 2016/1148 by the European Parliament and the Council of Europe, its aim was to enhance cybersecurity and risk management for organizations that provide services essential to our economy and society, particularly those that heavily depend on information and communication technologies (ICTs), such as energy, transportation, water, banking, financial market infrastructures, healthcare, and digital infrastructure.

Between 2016 and 2018, efforts persisted to develop this foundational cybersecurity legislation, garnering substantial industry interest as it represented the inaugural EU-wide legislative effort in this field.

Why do we now have a second version? The COVID-19 pandemic in 2020 caused significant disruption, accelerating digital transformation and reshaping the threat landscape with a substantial increase in cybercrime. High-impact data breaches, such as the SolarWinds attack, affected supply chains and critical infrastructure providers. Additionally, the EU noticed inconsistencies in how member states applied the directive, particularly in defining which organizations qualify as essential operators and digital service providers. There was also insufficient common understanding of the main threats and challenges. This recognition led to the revision of the directive.

In conclusion, the NIS2 Directive (Directive 2022/255) was published on January 16, 2023, to make the regulations more specific and thorough. It mandates that every member state harmoniously transposes to stricter regulations by the deadline of October 17, 2024. The primary goal of this second version is to reduce inconsistencies by covering a broader range of organizations and implementing stricter requirements and liability provisions for the management of affected organizations. Wondering if your business falls under the scope of the NIS2 Directive? Explore more below!

Sectors in Scope

This categorization aims to ensure that sectors vital to the economy and society are better protected against cyber threats. The NIS2 Directive, covered by two annexes, expands the scope of the original NIS Directive to include more sectors and types of entities, reflecting the growing interconnectedness and digitalization of critical infrastructure. Annex I lists the high criticality sectors, which can be classified as either “Essential” or “Important” entities based on the industry type, number of employees, annual turnover, and balance of the organization.

Additional Notes:

Specific to certain services: There are sectors dedicated to specific services, such as Trusted Service Providers, which include electronic identification and trust services, DNS and name registries, and public communications networks or publicly available electronic communication services.
Entities within these sectors need to comply with the NIS2 directive’s requirements for cybersecurity risk management and incident reporting.
Important entities include those from other critical sectors but with slightly different obligations compared to Essential entities.

REMARK

Please note that an entity exceeding the threshold for the “Important” sector but not meeting the criteria for the “Essential” entity must comply with this law as an “Important” enterprise. A detailed and designated list of operators of essential services and digital service providers can be found here. For more FAQs related to the NIS2 Directive click here.

Enhancing NIS2 Compliance with Maltego

Every business relies on a digital network and technology stack consisting of multiple platforms and providers, all of which are heavily interconnected. The CrowdStrike incident is a prime example of how one security event can severely impact others, causing billions in financial losses across various industries. Following this incident, we’ve seen malicious forces take advantage of the crisis, striking when targets are most vulnerable.

This highlights the critical need for many businesses to bolster their cyber resilience and collaborate with other sectors. While using Maltego alone does not directly ensure compliance with the NIS2 Directive, it can be an essential component of a broader toolkit that supports NIS2 compliance in areas such as risk assessment and management, incident response and forensic investigations, and information sharing.

For instance, the entire initiative focuses on effective risk management and incident response posture to mitigate risks associated with network and information systems. It also emphasizes the importance of reporting incidents in a timely and accurate manner to relevant authorities. Maltego can help map the digital footprint of an organization, identifying potential threats and vulnerabilities more comprehensively. By enabling real-time data collection and visualization, Maltego assists in the quick identification, triage, and analysis of incidents.

In the whitepaper, we detail more examples of how Maltego can enhance compliance with the NIS2 Directive in key regulatory areas.

DOWNLOAD WHITEPAPER

Download the Whitepaper for Full Insights!

Understanding and adhering to the NIS2 Directive is not just a regulatory necessity; it is a critical step in bolstering cybersecurity defenses. Integrating Maltego into cybersecurity strategies allows organizations to strengthen their defenses and adhere more closely to the stringent requirements of the NIS2 Directive. This alignment not only ensures compliance but also enhances overall cyber resilience, providing a comprehensive approach to managing cybersecurity risks. Download the white paper to find more out about how Maltego enhances NIS2 compliance, guidance on how to prepare your organizations, and the importance of threat intelligence in regulatory compliance.

Download the white paper to learn more about how Maltego enhances NIS2 compliance, provides guidance on preparing your organization, and emphasizes the importance of threat intelligence in regulatory compliance.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Stay connected with us on X and LinkedIn, and subscribe to our email newsletter to stay updated with the latest news and developments.

Happy investigating!

Where to Gather Intelligence for Deep and Dark Web Investigations

Thu, 11 Jul 2024 05:25:22 +0000

The surface web, the deep web, and the dark web all provide useful information for analysts to explore and draw from for use in their OSINT investigations. The deep, and the dark web contain far more data compared to the surface web, and though both are used by people from all walks of life, they are often thought to be the source of a sizeable chunk of illegal activities in both the real and digital worlds.

The wealth and type of information contained in the deep and dark web, combined with the higher security access and the degree of anonymity they provide, are what have essentially turned them into prime real estate for threat actors.

By the same token, this flurry of threat actor activity has also led investigators and analysts from various industries to consider the deep and dark web as prime sources of information. However, while gaining access to data on the surface web is quite simple and performed daily, accessing data on the deep and dark web can be considerably trickier and requires more consideration and resources.

So, what are the differences between the deep and dark web? Why is the data they contain so useful not only to threat actors but to investigators and analysts alike?

In our whitepaper, you will find answers to those and more questions. It will also provide you with a list of data sources and ready-to-replicate workflows to support your deep and dark web investigations. Download now or follow along to take a look at some of the insights first!

DOWNLOAD FULL VERSION

Differences Between the Surface Web, Deep Web, and Dark Web

Before we delve into the deep and dark web, and why accessing data from these layers is relevant to investigations, let’s quickly touch upon the surface web.

Surface Web

Also known as the visible, open, or public web, the surface web is the most superficial layer of the internet and encompasses everything that is accessible via search engines that use page indexing, such as Google or Bing. Searching the surface web usually returns a good deal of results that can be narrowed down using a range of dorking techniques.

As endless as popular search engine results may often appear, surface web data still amounts to less than 5% of what is contained on the internet. It is precisely that remaining 95% that constitutes the deep and the dark web and our topic at hand.

Deep Web vs. Dark Web

Unlike the surface web, these two layers represent the non-indexed content available on the internet. This means content which cannot be found using common search engines like Google or Bing. However, there are substantial differences between the deep and the dark web.

For instance, unlike the dark web, the deep web doesn’t require specific software to be accessed. Still, its contents can’t be identified, tracked, or crawled by standard search engines because it is either password-protected or kept behind specific internet services for privacy and security reasons.

The data contained within our email inboxes, online banking services, and even job intranets are examples of the deep web. And, as you can imagine, this data is usually only available to the user and the service providers, unless specific allowances for investigators are made in the terms of service, such as for criminal investigations.

The dark web, on the other hand, isn’t indexed by search engines and is accessible via specialized networks such as The Onion Router (TOR), I2P, or Freenet, which are designed to enable anonymous communication over the internet. This makes it a valuable source of intelligence for those who know how to navigate it.

When discussing the key differences between using conventional web browsing and accessing the dark web via specialized networks, it is necessary to distinguish between browsers like Google Chrome and entire networks like TOR.

Google Chrome utilizes standard internet protocols to access websites through easily understandable URLs. In contrast, networks such as TOR operate on unique protocols designed specifically for anonymity. These protocols then affect how URLs are structured. Unlike standard web addresses, TOR URLs are derived from the public key as part of the protocol, making them almost impossible to guess, remember, or understand.

Oftentimes, information stolen from the deep web, be it passwords or other privileged data, ends up being sold on the dark web. However, not everything that transpires there is of a criminal nature. Journalists, activists, and politicians working and reporting under corrupt or totalitarian regimes use it to gather, collaborate, and exchange information without fear of being harassed or prosecuted.

DOWNLOAD FULL VERSION

The Scope of Deep and Dark Web Investigations

As mentioned before, some threat actors lurk within the deep web, where they use techniques such as phishing and social engineering to steal personal data, defraud individuals, or get a foothold into a specific organization. They might then turn towards the dark web to profit from their schemes by selling the stolen data or the kits they developed for their schemes.

Others may prefer the enhanced anonymity of the deep and dark web, as it allows them to conduct their illegal activities anonymously, be it hacktivism, exchange of CSAM material, trading illegal goods, such as drugs or weapons, or disseminating content that incites violence and facilitates terrorist activities.

Because of that, analysts and investigators use data from the deep and dark web for different types of investigations:

For one, analysts can study the interactions between extremist groups, criminal organizations on dark web forums, and, in specific cases, law enforcement can use seized data from private messages to support their investigations.

For others, the deep and dark web can help bolster cybersecurity when used as a source of enrichment. This allows them to:

confront fraud by tracking mentions of their brand and products across different forums.
react to insider threats by tracking paste sites and chatter regarding password or data leaks.
enhance physical security by monitoring underground chatter.
gain insight into how their current policies and processes may be enabling criminal activities, such as human trafficking, to take place.

Where to Gather Intelligence for Deep and Dark Web Investigations

IMPORTANT!

Before discussing where to gather this type of intelligence, it is necessary to note that investigating deep and dark web forums means that law enforcement agencies (LEAs) don’t just passively monitor these forums from a distance but actively engage in them to gather intelligence and evidence. This requires LEA officers to use undercover or sock puppet accounts to infiltrate these forums.

To ensure appropriate rules are followed and protective measures are taken, each country must have legislation related to undercover agents, so it is important for investigators to operate within the established legal framework.

For example, to verify if someone is selling illegal goods, LEA officers must engage in one-on-one conversations through private messages with sellers and provide proof of illegal activity. This engagement must comply with relevant laws, as not all countries permit such investigative methods.

Regarding where to gather the intelligence, there are several options to explore, starting with forums and communities where dark web users interact, monitor dark web marketplaces to observe transactions of illegal or stolen goods, and access data breach sites to enrich their findings.

Some deep web forums also have social media components or are discussed on surface web platforms, where users may share information about dark web activities. This is another valuable option for investigators, especially in the early stages of an investigation when no concrete starting point has yet been identified.

However, it is important to point out that manually searching for and collecting such intelligence is time-consuming and requires maintaining high operational security to avoid leaving digital footprints that could expose the investigator’s identity and intentions.

For these reasons, investigators may use tools like Maltego, which facilitates the process of collecting and analyzing data from the deep and dark web while keeping the searches within the tool anonymous. Using Maltego, investigators can leverage data from a number of providers of breached data and information on dark web users, their activities on forums, and more.

How can your team leverage deep and dark web intelligence in Maltego?

Download Full Version

Access the full version of this whitepaper now to see an extensive list of recommended sources for deep and dark web intelligence to help conduct and enrich your team’s work!

Inside, you will also find real-life examples showing how to use these sources as data integrations within Maltego, along with ready-to-replicate workflows to maximize your team’s success.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Sergio Leal Rodriguez

Exploring ATT&CK and MISP Data with Maltego

Mon, 08 Jul 2024 08:58:53 +0000

For the cyber intelligence community, MITRE ATT&CK has become the standard for modeling and communicating adversarial tactics and techniques based on real-world observations. Provided and maintained by the MITRE organization, the ATT&CK Matrices are enabling numerous communities to develop more effective cybersecurity practices.

Introduction

Many organizations run MISP instances with other cybersecurity tools and OSINT for data-driven investigations. Investigators can integrate internal and external data to map with MISP data in various ways. This blog details how to look up information directly in the MISP community using MISP Transforms on Maltego Graph, highlighting its seamless integration for efficient and comprehensive investigations.

How Maltego Integrates with MISP Data

Requirements

API access to MISP instance(s) and MISP-Maltego Library. Pre-requisites and installation instructions are available on GitHub here. Alternatively, if your MISP instance is internet-facing, you can use the integration provided by Maltego. Simply install the “ATT&CK – MISP" Hub item and enter your login information under Settings.

Use Cases

With MISP and MITRE ATT&CK Entities and Transforms on Maltego Graph, investigators can query data directly within the same interface during investigations, achieving faster clarity while improving workflow efficiency. They can explore MISP threat-sharing instances, events, attributes, objects, tags, and galaxies for a solid starting point for further exploration. Typical use cases include:

Query MISP Datasets: Seamlessly query MISP datasets within Maltego Graph to enhance your investigations with valuable threat intelligence. For instance, query a MISP instance for events containing a specific Indicator of Compromise (IoC).
Visualize Connections: Visualize and map relationships between MISP data and other OSINT sources to uncover hidden patterns or connections that might have gone unnoticed. For example, pivot a MISP event into its attributes, objects, tags, galaxies, and related events.
Enrich Entities: Enrich Entities discovered during investigations with relevant MISP data, providing additional context and insights into data. For example, explore details from galaxies and related events.
Streamline Workflows: Enhance investigative workflows by integrating MISP data for better situational awareness and time savings. For example, categorize related information within the MITRE ATT&CK framework.
Foster Collaborative Threat Analysis: Collect, manage, and disseminate intelligence across organizations and with cybersecurity professionals based on the results. This facilitates a streamlined process and collaborative approach that spans the entire threat intelligence lifecycle—from collection and processing to analysis.

Maltego Graph also enables the visualization of the full MITRE ATT&CK framework, MISP Galaxies, and more. These capabilities not only reduce efforts but also ensure a more structured and efficient intelligence collection and analysis process, leading to quicker and more accurate threat detection and response.

Introducing Workflows

Identify Suspicious Information: During your investigations, you may come across suspicious data such as domains, DNS names, email addresses, or IP addresses.
Use MISP Transforms: Utilize MISP Transforms in Maltego Graph to analyze the above information.
Look Up in MISP Community: From any type of Entity, query the MISP community.
Check for Existing Records: Determine if the information has already been recorded in the MISP database to have additional context and insights into the data.

Demonstration

Below, you will find a simple investigation to learn how to leverage Maltego integration with MISP.

Step 1 – Starting with suspicious data
- Overview: Let us start with an email address that a spam trap has detected. The given email source is hardik.desai.neostructo@mail[.]com. We will continue our investigation of this email address by adding it to a new graph. In the Transform menu, under the ATT&CK and MISP Transform group, use the To MISP Events Transform to find any related events.
- Maltego task: Select the Phrase Entity containing the email address and run the following Transform:
  - To MISP Events
Step 2 – Checking details for insights
- Overview: Sure enough, the email has already been recorded as an attribute of event ID 1241. The event info detailed in the Property View also indicates that it is associated with a COVID-related fraud email campaign. Additionally, there are six other attributes and objects linked to this event.
- Maltego task: Check event details in Property View.
Step 3 – Checking other attributes of the event
- Overview: Next, we would like to see what else is known about this event (6 attributes).
- Maltego task: Run the following Transform:
  - To Attributes/Objects
Step 4 – Analyzing and classifying phishing threats
- Overview: The previous step brought back the list of attributes and objects, including IP addresses, URLs, and domains, and a link to a VirusTotal report. From the Event Entity, there are various steps you could take to get more insights, such as finding related events or pulling a list of the tags.
- Maltego task: Run the Transform and switch it to List View to check phishing classification.
  - To Tags
Step 5 – Mapping the patterns with MITRE ATT&CK
- Overview: From the list, we can see that this event is classified as a cyber threat, specifically part of a spear-phishing campaign. It utilizes email spoofing, as shown in the List View image. The event is associated with some ATT&CK patterns. In this case, let’s explore the patterns using the MITRE ATT&CK framework data. By identifying these patterns, we can better protect ourselves against such attacks and test our incident readiness. First, check the details about the malware, software, and tools used in the attack technique. This information will help us understand the threat and improve our defensive strategies.
- Malteg task: Select “mitre-attack-pattern Spearphishing via Service – T1194” Entity and run the following Transforms to look up the details
  - To Malware/Software/Tools
Step 6 – Exploring attack patterns
- Overview: After checking the details, we can find other MISP events associated with this attack or search for specific threat actors known to use this attack pattern. This includes identifying which threat actors have utilized the pattern.
- Maltego task: Run Transform:
  - To Related Galaxies
    
    As a result, you will find that threat actors like FIN6, Dark Caracal, OilRig, and Magic Hound have used the same pattern. And finally, from a galaxy, there is of course a lot more information you can pivot to.
Step 7 – Exploring mitigation techniques
- Overview: Now, we can discover suggested mitigation techniques to protect against this type of attack, such as using antivirus or antimalware software, performing user training, and restricting web-based content. For brevity, let’s look at one more example. Using the “To Malware/Software/Tools” Transform on the threat actor called Dark Caracal, we can identify the malware, software, and tools that this threat actor commonly uses.
- Maltego task: Select threat actor and run the following Transform:
  - To Malware/Software/Tools

Voilà! The result reveals that Dark Caracal prefers to use FinFisher, Bandook, CrossRAT, and Pallas malware for their attacks. This demonstrates the extensive insights provided by integrating MITRE ATT&CK and MISP data using Maltego. The biggest advantage is the ability to extend and enrich investigations or uncover new IoCs through various data integrations without switching tools. To learn more about Maltego’s CTI-specific data integration, check our blog about Maltego Handbook for Cyber Threat Intelligence or simply download the handbook now.

DOWNLOAD HANDBOOK

Conclusion

The integration of Maltego with MISP supercharges analysts with unprecedented situational awareness for complex OSINT investigations. By leveraging Maltego’s visualization and data capabilities along with MISP’s extensive threat intelligence data, investigators can uncover hidden connections, enrich their findings, and streamline their workflows—all within the familiar Maltego interface. This powerful combination enhances the depth and efficiency of threat intelligence operations, providing a comprehensive toolset for effective data collection and threat analysis.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Stay connected with us on X and LinkedIn, and subscribe to our email newsletter to get updated with the latest news and developments.

Happy investigating!

Utilizing Maltego for Various Dark Web Investigations

Fri, 28 Jun 2024 07:17:22 +0000

The dark web is often seen as a mysterious and impenetrable part of the internet, accessible only to cybercriminals and law enforcement. However, its hidden forums and marketplaces hold valuable information that companies can use to protect their assets and understand emerging threats. Despite the belief that dark web investigations are too complex for anyone but law enforcement, tools like Maltego are making these investigations more accessible and effective for businesses.

Understanding the Dark Web

The dark web is a part of the internet that isn’t indexed by search engines and requires specific software, like the Tor browser, to access. Its hidden nature makes it a hub for illicit activities and a valuable source of intelligence for those who know how to navigate it.

Key forums and marketplaces on the dark web are where many of these activities begin. These sites are often the starting points for trading stolen data, selling insider information, and offering access to compromised systems.

In the above example, we see a threat actor using a dark web forum to offer access to hacked instances of various organizations. For organizations aiming to protect themselves, monitoring these posts for mentions of their infrastructure is crucial.

Use Cases for Dark Web Investigations

Investigating dark web forums involves navigating the dark web and manually searching for specific keywords to uncover information that may be relevant to your organization. This can be daunting and risky, exposing investigators to malware, phishing attacks, and other dangers. Maltego functions as a protective barrier between the investigator and these threats, providing access to essential information without direct interaction.

INVESTIGATOR NOTE

Maltego provides a layer of anonymity for users accessing data, masking their identity from external data vendors. Typically, data providers can identify users and their searches through their API keys. However, with Maltego Graph (ISO certified), we act as a middleman between the user and the diverse range of data sources. In this way, all queries first go to Maltego servers, which then forward the requests to various API providers. This ensures anonymity, particularly for law enforcement and intelligence agencies, while still offering access to the most relevant data for investigations.

Below is a practical use case demonstrating how Maltego can assist in minimizing potential business risks by proactively responding to any mentions or activity involving your organization. We will provide step-by-step guidance on where to start and how to attribute results. Continue reading!

Access Brokers

Access brokers are individuals or groups that sell access to compromised systems. They often operate on dark web forums, offering Remote Desktop Protocol (RDP) access, VPN credentials, and more.

Starting Point: A keyword relevant to the investigation.
Keywords: “RDP sale,” “VPN access,” “buy accounts,” “admin rights,” “server login,” “network entry.”
Goal: To identify key brokers and their networks for active monitoring of their activities and communication.
Example Scenario: A threat analyst is tasked with preparing reports that include a list of threat actors and forums likely to purchase confidential information from potential insider threats, for active monitoring and insights. Below you can find the typical workflow for this example scenario.
Workflow:
1. Search: Use Maltego to search for posts mentioning any of the keywords mentioned above.
2. Extract Information: Gather details about the threat actors and forums involved in these sales.
3. Extract Identifiers: Look for other identifiers like TOX IDs, email addresses, and phone numbers.
4. Pivot: Use this information to pivot into additional searches, expanding the network of connected organizations.
5. Entity Mapping: Visualize connections between access brokers, buyers, and other related organizations.
6. Pattern Analysis: Analyze communication and transaction patterns to identify key players and networks.
7. Validation and Correlation: Cross-reference the collected data with internal threat intelligence and external sources to ensure accuracy.
8. Reporting and Actionable Insights: Generate detailed reports and provide actionable recommendations based on the findings.

Let’s start our investigation by searching for a keyword related to access brokers. In the following example, a threat actor is selling access to multiple Remote Desktop hosts belonging to a German organization for only $1,000.

Step 1 – Starting off
- Overview: In this initial step, we will search for a keyword to determine the type and quantity of posts available. This will help us visualize the access broker’s entire network and business area.
- Task in Maltego: Add a Phrase Entity to a new Maltego Graph. Enter a relevant keyword like “RDP access.” If you are searching for posts mentioning your organization, include your organization’s name as well. For example, “RDP access maltego.”
Step 2 – Searching for related posts
- Overview: We will try to look for related posts that contain the keyword. We will use the same data source as the previous investigation.
- Task in Maltego: Select the Phrase Entity and run the Transform:
  - Find Posts Related to Phrase [Cybersixgill]
  In this case, Maltego returned several Telegram posts offering infostealer logs. If you are in law enforcement, you would likely appreciate that this provides numerous posts with contact information.

Step 3 – Reporting for mentions

Overview: If your company is mentioned in any of the posts, immediately take steps to secure the affected accounts, notify relevant stakeholders, and investigate the extent of the breach to mitigate further risks.

 **INVESTIGATOR NOTE**

 It's important to remember that cybercriminals often operate in their native languages. Some of the most prolific dark web forums are tailored to Russian-speaking individuals. However, you can still use Maltego to search for posts in other languages, even if you don't speak the language.

Considering that access brokers operate globally and that many dark web forums target Russian-speaking individuals, let’s search for posts where access brokers offer VPN access on the dark web, specifically written in Russian.

Step 1 – Starting off
- Overview: Just like before, let’s add a Phrase Entity into a new graph and enter “VPN access”, but this time we will use the DeepL Transforms to translate the phrase into Russian before moving on to the Darkweb Transforms. You can modify the Phrase Entity to include your organization’s name.
- Task in Maltego: Run the Transform below and put the target language as “RU.”
  - Extract Translation to Phrase [DeepL]
Step 2 – Searching and translating related posts
- Overview: Then, we will try to look for related posts that contain the Russian keyword. And then we will translate the interesting posts back to English to see what they are about.
- Task in Maltego: Run the same Transform as previous steps to look for related posts and use DeepL to translate the selected posts back to English to facilitate the research.
  - Find posts related to phrase [Cybersixgill]
  - Translate [DeepL]

As before, if your company is mentioned in any of the posts, immediately take steps to secure the affected accounts, notify relevant stakeholders, and investigate the extent of the breach to mitigate further risks.

Please note that access brokers are known not only for selling access to compromised hosts but also for offering to buy access from other threat actors and even willing individuals who may work for potential victims (insider threats).

Check Out the Full White Paper for Insights on Dark Web Investigation

By integrating the workflows with Maltego’s capabilities, organizations can conduct thorough dark web investigations, uncover critical insights, and take proactive measures to enhance their security posture. In our white paper, we outline workflows for five additional use cases where you can benefit from utilizing Maltego for dark web investigations:

Insider Threats
Data Breach Detection
Counterfeit Goods and Intellectual Property Theft
Fraud and Scam Detection
Threat Actor Profiling

Early detection is crucial in mitigating exposed assets and data, as well as preventing further information leaks. By enabling quick responses to such threats, organizations can significantly reduce their risk and protect their valuable information. Maltego’s powerful capabilities for dark web investigation play a vital role in this proactive approach, ensuring that threats are identified and addressed promptly to maintain a robust security posture.

Download the white paper to learn what types of dark web investigations you can conduct using Maltego!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Stay connected with us on X and LinkedIn, and subscribe to our email newsletter to get updated with the latest news and developments.

Happy Investigating!

About the Author

Mario Rojas

Everything About Social Media Intelligence (SOCMINT) and Investigations

Tue, 18 Jun 2024 04:14:32 +0000

Social media intelligence (SOCMINT) is considered a subdiscipline of open-source intelligence (OSINT). SOCMINT can be defined as the techniques, technologies, and tools that allow for the collection and analysis of information from social media platforms.

SOCMINT can be harnessed by government or non-state actors, such as private intelligence agencies or marketing companies, to gain knowledge about specific individuals, groups, events, or other targets. While SOCMINT generally falls under the category of OSINT, there are some key differences worth noting.

In this article, we will walk you through everything you need to know about social media intelligence and the best practices for conducting social media investigations. For a more extensive version with practical workflows, you can download the handbook below!

DOWNLOAD HANDBOOK

Table of Content

SOCMINT vs. OSINT

SOCMINT is not as straightforward as OSINT because there is a belief, particularly by users and privacy advocates, that there is some expectation of privacy when using a social media platform. While OSINT investigators may not agree with this expectation, there is another aspect of SOCMINT worth considering.

OSINT investigations focus solely on publicly available information while SOCMINT investigations also use information found on social media platforms that was intended only for a specific audience. For instance, an investigator might join a private group or create a fake account to gain access to information provided by a person of interest. These situations make SOCMINT more difficult to navigate for investigators, and every effort should be made to comply with laws, regulations, and policies around intelligence gathering and investigations.

In these investigations, government investigators will likely go through the court system to request subpoenas or warrants to obtain information directly from the social media platform. Often, some SOCMINT techniques will have already been employed to gather the data used to support the issuance of those subpoenas or warrants.

SOCMINT Concepts and Terms

There are many nuances in the field of SOCMINT, including the type of information that can be gathered and the type of platforms that can be used to gain information.

First, it is important to understand that SOCMINT includes all social media platforms, not only social networking sites. Social networking sites, like Facebook and LinkedIn, only make up one portion of the platforms that can be used to gather data. Information can be found on media-sharing sites like Instagram, forums like Reddit, image-sharing sites like Pinterest, video-sharing sites like YouTube, microblogging platforms like Twitter, social gaming platforms like Xbox Live, and blogs created using platforms like WordPress.

Next, it is important to know the types of information that can be gathered from social media platforms. We can break this information down into three general categories:

Profile Information: Static information provided about a specific user that is observable by those who access the profile. On LinkedIn, for instance, this might include a user’s job title, current and former employers, skills, and contact information.
Interactions: Users on a social media platform can interact with the platform or other users in many ways. These forms of interaction include posting/commenting, replying to someone else’s content, posting pictures or videos, and liking or reacting to existing content.
Metadata: Information found on social media platforms is not limited to text and pictures. It can also include contextual information about said pieces of content. Metadata can include the location tagged in a post, the time that the post was made, or even the type of device used to take a picture.

Uses for SOCMINT

SOCMINT is commonly associated with investigations of a group or individual involved in criminal activity, but that isn’t the only scenario where it can be useful. Other types of investigations where SOCMINT could be employed include:

Terrorism
Organized Crime
Human Trafficking
Child Sexual Exploitation
Disaster Prediction and Response
Population Density
Economic Analysis
Health and Disease Monitoring
Drug Use and Trends
Cybercrime

While this is not an exhaustive list, it is meant to demonstrate that SOCMINT has many uses outside of those common to law enforcement. While state actors are prolific users of SOCMINT, private companies and organizations also use SOCMINT to collect information to better inform business decisions, improve marketing, ensure brand protection, and identify patterns and trends.

DOWNLOAD HANDBOOK

SOCMINT Challenges

Though there is a wealth of information available through social media platforms, that does not mean that the use of SOCMINT is easy or simple. There are several challenges that face investigators who employ it.

Number of Users: Social media platforms like Facebook and Twitter boast billions of users each month. With the sheer amount of data available, it can be difficult to find the information relevant to a particular investigation.
Identification of Users: Many platforms operate with the intention of keeping their users’ identities private, creating challenges for investigators. Additionally, the increased prevalence of fake accounts and bots on these platforms can make it extremely hard to figure out which data is accurate, available, and useful.
Compromising Trust: There has been an abundance of stories over the last few years about data leaks and user information being compromised, which can cause users to think twice before sharing information online. Additionally, as governments continue to employ SOCMINT techniques, they risk violating the privacy of their citizens, creating an unstable relationship between authorities and the people they serve and protect.

SixDegrees.com launched in 1997. It is often described as the first social media where users would have their real name, a list of friends, and personal information displayed on their profile. At its peak, it boasted more than 3.5 million users. Since then, other websites and apps have replaced it, and it’s estimated that billions of people use social media nowadays. This means that for any given investigation, it is likely that some data or clues can be harvested from social media.

What you can find on social media depends vastly on the individual or entity you’re looking into, and on the platform itself. Some, like LinkedIn, have by design a userbase wanting to be found and desiring to use their profile to display their professional experience.

Others, like Twitter, have profiles that may be less informative but may provide more context in the contents of the posts made by an account. While the information on LinkedIn tends to be more curated because it’s geared towards a professional environment, not everyone expects other people to pay attention to their tweets.

How Can You Find a Profile To Investigate?

The first thing to do when investigating someone on social media is to find the account that belongs to that person. This can be done in several different ways, but we can identify at least six pivot points that will help us find social media accounts belonging to an individual:

Name: The name of a person is a good starting point as it will often return a Facebook, Myspace or LinkedIn account. However, it is also the first personal identifier people will avoid using or disclosing if they do not want to be found.
Email address and phone number: These are great starting points because they’re usually only shared between accounts, and thus, individuals, that are somehow connected. If two accounts on different platforms share the same phone number or email address, it indicates a connection. The problem with these data points is that they usually aren’t easily searchable (Skype is a notable exception) and are not displayed on the profile of a person of interest.
Alias: Also known as username or the pseudonym, alias is often reused across different social media platforms. The advantage of this data is that it is extremely easy to search: Any social media platform that has usernames allows you to search for and connect with users with a particular alias, as it is often a core concept of the platform. The main issue with this is that aliases are only as good as they are unique: One can assume that two accounts on different platform sharing a rather specific username such as “LittleTroll15245” are likely to be operated by the same person. But even then, one would need to investigate further to corroborate the link. If the account has a more generic username like “BlueDragon,” finding an account on another platform belonging to the same individual solely based on the alias might prove difficult.
Profile pictures: Profile pictures fall into the same kind of category as aliases, which means that with luck, doing a reverse image search from a picture found on a profile might just lead you to an account operated by the same person. However, it can also be that two different people thought that a particular image would look good on their profiles. Searching for accounts by a picture is also much more difficult because you rely on reverse image search engines, which is usually not a feature supported by social media platforms. The only advantage of profile pictures is that not everyone is aware that they can be used as a pivot point. Thus, they tend to reuse them more often than aliases.
Address and bio: Addresses and bio might be the most difficult pivots to exploit. Seldom will an individual reveal their physical address on social media. Platforms that scrape online information such as Pipl are more likely to yield relevant results from that kind of information. On the other hand, bio should always be scrutinized as some individuals link their social media accounts using their bio.

What Can Be Automated and What Do You Need To Verify?

There are two types of information that can be found on social media:

Information that the user wants to share
Information that the user forgot to hide—for a lack of concern for their privacy or because they didn’t notice

The main difference between the two, from our point of view, is that the first type of information can be automated and thus obtained pretty easily: Jump into Maltego Graph to pull the list of friends of both profiles. The friends in common will appear before your eyes.

The second type of information, however, will often require an investigator to pay close attention to the sometimes-extensive content displayed on a social media profile. This content analysis can be simplified and accelerated in Maltego Evidence, which automatically collects social media data from multiple platforms in a standardized way.

Maltego Evidence (formerly Social Network Harvester), included in the Maltego Organization plan, enables investigators to scrape, analyze, and cross-reference text, images, videos, and other forms of interaction between multiple social media profiles.

The Maltego Organization plan also gives you access to Maltego Monitor (formerly PublicSonar), which allows analysts to perform real-time social media monitoring and AI-powered sentiment analysis of potential and ongoing public safety disruptions across multiple platforms.

DOWNLOAD HANDBOOK

Are You Investigating the Right Profile?

The first thing you should do when conducting a social media investigation is to make sure you have the right profile. There are some platforms where, using your real name, displaying information about yourself, and having an actual photo of your face as a profile picture is the norm (e.g., LinkedIn). In this scenario, it is pretty easy to cross-reference data at hand and identify the profile related to a person of interest. This type of profile is the one you will obtain when starting your search from a name.

However, starting your search from an alias might yield other kinds of profiles where there is less information available for you to establish the difference between an account that coincidentally happens to have the same alias used by the person of interest, and an account that belongs to said person of interest.

To properly draw conclusions, you can first check information such as the location or the other social media they link in their bio (if any). If there is no such information, looking at their posts and account followings might help.

Are they posting about a particular topic that you know is connected to your person of interest?
Are they following an account tied to a particular location like a local police department or a small town mayor?

To verify these things, you can pull the list of posts and followed accounts into your Maltego Graph, or visualize and show this in one of the interfaces in Maltego Evidence.

How Can You Access the Information on a Profile?

Maltego will provide you with Transforms to pull most of the data available on a profile directly into your graph. This will save you a great deal of time as you won’t have to comb through the profile yourself which, depending on the platform, might require you to have an active account.

It should be noted that an investigator should never use a personal account to collect information. A sock puppet account reserved for research purposes should be created to do so. Be aware that some platforms tell their user when someone has seen their profile, as is the case of LinkedIn.

Download Handbook

In this handbook, we will show you 6 standard investigative workflows using the Maltego Graph and SOCMINT, pivoting from the following starting points:

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

We hope this handbook will help you collect relevant social media intelligence and find online traces of your person of interest in Maltego.

For more insights, check out our other resources: 

Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

How Law Enforcement Can Leverage Internal Data and OSINT to Gain Insights

Mon, 17 Jun 2024 10:32:57 +0000

Law enforcement agencies (LEAs) have a wealth of data at their disposal, but often struggle to use it effectively. This data, if properly accessed and analyzed, can help LEAs to make better investigative decisions, solve cases faster, and improve overall operations. Unfortunately, data is usually scattered across different sources and lacks a unified structure, making it difficult to piece together the full picture.

For instance, a police department might maintain separate databases for passwords, hashes, profiles, or seized databases coming from different operations. The absence of integration among these sources and the different technologies used to store them makes investigations challenging.

This whitepaper explores how law enforcement can overcome these challenges to support their criminal investigations. We’ll discuss the role of competency questions, explain how defining an ontology can make operations more effective and data-driven, discuss two approaches to storing and accessing internal data, and show how this can be done using Maltego.

DOWNLOAD WHITEPAPER

By following our guidelines, cyber investigation teams will be able to not only enhance data quality and accessibility but also support comprehensive and accurate business intelligence and analytics, driving better decision-making and strategic planning.

Table of Content

Identify Data Sources Used in Criminal Investigations

What data does your team use and need for criminal investigations? What technology was used to build the databases? Where are they stored, and in what format? How can they be queried effectively? Finding answers to these questions and understanding what information your data can offer (or lacks) is fundamental for making better-informed decisions in real time.

These data sources can be anything that includes pieces of information that may help identify a person, establish a timeline, or uncover connections. They can range from logs coming from incident reports and communication records when available. Depending on the focus of a given team, the specific data needs will differ.

INVESTIGATOR EXAMPLE

Imagine the work of a cybercrime unit tracking an online fraud scheme. They would need to analyze data from financial transaction records, emails, IP addresses, and social media interactions.

By having a clear understanding of where this data is stored and how to retrieve it swiftly, the unit can trace the digital footprints of the perpetrators, connect the dots between different data points, and uncover the network behind the fraud.

Understand Questions Your Data Should Answer

Knowing your data sources and their contents is one thing, but figuring out how to leverage them for a specific project or investigation is the next challenge.

Let’s imagine the following scenario:

Case Study

Your team works under an international law enforcement body. It is tasked with investigating a series of financial frauds linked to a major crime syndicate.

The investigation team will need to use several different datasets from different financial institutions, internet service providers (ISPs), and social media platforms.

The data includes transaction records, account details, and communication logs, originating from various sources built using diverse technologies, where each dataset follows its own format.

Your Goal: Analyze and model the data to identify patterns and connections that can lead to the crime syndicate’s key operatives.

Role of Competency Questions

Before jumping straight into querying the different datasets, the first step is to ask and answer a set of competency questions. These questions help LEAs define what they want to learn from the data and what kind of information they need to find. For example:

What specific fraudulent activities are you looking to identify?
Are there particular transaction patterns indicating suspicious behavior?
What connections between accounts and individuals are you trying to uncover?

Setting these questions upfront brings better focus to your data analysis, making your insights directly applicable to the investigation. This approach helps avoid aimless data sifting and ensures your efforts align with the investigation’s goals.

Finally, by understanding the needs, investigative teams can avoid focusing on unnecessary or irrelevant data points and stay on the right track instead of going down the rabbit hole without a clear strategic goal.

Download This Whitepaper

The insights shared in this article are just the beginning steps to help your team understand the potential questions your data can answer. However, the challenge of using that data effectively and at scale, without missing any vital information, still remains.

This whitepaper aims to guide you through this process by defining common ontologies to ensure consistent terminology, introducing two effective data analysis strategies, and explaining how to standardize and centralize your data warehouse. Finally, it provides a comprehensive guide on leveraging Maltego to gain insights from both internal and OSINT data sources.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

We hope this whitepaper will help you make better decisions about the use of internal data and OSINT within your unit or team of investigators.

Your Next Steps

For more insights like this, you can check out our other resources:

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Sergio Leal Rodriguez

Maltego Academy: Learn How to Be a Top Investigator

Mon, 17 Jun 2024 08:49:43 +0000

As Maltego officially introduced the Maltego platform to equip our users and customers with more powerful investigative capabilities and data, we continue to be dedicated to empowering every investigator to master our platform and upskill on investigative knowledge. We are very excited to launch Maltego Academy in May 2024, the online learning platform for Maltego which over 3,000 investigators worldwide have already been learning from.

NEW TO MALTEGO ACADEMY? START NOW

Introducing Maltego Academy

Maltego Academy is your one destination for all training resources for Maltego. Using a mixture of on-demand and live learning formats, Maltego Academy prepares our users to become experts at conducting digital investigations with Maltego.

The learning resources focus on showing you effective investigation techniques that help establish relevance from complex data connections and bring critical OSINT investigations to actionable results. They are designed for investigators who are just getting started in their career and experienced analysts looking to advance their skills.

How Does Maltego Academy Compare with Spark Learning?

If you are an existing Maltego user or customer, you might have heard of or used Spark Learning, Maltego’s previous learning platform.

While offering similar learning formats and resources included in Spark Learning, Maltego Academy has redesigned its on-demand learning options to better guide users through the journey of mastering a subject matter. Maltego Academy also offers more regular and interactive live training sessions that bring like-minded investigators together.

On-demand Learning Paths Designed for All Investigators

Learning paths are the core of on-demand learning in Maltego Academy.

A learning path is a collection of modules tied together for learners to naturally progress through their understanding and skills around a particular subject.

In Maltego Academy, we design learning paths based on use cases. Each learning path contains multiple modules. Completing all modules should equip you with the know-how and confidence to use Maltego for these types of use cases and investigations.

Your browser does not support the video tag.

Maltego for Cybercrime Investigations Learning Path

Upon the launch of Maltego Academy, we released the Maltego for Cybercrime Investigations learning path. This learning path is for investigators conducting investigations related to cybercrime, fraud, due diligence, harassment, disinformation, extremism, and other similar use cases.

The learning path takes you through modules covering how to investigate email addresses, a person’s name, phone numbers, and usernames using Maltego and relevant data integrations. Completing the learning path will earn you a Maltego for Cybercrime certificate!

START NOW

Maltego for Cybersecurity Investigations Learning Path

Coming soon later this year is the Maltego for Cybersecurity Investigations learning path! This learning path is tailored to analysts involved in cybersecurity, cyber threat intelligence, penetration testing, threat hunting, incident response, or other similar investigations.

The learning path includes modules about investigating websites, IP addresses, malware hashes, and more using Maltego and common cybersecurity data sources. You will also earn a Maltego for Cybersecurity certificate once you complete the learning path!

Live Learning to Bring Together Investigators Worldwide

Maltego Academy live learning offers virtual, instructor-led training sessions in group settings. As a participant of the live training sessions, you can watch live demonstrations, participate in hands-on activities, ask questions to your Maltego Subject Matter Expert, and exchange knowledge with other participants in the session.

We now offer weekly sessions covering various topics such as social media investigations, cyber threat intelligence, dark web and online scam, specific features you should know about in Maltego, and more.

CHECK OUT LIVE SESSIONS HERE

Custom Training Tailored to Your Teams

Only available to Maltego Organization plan customers, Maltego Custom Training enables your team to start using Maltego in their daily work as quickly as possible.

Our team of training experts works with you to fully understand your teams’ investigative processes and goals. We then tailor our training sessions to deliver exactly what your team needs to hit the ground running with Maltego. Maltego Organization plan customers who are interested in Maltego Custom Training can reach out to their Customer Success Managers to start the conversation.

Start Learning to Be a Top Investigator

Getting started with Maltego Academy is easy. If you are a Maltego user or customer, simply sign up for an account on the Maltego Academy website, enter your Maltego license key, and you will be able to start learning!

If you are an existing Spark Learning user, simply log in with your existing login credentials! Your account and access information has been transferred and stored safely in Maltego Academy.

START NOW

Start learning to be a top investigator like others today. Happy investigating!

Incident Readiness with Maltego

Wed, 12 Jun 2024 06:25:32 +0000

In today’s rapidly evolving cyber landscape, security operations must stay ahead of increasingly sophisticated threats and manage vast amounts of data from diverse sources. Relying solely on a single tool or manual process is no longer sufficient. So, what should you consider when choosing a threat intelligence integration and analysis platform?

In this blog, we will highlight Maltego’s strategic approach to empowering cyber threat intelligence (CTI) teams, showcasing our holistic platform and benefits. Let’s first dive into what are the key trends shaping the field of CTI and the challenges that CTI professionals go through.

Future of the CTI Landscape
Challenges in CTI Investigations
Essential Capabilities of a Holistic Data Integration and Analysis Platform for CTI Teams
- Maltego Graph
- Maltego Data
- Maltego Academy and Services
- Maltego Cases and Admin
Benefits of a Holistic Data Integration and Analysis Platform for CTI Teams
Achieving Incident Readiness with Maltego

Future of the CTI Landscape

In a world where significant advancements in technologies like artificial intelligence and machine learning dominate our everyday lives, it is evident that they will shape the landscape and future of cyber threat intelligence (CTI) over the next decade. These technologies will enable sophisticated, real-time threat detection, allowing organizations to predict and mitigate cyber threats before they materialize. However, they also pose new challenges, such as the cybersecurity workload created by the vast amounts of information generated by both humans and machines and high-level social engineering cyber-attacks that leverage these advanced technologies.

Although we recognize the importance and value of advanced technologies, especially as they pertain to the future for all practitioners in the CTI space, how can you facilitate more robust defense strategies and improve overall cybersecurity resilience at this time? There is a growing need to manage the full lifecycle of threat intelligence within a single platform. Such a platform should seamlessly integrate vast amounts of data from diverse sources, providing comprehensive insights into the threat landscape and threat actors’ behaviors. Additionally, as cyber threats become more complex, real-time collaboration and information sharing among organizations, industries, and governments globally will become essential. By efficiently working with data, organizations can enhance their defense mechanisms and stay ahead of evolving threats.

Challenges in CTI investigations

Despite the clear benefits technological advancements offer, they will simultaneously intensify the challenges in CTI investigations. Let’s explore several of the current challenges in CTI investigations.

CTI investigations encounter numerous challenges. Given the vast amount of data produced by various networks, devices, and sources, analysts require a platform to consolidate and visualize their data in an easily consumable manner. Threat analysts are forced to juggle several tools and platforms, each with myriad data sources, to cross-reference results. This process is further impeded by differences in pricing, plans, and licenses. All these aspects complicate and disconnect their workflows, making it difficult to efficiently sift through information and identify meaningful connections, regardless of their level of training. This slowdown is particularly critical in SOC operations, where time is of the essence.

Furthermore, as threat actors continuously develop new tactics, techniques, and procedures (TTPs), it becomes challenging for analysts to accurately attribute cyber-attacks to specific actors or groups. They need to acquire or purchase the most relevant tools and data for each effective investigation.

Additionally, resource constraints, including the need for skilled personnel, advanced tools, and continuous monitoring, can limit the ability of threat intelligence teams to conduct thorough CTI investigations. Integrating data from various sources seamlessly and ensuring the sharing of intelligence across different organizations and platforms is complex. Legal and ethical considerations, such as privacy laws and regulations, must be also navigated carefully to ensure compliance while gathering and using intelligence.

Finally, there is a persistent skill gap, with a shortage of cybersecurity professionals specializing in CTI. This makes it difficult for organizations to train and retain talent in this specialized field, not to mention fully leveraging each acquired tool to address new and specific challenges.

Essential Capabilities of a Holistic Data Integration and Analysis Platform for CTI Teams

Maltego constantly evolves to enhance product capabilities with a user-centric approach. As introduced in our product roadmap, we truly focus on an intuitive, but holistic way for CTI professionals to centralize intelligence and manage data-led workflows in a single platform. Dive deeper into what Maltego has to offer for CTI teams.

Maltego Graph

Maltego Graph enables analysts to visualize and comprehend key information and connections in large and complex datasets via a straightforward user interface. Additionally, Maltego Graph can significantly cut down the time spent on investigations—from hours to minutes—by automating manual and repetitive tasks with Maltego Machines.

Maltego Data

The entire platform is powered by Maltego’s unique data, offering you access to all the data you need. It integrates over 120 different data providers and more than 12,000 search methods into CTI investigations, including data sources and tools like OpenCTI, Anomali, Splunk, and more. Our focus has been on streamlining workflow integrations, enabling you to centralize all relevant data from SIEM, TIPs, SOAR, OSINT, and internal databases into Maltego’s standardized data ontology.

Maltego Academy and Services

World-class experts offer both pre-recorded and custom live training sessions tailored to teams of any skill level, ensuring they make the most of Maltego. Additionally, custom support and engineering projects are available to guarantee a successful and personalized setup of the Maltego platform.

Maltego Cases and Admin

The team can store and collect all investigations in a single location and cross-correlate all data in a unified format to enhance collaboration. With administrative controls, the manager can audit and centralize your organization’s Maltego usage, billing, and access authorization, eliminating the need to manage these aspects separately for each tool.

Benefits of a Holistic Data Integration & Analysis Platform for CTI Teams

These essential capabilities translate into three main benefits:

Supercharge your Analysts

Empower your analysts with real-time intelligence and seamless internal and external data integration to enhance their efficiency and precision. By helping them bring up-to-the-minute threat data in one interface and ensuring smooth data integration across various sources, you enable them to perform their tasks more swiftly and accurately. This empowerment not only improves their effectiveness but also boosts their confidence and decision-making process, leading to a more robust security posture for your organization.

Identify Threats Faster

Achieve incident readiness and respond to incidents with unprecedented speed. By leveraging advanced threat detection and real-time intelligence with Maltego, your organization can rapidly identify potential threats and vulnerabilities. For example, Maltego allows you to directly take indicators from third-party sources and link them to your internal environment. This process helps identify previously undetected incidents, enabling swift incident response and minimizing the impact of security breaches. In doing so, you can ensure your systems and data remain secure. With faster threat identification, you can stay ahead of cyber adversaries and protect your assets more effectively!

Increase Return on Investment

Save time and money with an unparalleled intelligence analysis experience. By optimizing your CTI processes and tools, you can reduce the time spent on manual data analysis and streamline your threat detection workflows. This efficiency translates to significant cost savings, as your team can focus on high-priority tasks and strategic initiatives. Additionally, preventing business interruptions and potential financial setbacks caused by cyber incidents further reduces overall costs, ensuring your organization remains resilient and profitable in the face of evolving cyber threats.

Achieving Incident Readiness with Maltego

It all sounds promising, but you might wonder how to achieve these benefits. Below, you’ll see how your organization can proactively prepare for and respond to cyber threats by leveraging the power of threat intelligence. You’ll find resources to help you explore the full capabilities of Maltego, perfectly suited for a corporate environment.

Identifying Exposure

Maltego enables teams to identify the exposure of digital assets or individuals who could be targeted through surface threat assessments and analysis of personal footprints. This enables organizations to understand and mitigate potential vulnerabilities before they are exploited. For example, your team can learn how to use Maltego for attack surface assessments here, or check out the playbook for vulnerability and attack surface assessment in use case 3 of this handbook.

Collecting and Disseminating Threat Intelligence

Maltego allows users to collect threat intelligence on potential threat actors from various data providers and disseminate this information to detection engineering and hunting teams. This process facilitates better detection and aids in the early identification of attempts or the early stages of attacks, enhancing the ability to preemptively counter threats. For example, you can refer to this white paper on cyber threat profiling of the known threat actor “Scattered Spider,” which introduces various methods for collecting and analyzing IoCs using Maltego.

Investigating Insider Threats

With Maltego, organizations can effectively investigate insider threats that may pose risks to the company. You can uncover and analyze behavioral patterns that indicate malicious activities within the organization, allowing timely interventions. By harnessing Maltego’s dark web integrations, the organization can proactively search for mentions of the company or sensitive data on hidden forums and marketplaces. For example, you can check out a step-by-step playbook for investigating insider threats here, which allows your team to replicate the same process.

Additionally, all investigations conducted on Maltego platforms are guided by three key principles. Maltego ensures the security of investigators’ identities and the data acquired, maintains compliant and transparent data collection and storage, and finally provides expert support for tool training, deployment, and individual setup tailored for your organization.

In conclusion, the rapidly evolving landscape and challenges of CTI demand innovative and comprehensive solutions. Our discussion has underscored the necessity of an all-in-one platform to effectively address these issues and showcased how Maltego’s strategic approach and product capabilities can empower CTI teams to meet the emerging demands of advanced investigations.

We hope this overview has provided a clear understanding of how Maltego enables your team to centralize data access, visualize vast amounts of information, and interpret it to uncover hidden truths. As a result, your team can respond to threats faster and reduce risks effectively. Having a holistic threat intelligence integration and analysis platform is invaluable and essential for successful CTI operations. Stay ahead of the curve with Maltego and ensure your organization is equipped to tackle the ever-changing threat landscape with confidence.

Stay connected with us on X and LinkedIn, and subscribe to our email newsletter to get updated with the latest news and developments.

Enjoy exploring all our resources!

Unmasking a Darkweb Persona: scaryred24

Wed, 05 Jun 2024 07:26:58 +0000

Uncovering Information on a Dark Web Gun Seller

Dread can be considered the Reddit of the Dark Web and, just like Reddit, it is subdivided into different sub forums known as subdreads. The subdread named [/d/murderhomelesspeople] is the sub forum where drug dealers (or people pretending to be one) discuss their different experiences.

In this whitepaper, we will investigate the persona of “scaryred24,” an individual who offered a gun for sale in a thread posted to this subdread.

DOWNLOAD WHITEPAPER

Chancing Upon Scaryred24

The image below shows the Dread post found on the onion site Dread[^1]. The post, made by the user “okbuddydread” around October 2021, notes that they want to take revenge against their drug dealer who allegedly owes them money.

Amongst the 20 comments added to this post, we found one comment by the user scaryred24, who offers to sell a gun to “okbuddydread.”

At this stage, it is already possible to gather significant information from these posts. To begin with, the username “scaryred24” seems quite unique. And, given that scaryred24 offers to sell a “piece” (firearm) to the poster if they are in or around the Boston area, it can be assumed that they are located somewhere within that area. Lastly, “scaryred24” has also provided a phone number on which they can be contacted via WhatsApp or text.

This information already provides a good start to an investigation. The different pieces can be used as starting points to see what kind of information we could gather to unmask the person hiding behind the user “scaryred24.”

Download Whitepaper

Access the whitepaper below to get a full overview of the investigation, the steps you can replicate in Maltego, and other investigator tips for person of interest investigations.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

We hope this whitepaper will help you collect relevant intelligence and find online traces of your darkweb persona in Maltego.

For more investigations like this, you can check out our other resources: 

Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Mathieu Gaucheler Mathieu Gaucheler is a Subject Matter Expert at Maltego. His responsibilities include research-driven content development for blog posts, webinars, and talks. He started working in cybersecurity in Barcelona, focusing on malware analysis and sandbox development. He has previously presented his research at BotConf and RSA APJ.

Introducing Maltego Professional and Organization Plans

Tue, 04 Jun 2024 09:20:15 +0000

Since 2008, Maltego has become the go-to platform for making sense of massive datasets in cyber threat intelligence and cybercrime investigations. As the investigative landscape evolves to become more complex and demanding, Maltego has also grown beyond the well-known link analysis tool to an all-in-one platform that covers the full investigation cycle.

In May 2024, we officially introduced the Maltego Professional and Organization plans to provide existing and new users with even more investigative capabilities, data, and services.

The Maltego Platform

The transition from a single link analysis tool to an all-in-one platform directly represents Maltego’s dedication to continuously empowering the work of investigators worldwide.

In the last years, we not only finetuned Maltego’s link analysis interface and expanded Maltego’s data offerings, but also invested resources in exploring and implementing solutions that support further aspects of the investigation: The non-technical users, the admins managing deployments, the teams who rely on file-sharing for collaboration, the monitoring of data, and the collection and storage of evidence.

Power Preliminary and Advanced Investigations for Specialized Cases

For years, the Maltego Graph (also known as the Maltego Desktop Client) has been the trusted tool to conduct complex and large-scale OSINT investigations and flexibly integrate them with their own tools via API. In the fall of 2023, we released Maltego Search (formerly OSINT Profiler), a browser-based investigation tool, to enable non-technical users to conduct quick and automated, preliminary OSINT searches across devices.

Ensure Smooth Collaboration and Administrative Excellence

Now available through our Beta program, Maltego Cases allows users to store and collect all investigations in one place and cross-correlate all data in one format. We also provide administrative capabilities to audit and analyze an organization’s Maltego usage, billing, and access authorization.

With the newest capabilities that Maltego acquired in April 2024, Maltego Monitor (formerly PublicSonar) and Maltego Evidence (formerly Social Network Harvest), the Maltego platform will now also provide monitoring and court-ready evidence securing capabilities to further support the investigation process.

Mine, Merge, and Map All Essential Intelligence in One Place

The Maltego Data Hub (formerly known as the Transform Hub) has always been and will continue to serve as your central access point to the most essential and relevant data for your use cases. Through its Connectors, the Maltego Data Hub provides unmatched access to paid external, internal and OSINT data from more than 120 data providers, and for a wide range of use cases including social media, persons of interest, the dark web, cryptocurrency, and cyber threat intelligence. We will continue to improve our capabilities in this area by adding more valuable Connectors to the Hub.

With the launch of our new plans, we now also offer Maltego Data (formerly Maltego Data Pass), a form of credit-based out-of-the-box access to paid external data already included in your plan. Currently, over 20 data partners are part of Maltego Data and this number is continuously growing. The credits included in your license are designed to allow deep complex investigations for your use case.

Maltego Plans for Small and Large Teams of Investigators

The Maltego platform is a scalable technology built to remove blind spots and increase efficiency in the OSINT and cyber investigation space. The Maltego platform will be able to replace manual work with automated monitoring, utilize software-aided investigations, and secure online evidence, all within one interface.

We wanted to make the Maltego platform available for both small and large teams of investigators, and we wanted to do it in a way that simplifies the purchasing hurdle for our users. The newly launched Maltego Professional and Organization plans allow our new users and customers to access all the core platform capabilities and essential data integrations with just one subscription.

Maltego Professional Plan

Designed for individual investigators and small teams, the Maltego Professional plan includes everything you need to conduct preliminary OSINT searches, complex data link analysis, and collaborate in the cloud. It also comes with out-of-the-box access to household cyber threat intelligence feeds, common OSINT data sources, and a growing range of commercial data providers for a variety of use cases.

The Maltego Professional plan is available for purchase directly from the Maltego webshop. Learn more about what’s included in the Maltego Professional plan here.

Maltego Organization Plan

Best for large teams and government organizations, the Maltego Organization plan includes everything in the Maltego Professional plan and more.

With the Maltego Organization plan, both cyber threat intelligence teams and law enforcement agencies have even more out-of-the-box access to data providers and data sources. Customers will also have access to Maltego Monitor (formerly PublicSonar) and Maltego Evidence (formerly Social Network Harvester) to enhance their operations and utilize OSINT in every scenario – from criminal profiling to public safety monitoring and court evidence reporting.

Finally, the Maltego Organization plan enables access to Maltego Admin, which streamlines and centralizes crucial admin management behind large-team deployments like billing, user authentication, and more.

Interested in learning more about the Maltego Organization plan? Check out the Maltego Organization plan here.

Continuous Enterprise-Grade Support & Services

Finally, to empower investigators to use the technology skillfully and truly reap the benefits, the Maltego Professional and Organization plans offer learning opportunities on Maltego Academy with world-class experts delivering on-demand and live training sessions for teams. To ensure the successful and tailored setup of the Maltego platform, there are custom support services and engineering projects to guide your team through the technology adoption.

Coming Soon for the Maltego Community

This fall, we are also looking forward to launching a free plan for independent researchers, community users, and individual investigators. Different from the current Maltego Community Edition, the free plan is available for commercial usage and will include more investigative capabilities of the Maltego platform. Stay tuned!

Find the Right Maltego Plan for You and Your Team

Visit our pricing page to get started. If you have any questions, please read our FAQs, reach out through our Support Portal, or contact your Maltego partner. We will gladly help you pick the right plan for you and your organization.

If you are an existing Maltego user and not yet subscribed to the Professional or Organization plan, please reach out to us to learn how you can upgrade.

Happy investigating!

How Law Enforcement Can Adapt to the Ever-Changing OSINT Landscape

Wed, 29 May 2024 04:54:47 +0000

In the past decades, law enforcement has experienced fundamental evolutions in how crimes are committed and investigated due to the expansion of the digital world. In the next decade, the open-source intelligence (OSINT) landscape is expected to undergo another even more extensive shift.

Misinformation, disinformation, AI-generated content, and the sheer amount of fragmented digital evidence will only add complexity to criminal investigations. And the challenge is compounded by the various formats of data uploaded to the internet, including AI-generated content.

The status quo is that OSINT data has become too extensive and complex to be analyzed solely by humans, so simply hiring more people won’t be a sustainable solution in the long run. If law enforcement wants to bring criminals to justice, backed by reliable and accurate intelligence, they need to rethink their use of technology to make it future-proof and scalable.

What could help them adapt to these challenges is an all-in-one ecosystem of tools and data. This ecosystem would provide seamless access to data for both quick searches and complex investigations, regardless of the data’s volume or fragmentation.

It would need to enable law enforcement analysts to quickly find actionable insights in the vast sea of OSINT and internal data. Additionally, it should help them solve crimes with reliable, court-ready evidence.

In this whitepaper, we provide an overview of how criminal investigations and the use of OSINT have evolved in recent decades and what technology can truly help law enforcement navigate the next-generation OSINT landscape.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

We hope this whitepaper will help you make better decisions about the use of OSINT technology within your unit or team of investigators.

For more insights like this, you can check out our other resources:

Don’t miss out on new updates by following us on Twitter, LinkedIn, and Mastodon, or signing up for our email newsletter.

Dissecting Scattered Spider with Maltego

Tue, 21 May 2024 14:50:07 +0000

Profiling requires conducting in-depth research on a threat actor ranging from the strategic, tactical, and operational levels. And multiple angles need to be covered. In this article, we delve into the intricate process of profiling the threat actor known as “Scattered Spider,” illustrating various techniques for data collection and analysis using Maltego

Who is Scattered Spider?

Scattered Spider is a threat actor group that has been widely known because of their consistency and creativity. They can be identified by multiple names established by the different industry players who analyzed them. Those aliases include Tarfraud, UNC3944, Scattered Swine, Storm-0875, LUCR-3, Octo Tempest, Roasted Oktapus, and Muddle Libra.

They have attacked hundreds of organizations worldwide since 2022, getting attention from the industry and other vendors such as CrowdStrike, Mandiant, Palo Alto Unit42, Trellix, SilentPush, and Group-IB. Their activities have even been featured on the CBS “60 Minutes” program.

Source: Infographic by CrowdStrike on victimology, shared via Adam Cyber on Twitter

Scattered Spider employs a variety of social engineering techniques, such as SMS phishing and impersonation in help desk calls. They also abuse compromised credentials to establish a foothold in their victims. This foothold is preserved and escalated through the use of living off the land (LOTL) techniques and legitimate remote access software. Additionally, they have a special predilection for abusing privileged cloud environment resources.

Source: Infographic by Mandiant on Threat Actor TTPs

Source: Infographic by Unit42 Palo Alto Network on Fig Threat Actor TTPs

Three Popular Cyber Attacks Orchestrated by Scattered Spider

The Scattered Spider group has conducted at least 3 remarkable campaigns so far:

Oktapus / March-July 2022: This campaign targeted employees of U.S.-based companies that use services from IAM leader Okta. The attackers created over a hundred unique domains that mimic these organizations, incorporating keywords such as “sso,” “vpn,” “okta,” “mfa,” and “help.”
C0027 / June-December 2022: This campaign focused on targeting mobile carriers, aiming to facilitate SIM-swapping attacks against victims.
Mid-2022-January 2023: This period saw the group targeting large outsourcing firms that serve high-value cryptocurrency institutions and individuals.

It’s important to note that in mid-2023, as reported by Unit42 from Palo Alto Networks, Scattered Spider began shifting their tactics to deploy ransomware in victim environments. This marks a significant change in the group’s monetization strategies, indicating an evolution in their behavioral patterns.

Scattered spider has effectively targeted victims using breached or stolen data, and they repeatedly return to the well to update their stolen dataset. Even after initial incident responses, they use this data to re-target previous victims. This group has consistently demonstrated a profound understanding of modern incident response processes, enabling them to persistently advance toward their goals and maintain access to victim networks, despite efforts by responders to remove them.

Early this year, the industry was surprised by the arrest of an individual named Michael Urban who uses the aliases “Sosa” and “King Bob” on alleged charges of SIM-swapping activities over different victims. As the cybercrime journalist, Brian Krebs, states, he was a top member of the broader cybercriminal community online known as “The Com,” wherein hackers boast loudly about high-profile exploits and hacks that almost invariably begin with social engineering — tricking people over the phone, email or SMS into giving away credentials that allow remote access to corporate internal networks. Sosa was also active in a particularly destructive group of accomplished criminal SIM swappers known as “Star Fraud.” Cyberscoop’s  AJ Vicens reported last year that individuals within Star Fraud were likely involved in the high-profile Caesars Entertainment and MGM Resorts extortion attacks.

Based on the reports and similar TTPs he employed, it is reasonable to assume that Mr. Urban might have close ties to the activities of the Scattered Spider group.

Source: A booking photo of Noah Michael Urban released by the Volusia County Sheriff(left) and Graphic by Amitai Cohen of Wiz used in krebsonsecurity article(right), depicting how Oktapus leveraged one victim to attack another.

Download the White Paper for Expert Tips!

In our whitepaper, we outline detailed techniques for data collection and analysis, specifying what and where to gather crucial Intelligence. We also present several effective methods for collecting threat intelligence using OSINT, threat intelligence communities, and private intelligence providers. The information is presented in a step-by-step format, making full use of Maltego’s seamless data integrations. The whitepaper enables readers to:

Identify relevant cyber threat intelligence data and sources.
Understand effective methods for collecting treat Intelligence from these sources.
Analyze the collected intelligence, enhance its integration, and enrich it with additional data sources.

Download the whitepaper to gather and analyze real-time intelligence with Maltego!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Don’t forget to follow us on Twitter and LinkedIn and sign up for our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Authors

Carlos Fragoso

Carlos is the Principal Subject Matter Expert and Lead Instructor at Maltego with over 20 years of professional experience in information security: Incident response, digital forensics, threat intelligence, and threat hunting. A curious and passionate investigator working with big companies and LEAs to tackle cybercrime around the world (Europe, Middle East, LATAM) SANS Institute Instructor.

Acknowledgements:

We were excited to undertake this research to support our users and honor the InfoSec community, which tirelessly works to prevent cybercrimes. We recognize that many CTI teams face numerous requests and lack the time to manage all their data sources effectively. Our goal was to inspire them by demonstrating how Maltego can streamline this process and enhance various data integrations within one platform. Scattered Spider is just one of many threats, and we will continue to stand by your side to tackle them together.

Exciting developments are on the horizon—stay tuned for more updates!

Mathieu Gaucheler

Mathieu is a Subject Matter Expert at Maltego. His responsibilities include research-driven content development for blog posts, webinars, and talks. He started working in cybersecurity in Barcelona, focusing on malware analysis and sandbox development. He has previously presented his research at BotConf and RSA APJ.

Acknowledgements:

We trust that this article will not only provide insights into tracking threat actors across diverse datasets using Maltego, but also offer guidance on leveraging the fusion of these datasets to advance your investigations. By delving into the intricacies of combining various data sources, we aim to equip you with the knowledge needed to extend the scope and depth of your investigative efforts. It has been a privilege to play a role in this journey, and we remain committed to continually simplifying the process of analyzing threat intelligence.

Investigating the Alleged Leak of FSB Agents’ Phone Numbers

Thu, 16 May 2024 08:17:37 +0000

Oftentimes, investigators do not possess ample information to launch a person of interest investigation. They may have a name or an alias as a starting point, which is the most common scenario but not the most optimal, as these types of data are not always strictly linked to a unique individual.

While people may randomly share a name or an alias without being connected in any other way, a phone number or an email are data types that investigators may pivot off of with a much higher degree of confidence in the results. However, a phone number or an email might not yield as much information as a name or an alias.

To conduct a successful person of interest investigation, an investigator must combine the previously mentioned types of personal identifiers in order to harvest the maximum amount of information.

We demonstrate this and the investigative steps you can take in your Maltego in the whitepaper below.

DOWNLOAD WHITEPAPER

Person of Interest Investigation Using Leaked FSB Agent Phone Number

Not so long ago, a list of phone numbers—supposedly belonging to employees of the Federal Security Service (FSB), one of the main Russian security agencies, was published by the Defense Intelligence of the Ministry of Defense of Ukraine.

Investigation Method and Objectives

We will investigate one of these leaked phone numbers using Maltego Graph in an attempt to validate it and leverage Maltego Data to learn more about the individual associated with it, including their personal information, social media footprint, and professional affiliations.

Download Whitepaper

Access the whitepaper below to get a full overview of the investigation, the steps you can replicate in Maltego, and other investigator tips for person of interest investigations using social media and breached data.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Your Next Step After Reading the Whitepaper

Person of interest investigations can be made easier by using compromised records, as they can help uncover email addresses, domains, IP addresses, names, passwords, and other personal identifier information. This can be used to map a subject’s online presence, identify threat actors, and determine a company’s breach exposure.

Watch our deep dive with the largest compromised data provider, District4, where we show steps in Maltego to demonstrate the breadth and depth that breached data can bring to your investigations.

WATCH DEEP DIVE

Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Jules Brahms Jules Brahms is a Subject Matter Expert at Maltego, where she supports the trust and safety needs of brands, companies, and platforms, drawing on her experience as a trust and safety professional with a background in incident response, product abuse, and misinformation prevention. In her role, she develops workflows for trust and safety practitioners and conducts training with teams to build capacity in risk assessments, the handling of misinformation and electoral manipulation, and person of interest investigations. Previously, Jules worked as a Subject Matter Expert for online radicalization and misinformation at trust and safety provider ActiveFence, which delivers trust and safety solutions to leading online platforms.

Maltego Handbook for Cyber Threat Intelligence

Mon, 06 May 2024 07:54:23 +0000

With cyber threats and attack methods evolving in complexity, companies can no longer only work on a traditional and reactive basis but utilize insights from past incidents and current alerts to swiftly identify and address potential future threats. In this context, Maltego emerges as a critical platform for helping companies deal with the complexities of streamlining the entire lifecycle of threat intelligence, from collection and processing to analysis as part of their advanced security measures. Moreover, adopting these advanced security measures has become essential for businesses to protect their digital assets.

That is why businesses are turning to incident observations and cyber threat intelligence (CTI) to enhance their understanding of security events, allowing them to anticipate and proactively defend against future threats. CTI, in particular, plays a critical role in refining digital forensics and enhancing the incident response process, but it is still described as a nascent and fast-developing field.

In this article, we will cover foundational concepts and the application of cyber threat intelligence, a field shaped significantly by governmental and military organizations over the years. Additionally, we provide a handbook that your threat intelligence team can use to replicate the investigative process using Maltego, available for download.

What is Cyber Threat Intelligence?

In cybersecurity, threat intelligence refers to the data an organization collects, processes, and analyzes to better understand the motives, targets, and attack behaviors of threat actors, which can assist the decision-making process.

The fact that cybersecurity is increasingly recognized as a priority business risk, along with the growing variety and maturity of products, and factors such as regulatory requirements, are all driving the demand for cyber threat intelligence services. Let’s examine different types to determine the level of cyber threat intelligence your team would need.

Levels of Cyber Threat Intelligence

Cyber threat intelligence can be categorized into four levels:

Strategic Threat Intelligence: It is high-level information including real-life factors such as economic conditions, political climates, the business impact of risks, and emerging trends in attack methodologies. Sources such as whitepapers, policy documents, and publications contribute to this knowledge base, aiming to enlighten non-technical stakeholders such as High-level executives and management.
Operational Threat Intelligence: It is high-level but actionable information including the timing, objectives, and specific methods utilized by threat actors. It equips cybersecurity teams with the foresight needed to predict attacks and understand the schematics behind threat actors’ operations, particularly useful for threat hunters and incident responders. It covers specifics on attack vectors, like domains employed to control comprised systems, and information from external sources like the dark web, all to facilitate the assembly of TTPs.
Tactical Threat Intelligence: It is information that outlines the TTPs employed by threat actors, utilizing frameworks like Mitre ATT&CK to track internal threat information feeds such as network traffic data. It provides a technical context that allows IT admins and SOC managers to detect system breaches or familiarize themselves with prevalent attack strategies. Furthermore, this information supports the improvement of security measures and the protection of businesses.
Technical Threat Intelligence: It is information that includes specific technical indicators or evidence of threat actor’s tools and infrastructures, aimed at SOC staff to block malicious activities. Such information can include identified malicious IP addresses, phishing email subject lines or content, rogue URLs, or samples of malware and exploits. For example, if adversaries leverage corporate emails as an entry point into an organization (as identified through tactical threat intelligence), the specific email subject lines used would be classified as technical threat intelligence.

With this categorization in place, each operational team and individual can access the most relevant intelligence to their role. The goal of categorizing threat intelligence is to facilitate the identification and mitigation of risks, potentially even leading to the attribution of actors, given their diverse motivations and targets. For example, a bank may request its threat intelligence team to create reports on well-known, persistent cybercriminal groups in the industry to avoid becoming their target. Below are the typical motivations and targets associated with different types of cyber threat actors.

Lifecycle of Cyber Threat Intelligence

Numerous approaches to cyber threat intelligence exist, tailored to the specific requirements and priorities of the teams and different cases. However, the most widely adopted lifecycle model of cyber threat intelligence is one that has been developed through decades of intelligence efforts by government and military organizations like the CIA and the NSA. This model outlines the process of developing raw information into finished intelligence in six essential phases: Direction, Collection, Processing, Analysis, Dissemination, and Feedback.

Access the cheat sheet provided below to gain a comprehensive understanding of the six phases of the threat intelligence cycle. It includes examples and key considerations, and showcases Maltego in action, demonstrating how your team can enhance the efficiency of the threat intelligence lifecycle, from data collection and processing to analysis, all through the use of Maltego.

DOWNLOAD CHEAT SHEET

Key Use Cases Involving Cyber Threat Intelligence

Tailoring cyber threat intelligence to align with the specific requirements of each function and organization is crucial. Possessing a sophisticated level of threat intelligence empowers stakeholders to make swift, well-informed decisions. Additionally, it enables security professionals to more accurately grasp the decision-making processes of threat actors, facilitating earlier detection of threats and the implementation of automated responses. This approach also allows for the evaluation of the efficacy of existing security measures. Let’s first find out how it can benefit each function:

Security professionals utilize:

Technical Threat Intelligence to proactively hunt for threat actors who bypass detections, investigate security alerts, and locate forensic evidence.
Tactical Threat Intelligence to test their security technologies and processes, fine-tune tools, and lessen the gaps in their security controls.
Operational Threat Intelligence to prevent or respond to planned attacks, create rules and signatures for detection alerts, and be proactive in vulnerability and patch management.

Stakeholders utilize:

Strategic Intelligence to understand the likelihood of data breaches during risk assessments, set up the company’s cybersecurity stance and budget, as well as gauge the company’s compliance capabilities with regulations.

Download the Handbook for Expert Insights!

In our Cyber Threat Intelligence Handbook, we present the investigative playbook of five commonly known use cases, providing scenarios to demonstrate how you can utilize Maltego for cyber threat intelligence:

Threat Intelligence Collection
Malware Infrastructure Tracking
Vulnerability and Attack Surface Assessment
Threat Actors Profiling
Attacks and TTPs Analysis

Additionally, you can also find out different methodologies of cyber threat intelligence such as mapping the threats to the MITRE ATT&CK framework and the diamond model of intrusion analysis. It also includes tips on various tools and the steps of setting up Maltego on your devices. If you haven’t used Maltego yet, now is the perfect opportunity to discover our organization plan for CTI designed specifically for your team!

Download the handbook to make your threat intelligence analysis effortless!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Don’t forget to follow us on Twitter and LinkedIn and sign up for our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

Essential Playbooks for Your SOC

Mon, 22 Apr 2024 11:56:58 +0000

Security Operations Center (SOC) teams stand on the front lines in cybersecurity, keeping our cyber world safe from endless threats. For these teams, every second counts as they work tirelessly to identify and mitigate cyber threats targeting their organizations.

Balancing a rapid response with thorough initial assessments, all while juggling a myriad of tools, processes, and alerts, is a challenge that the teams face every single day, making efficiency both a goal and a must for survival. This is where the strategic importance of SOC playbooks comes into play.

An Overview of SOC Playbooks

SOC Playbooks are essential for cyber defense, providing clear, step-by-step instructions tailored to various threat scenarios. They serve not merely as documents, but as lifelines that streamline decision-making processes, ensuring that every team member understands their role and actions to take before, during, and after a security incident. Additionally, playbooks facilitate prompt communication with stakeholders in case of a security breach, thereby enhancing transparency and stakeholder relations.

Although no one-size-fits-all format exists for the SOC playbooks, most teams follow the National Institute of Standards and Technology (NIST)’s standards, including the following sections.

INVESTIGATOR NOTE

It is important to recognize that not every SOC is involved in every stage of incident response. Often, SOCs serve primarily in initial detection and analysis, assisting with tasks that Computer Security Incident Response Teams (CSIRTs) or Incident Response (IR) teams might later expand upon. Thus, in many instances, SOCs act as the foundational layer of incident response. In some scenarios, the term “SOC” might encompass the entire incident response spectrum, though this broader involvement is less typical. Remember these insights as you tailor playbooks to fit your team’s needs!

Preparation: Establishing and maintaining the capability to respond effectively to incidents, including developing policies, plans, and procedures, defining roles, training personnel, and acquiring necessary tools and resources.
Detection & Analysis: Identifying and investigating incidents to determine their nature and scope. This includes monitoring for and analyzing potential incidents, effectively using detection tools, and correctly identifying and documenting incidents.
Containment, Eradication & Recovery: Limiting the spread of an incident, removing its components, and restoring systems to normal operation. This involves executing a containment strategy, eradicating the incident’s cause, and recovering affected systems and data.
Post-Incident Activity: Learning from the incident to improve future incident response efforts and overall security posture. This includes conducting a post-incident review, documenting lessons learned, and implementing improvements to policies and controls.

Amplifying SOC Playbooks with Maltego: Ransomware

Security teams are constantly evolving their strategies to respond to and combat the ever-changing cyber threats. Maltego amplifies the SOC playbook’s effectiveness by automating data collection and visualization, turning complex datasets into clear, actionable insights, which saves precious time and helps analysts make informed decisions faster. We will focus on the Detection & Analysis phase, identified as the pivotal segment of the entire process. It is within this phase that Maltego’s capabilities prove most advantageous.

Let’s discuss how Maltego can be used for the ransomware playbook and elevate the SOC operation with the world’s most used cyber investigation platform! For insights into enhancing incident response workflows with Maltego, and to streamline investigative processes, consider delving into the Maltego Handbook for Incident Response.

Ransomware

Maltego enables teams to quickly assess the impact and scope of a ransomware attack and understand the methods through which threat actors control their victims, including uncovering malicious infrastructure such as command and control servers. By speeding up the aggregation and analysis of indicators of compromise (IOCs), Maltego helps identify patterns and connections that might go unnoticed.

Preparation

Attack Surface: Perform an attack surface assessment to identify and catalog all externally exposed hosts, including those potentially unknown to the organization. Regularly update the asset list to reflect the current state of the network environment.
Automated Level 1 Network Footprint: Efficiently conduct network footprinting with Maltego Machines, saving you considerable time on information gathering, processing, and visualization.
Drills: Conduct annual cybersecurity exercises to simulate ransomware attack scenarios. This practice helps validate the effectiveness of the playbook and the organization’s readiness to respond to actual incidents.
Threat Landscape Monitoring: Continuously monitor and analyze threat intelligence to stay informed about emerging threats to the organization, industry-specific risks, and evolving ransomware tactics. Incorporate various sources to obtain a comprehensive threat perspective.

Detection and Analysis

Identify Threat Indicators: Aggregate and analyze indicators from security solutions such as SIEMs like Splunk, AV/EDR, ticketing systems, and notifications from security personnel or users to identify potential ransomware incidents quickly.
Data Collection: Collect detailed information on indicators like Bitcoin addresses, emails, file hashes, file behaviors, domain reputations, and IP communications. Enrich this data using third-party sources to assess the severity and impact of the threat.
Triage: Evaluate the impact (e.g., data destruction, proliferation) and scope (e.g., number of affected hosts, additional IOCs) to prioritize response efforts. Determine if the event is a false positive; if yes, stop; if no, proceed with analysis.
Live Threat Actor: If a live threat actor is identified, utilize Maltego for real-time investigations and support to block new IOCs as they are identified.
Identify Ransomware Family: Use OpenCTI to identify the ransomware’s TTPs, determine decryption possibilities, and identify the targeted OS. This information aids in tailoring the response strategy.
Identify Affected Systems Type: Determine the types of affected systems (servers, workstations) using tools like Splunk to understand the attack’s breadth and depth.
Data Exfiltration: If data exfiltration is suspected, activate the Data Loss Playbook to mitigate and assess the damage.
Pay the Ransom: Assess the legality and advisability of paying the ransom, acknowledging that not all ransomware threat actors are sanctioned entities, paying criminals is illegal in some jurisdictions and generally discouraged according to Business Continuity Plans (BCPs). Perform a thorough blockchain analysis to fully understand the implications and potential risks associated with a ransom payment.
Root Cause Analysis: Conduct a thorough analysis to identify the attack’s root cause, which is crucial for preventing future incidents.
Send Communication: Communicate effectively with all stakeholders throughout the incident to ensure coordinated and informed response actions.

Containment, Eradication, and Recovery

Network Isolation: Block system-to-system communication to prevent the spread of ransomware. Disconnect affected systems from the network as well as any shared drives. And make sure that threat actors can no longer control the infected systems.
Stop Backups: Temporarily halt backup processes to prevent backup data encryption. Verify the integrity of the latest stable version of backups and preserve the latest backups with additional security measures.
Malware Infection: Follow the Malware Playbook to remove ransomware and other implants to remotely control and preserve access from infected systems and prevent reinfection.
Monitor for New IOCs: Continuously monitor new IOCs and the evolution of TTPs from the same incident or campaign during and after the containment phase to detect any lingering threats or additional points of compromise.

Post-Incident Activity

Incident Visualization: Use Maltego to create a comprehensive visualization of the incident, depicting the relationships between hosts, IOCs, and the attack’s progression. This visualization aids in understanding the incident’s full scope and can be used for debriefing and lessons learned.

A Brief Investigation in Maltego

This investigation represents the detection and analysis phase of the ransomware investigation with Maltego. Our starting point is the IPv4 address from the malware sample; Rhysida ransomware.

Step 1: Drop an IPv4 Address and update it with the address of the affected host.

Step 2: Run the Transform Get Malware Attacks Events [Splunk] to identify any malware events associated with the host. Other early unclear events could lead to identifying an infection by investigating suspicious outbound connections. However, in our case, we will focus directly on malware attack events.

Step 3: Select all events Entities and run To FileHash [Hash] to extract the associated hashes. You will see hash Entities as a result.

Step 4: Select the hash Entities and run Lookup by Hash [Polyswarm]. This Hub item is included in the Maltego Selection for CTI.

Step 5. Select the result with the red dot and run the Transform To Tags [Polyswarm] to identify the malware family. This will help verify if there’s a connection to the identified malware.

INVESTIGATOR TIP

To find additional affected hosts, run the Search All Events [Splunk] Transform on the hashes associated with the same Polyswarm Entities.

Step 6: Select the hashes associated with the ransomware and run the Transform To VirusTotal File [VirusTotal Public API] to gather more IoCs.

Step 7: Select the file Entities and run To Contacted IP Addresses [VirusTotal Public API] and To Contacted Domains [VirusTotal Public API] Transforms. After this step, if the team wants to know about the malware(Rhysida) as much as possible, they can use the OpenCTI integration on a new graph.

Step 8: Paste the name of the ransomware family as a phrase Entity and run the Transform Search by Phrase [OpenCTI].

Step 9: Select the STIX2 intrusion set and run the Set to Indicators [STIX2].

Step 10: Select all STIX2 indicator Entities and run the Indicator to all Observables [OpenCTI].

Step 11: Check email logs for emails generated from the identified Domains as well as connections made to/from the IP addresses by using the Get All Mail Events [Splunk] Transform.

In our playbooks, we detail the step-by-step process for four widely recognized use cases, making them ready for investigation so you can easily implement them in your Maltego platform.

Ransomware
Phishing Attack
Malware Infection
Vulnerability Response
Insider Threats (Data Leakage)

You can also find out about how to enhance the investigations with automation and the benefits of the automation in the playbooks!

DOWNLOAD PLAYBOOKS

Embracing a playbook goes beyond just meeting immediate challenges; it’s about evolving into a constantly adaptive presence against cyber threats. With these playbooks, you can assess your team’s current methods and discover ways to boost efficiency and the direct impact of your operations on the business!

Download SOC Playbooks

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

As cybersecurity professionals, we are committed to continuously refining our strategies and tools, which is crucial to staying ahead of adversaries. Embracing the synergy between SOC playbooks and Maltego’s capabilities offers a pathway to enhanced security and a more empowered stance in the digital domain. The journey of bolstering our cyber defenses is ongoing, and with a platform like Maltego at our disposal, it’s a journey that we can undertake with greater confidence and success.

To truly understand the immediate impact Maltego can have on your operations and see how it translates into enhanced efficiency for your organization, consider calculating a tailored ROI today.

Happy investigating!

About the Author

Mario Rojas

Maltego Acquires PublicSonar and Social Network Harvester to Propel Vision of An All-in-One Investigation Platform

Mon, 15 Apr 2024 08:00:00 +0000

Munich, Germany – April 15, 2024

Maltego is the world’s most used all-in-one investigation platform used by institutions such as the FBI and INTERPOL, financial organizations and half of the DOW 30 companies to conduct cyber investigations and analysis. Today, Maltego is excited to announce the acquisition of two great businesses by way of share acquisition: PublicSonar and Social Network Harvester. The acquisitions solidify our position as the all-in-one investigation platform for complex investigations and empowering impactful organizations in our target segments.

Since 2008, Maltego has empowered more than one million investigations worldwide, making it the most used cyber investigation platform in the world. It is our mission to build the ecosystem of tools, data, and people to enable every investigator to discover the truth.

The acquisition of Maltego by Charlesbank Capital Partners in April 2023 has helped accelerate Maltego’s growth and development. We have introduced browser-based investigation capabilities and simplified data access. These capabilities enable us to serve both novice and advanced investigators in various physical settings and with different collaboration needs.

Maltego and Social Network Harvester are often used in conjunction. While Maltego is used for research and pattern analysis, Social Network Harvester is used to collect and preserve court-ready social media data. Law enforcement and intelligence agencies go back and forth between the two tools to collect, research, analyze, cross-reference, and store evidence. Acquiring Social Network Harvester allows Maltego to streamline and broaden such workflow within one interface, providing a truly all-in-one platform to bring criminals to justice with more reliable, accurate evidence.

Maltego x PublicSonar

Similarly, PublicSonar is a platform Maltego customers often rely on to bring the power of open source intelligence (OSINT) into the physical security and public safety landscape. While Maltego is designed to support specialized OSINT investigations with cyber intelligence, PublicSonar leverages OSINT for large-scale, real-time monitoring and public safety management. The combination of Maltego and PublicSonar expands the capability for Maltego users to own and act on intelligence for real-life security objectives.

Maltego as an All-in-One Investigation Platform

“Today, we’re thrilled to expand the Maltego platform by welcoming PublicSonar and Social Network Harvester into our fold. Their exceptional products will further solidify our position as the world’s most used all-in-one investigation platform. I want to commend the exceptional teams behind these companies for building outstanding products for the public sector,” commented Maltego CEO Philip Mayrhofer. “As we integrate, our priority is ensuring continuity for all involved. We’re committed to a seamless transition, leveraging the strengths of each team to drive innovation and deliver unmatched value to our users.”

Over the course of the next months, we will focus on ensuring a smooth integration between the products, brands, teams, and services of all three parties. We are convinced that these acquisitions will help us provide better investigative experiences and resources for all our users and customers, and we will continue to prioritize our customers’ and users’ needs throughout the process.

“We are excited to join the Maltego family, enhancing our Social Network Harvester with even more diverse resources. Our commitment to our users and their investigations remains our top priority. Together, we anticipate a future filled with positive impacts.” Erik Nolte, CEO of Freezingdata (Social Network Harvester) said. CEO & CTO of Freezingdata (Social Network Harvester) Benno Krause added, “Maltego and the Social Network Harvester complement each other perfectly and enable complex and in-depth investigations in a simple way. I have known Maltego for many years and am convinced that all customers will benefit considerably from the acquisition.”

“We are very excited to be incorporated by Maltego. Together, we can provide our clients with a diverse set of tools on a comprehensive platform. Through this collaboration, we eliminate bottlenecks for users and can provide solutions across the whole OSINT spectrum (from public safety to investigation). This will give our clients even more powerful tools to generate valuable insights on the point of decision making.” Sjors van den Dries, CEO of CrowdSense (PublicSonar) said.

Maltego has become the go-to platform for making sense of massive datasets in cyber threat intelligence and law enforcement investigations. With the two acquisitions, we are excited to accelerate further to solidify the value of our platform for law enforcement on and behind the scenes of making the world a safer place.

About Maltego

Maltego empowers investigators to speed up and increase the precision of their investigations through easy data integration in a single interface, aided by powerful visualization and collaborative capabilities to quickly zero in on relevant information. Since its development in 2008, Maltego has empowered millions of investigations worldwide. Maltego is used by a broad audience, from security professionals and pen testers to forensic investigators, investigative journalists, and market researchers. Headquartered in Munich, Maltego has grown to over 100 employees in Germany and works with customers including the Federal Bureau of Investigations, INTERPOL, and major tech and service companies including half of the DOW 30.

About PublicSonar

PublicSonar was developed and founded in 2012 by a team led by Richard Stronkman and Hans Burghard. PublicSonar aims to simplify large-scale data analysis during the monitoring of public incidents, crises, or events. It is a real-time analytics platform for generating insights based on social media, news, and public blogs for incidents and trends that could impact public safety. PublicSonar, was acquired by Maltego in March 2024.

About Social Network Harvester

Social Network Harvester was developed and founded in 2015 by a team led by Benno Krause and Erik Nolte. The founders developed Social Network Harvester, a software solution for collecting, analyzing, and visualizing social media profiles, connections, and interactions, following years of experiences in internet investigations and fighting cybercrime. Social Network Harvester accelerates intelligence collection processes with automated online data collection capabilities and enables investigators to store such evidence effectively. Social Network Harvester was acquired by Maltego in March 2024.

For additional information, please contact: Bhavna Kochar (press@maltego.com).

Maltego, die weltweit meistgenutzte All-in-One Investigation Plattform, übernimmt PublicSonar und Social Network Harvester

Mon, 15 Apr 2024 08:00:00 +0000

München, Deutschland – 15. April 2024

INTERPOL, FBI, die Hälfte aller DOW 30-Konzerne, führende Anwaltskanzleien und Investigativ-Redaktionen nutzen Maltego für Cyber Ermittlungen. Maltego mit Sitz in München ist die weltweit meistgenutzte All-in-One Investigation Plattform. Nun baut Maltego seine Stellung durch strategische Akquisitionen zweier führender Social Network Spezialisten weiter aus: PublicSonar und Social Network Harvester. „Die Akquisitionen erweitern Maltegos Position in den Bereichen Cyber- und OSINT-Ermittlungen.“ freut sich Maltego CEO Philip Mayrhofer. „Und sie machen es Investigatoren noch leichter Intelligence Daten zu erheben, zusammenzuführen und zu kartografieren. Denn das ist zentral, um Muster zu erkennen und verborgene Zusammenhänge ans Licht zu bringen.“

Bereits seit 2008 am Markt hat Maltego als Pionier für Cyber-Investigation-Software heute über eine Millionen komplexe Cyber-Ermittlungen ermöglicht. Dabei hilft Maltego Ermittlern auf der ganzen Welt die in Daten oft tief verborgenen Zusammenhänge zu erkennen und mit ihren Recherche-Ergebnisse die Welt ein kleines Stück sicherer zu machen.

Jüngster Meilenstein der Unternehmensgeschichte war die Komplettübernahme durch den Harvard-nahen Mittelstands-Investor Charlesbank Capital Partners aus Boston im Jahr 2023. Sie gibt Maltego die Möglichkeit den Ausbau zur All-in-One Investigation Plattform für Cyber-Ermittlungen durch den starken Ausbau seines Tech-Teams und gezielte Zukäufe deutlich schneller voranzutreiben.

Schon heute werden Maltego und Social Network Harvester häufig zusammen verwendet. Während Maltego für Recherchen und die Analyse von Datenmustern verwendet wird, dient der Social Network Harvester der Sammlung und Aufbewahrung von gerichtsverwertbaren Social-Media-Daten. Strafverfolgungsbehörden und Geheimdienste wechseln zwischen den beiden Tools hin und her, um Beweise zu sammeln, zu recherchieren, zu analysieren, mit Querverweisen zu versehen und zu speichern. Durch die Akquisition von Social Network Harvester werden diese Arbeitsabläufe perspektivisch in Maltego zusammengeführt. Kriminelle mit zuverlässigeren und akkurateren Beweisen vor Gericht zu bringen, wird durch die einfach bedienbare, einheitliche Oberfläche innerhalb der All-in-One Investigation Plattform von Maltego künftig erleichtert.

Maltego × PublicSonar

Auf die PublicSonar Plattform greifen Maltego-Nutzer schon heute häufig zu, um Open Source Intelligence (OSINT) in die Bereiche physische Sicherheit und öffentliche Sicherheit zu bringen. Während Maltego darauf ausgelegt ist, spezialisierte OSINT-Untersuchungen mit Cyber-Intelligence zu unterstützen, nutzt PublicSonar OSINT für groß angelegte Echtzeitüberwachung und das Management öffentlicher Sicherheit. Die Kombination von Maltego und PublicSonar erweitert die Möglichkeiten der Maltego-Benutzer, Informationen für reale Sicherheitsziele zu besitzen und zu nutzen.

Maltego zur All-in-One Ermittlungsplattform ausbauen

Mit der Akquisition von Social Media Harvester und PublicSonar geht Maltego den nächsten Schritt auf dem Weg zur weltweit führenden All-in-One Ermittlungsplattform. „Für Cyberermittlungen gibt es zahlreiche exzellente Anwendungen, die führend in Ihrer Nische sind. Doch für Cyber-Ermittler ist die Verwaltung, Kenntnis und Pflege der vielen Spezialwerkzeuge eine zunehmende Hürde. Sie müssen sich auf ihren Fall konzentrieren, nicht auf das Handling und Zusammenspiel unterschiedlicher Software.“, erläutert Philip Mayrhofer, CEO von Maltego. “Maltego ist das meistgenutzte Ermittlungs-Tool der Welt und nun bringen wir Cyberermittlungen auf ein neues Level: Mit einer einheitlichen Plattform, die freie, kostenpflichtige und organisationsinterne Daten zusammenführt und gemeinsam in unterschiedlichen Anwendungen und Nutzeroberflächen auswertbar macht.“

“Social Network Harvester in Maltego zu integrieren ist der perfekte nächste Schritt um die Leistungsfähigkeit der Anwendung weiter zu verbessern. Durch die Vernetzung in die Maltego-Plattform entstehen zahlreiche neue Nutzen.“ freut sich Erik Nolte, CEO von Freezingdata (Social Network Harvester). „Und als Teil der Maltego-Familie bekommt unser Team mehr Power und eine begeisternde Perspektive für die Weiterentwicklung der Anwendung. Der CEO & CTO von Freezingdata (Social Network Harvester) Benno Krause fügte hinzu: “Maltego und der Social Network Harvester ergänzen sich perfekt und ermöglichen komplexe und tiefgehende Ermittlungen auf einfache Art und Weise. Ich kenne Maltego seit vielen Jahren und bin überzeugt, dass alle Kunden von der Übernahme erheblich profitieren werden.”

“Wir freuen uns sehr, von Maltego übernommen zu werden. Gemeinsam können wir unseren Kunden eine Vielzahl von Tools auf einer umfassenden Plattform zur Verfügung stellen. Durch diese Zusammenarbeit beseitigen wir Engpässe für die Nutzer und können Lösungen für das gesamte OSINT-Spektrum (von der öffentlichen Sicherheit bis zur Ermittlung) anbieten. Dadurch erhalten unsere Kunden noch leistungsfähigere Werkzeuge, um wertvolle Erkenntnisse für die Entscheidungsfindung zu gewinnen.” Sjors van den Dries, CEO von CrowdSense (PublicSonar) sagte.

Im Laufe der nächsten Monate werden wir uns darauf konzentrieren, eine nahtlose Integration zwischen den Produkten, Marken, Teams und Dienstleistungen aller drei Parteien zu gewährleisten. Wir sind davon überzeugt, dass diese Akquisitionen uns dabei helfen werden, allen unseren Nutzern und Kunden bessere Ermittlungserfahrungen und -ressourcen zu bieten, und wir werden während des gesamten Prozesses weiterhin die Bedürfnisse unserer Kunden und Nutzer in den Vordergrund stellen. „Uns freut besonders das unsere ohnehin wachsende Entwicklungsabteilung durch die exzellenten Tech-Teams von Social Network Harvester und PublicSonar an Knowhow und Schlagkraft noch einmal deutlich zulegt.“ ergänzt Philip Mayrhofer. „Wir heißen die neuen Kollegen herzlich willkommen in der Maltego-Familie und können es kaum erwarten gemeinsam den Sektor der Cyber-Ermittlungen immer besser und dadurch auch die Welt ein kleine bisschen sicherer zu machen.“

Maltego hat sich zur wichtigsten Plattform für die Analyse riesiger Datensätze bei Cyber Threat Intelligence und bei strafrechtlichen Ermittlungen entwickelt. Wir freuen uns, mit den beiden Akquisitionen den Wert unserer Plattform für die Strafverfolgungsbehörden vor und hinter den Kulissen weiter zu steigern, um die Welt sicherer zu machen.

Über Maltego

Maltego ermöglicht Ermittlern eine schnellere und präzisere Durchführung ihrer Ermittlungen durch einfache Datenintegration in einer einzigen Benutzeroberfläche, unterstützt durch leistungsstarke Visualisierungs- und Kollaborationsfunktionen, um relevante Informationen schnell ausfindig zu machen. Seit seiner Entwicklung im Jahr 2008 hat Maltego Millionen von Ermittlungen weltweit unterstützt. Maltego wird von einem breiten Publikum genutzt, von Sicherheitsexperten und Pen-Testern bis hin zu forensischen Ermittlern, investigativen Journalisten und Marktforschern. Maltego hat seinen Hauptsitz in München und ist auf über 100 Mitarbeiter in Deutschland angewachsen. Zu den Kunden gehören das Federal Bureau of Investigations, INTERPOL und große Technologie- und Dienstleistungsunternehmen, darunter die Hälfte der DOW 30.

Über PublicSonar

PublicSonar wurde 2012 von einem Team unter der Leitung von Richard Stronkman und Hans Burghard entwickelt und gegründet. PublicSonar zielt darauf ab, die Analyse umfangreicher Daten bei der Überwachung von öffentlichen Vorfällen, Krisen oder Ereignissen zu vereinfachen. Es handelt sich um eine Echtzeit-Analyseplattform, die auf der Grundlage von sozialen Medien, Nachrichten und öffentlichen Blogs Erkenntnisse über Vorfälle und Trends gewinnt, die sich auf die öffentliche Sicherheit auswirken könnten. PublicSonar wurde im März 2024 von Maltego akquiriert.

Über Social Network Harvester

Social Network Harvester wurde 2015 von einem Team unter der Leitung von Benno Krause und Erik Nolte entwickelt und gegründet. Die Gründer entwickelten Social Network Harvester, eine Softwarelösung zum Sammeln, Analysieren und Visualisieren von Social-Media-Profilen, Verbindungen und Interaktionen, nach jahrelanger Erfahrung in Internet-Ermittlungen und der Bekämpfung von Cyberkriminalität. Social Network Harvester beschleunigt nachrichtendienstliche Erhebungsprozesse durch automatisierte Online-Datensammlungsfunktionen und ermöglicht Ermittlern eine effektive Speicherung solcher Beweise. Social Network Harvester wurde im März 2024 von Maltego übernommen.

Für weitere Informationen wenden Sie sich bitte an: Bhavna Kochar (press@maltego.com).

Boston University MET College Integrates Maltego in New Investigation Training

Thu, 11 Apr 2024 16:12:26 +0000

The Boston University Metropolitan College Cybercrime Investigation & Cybersecurity (CIC) program has won a grant of $437,500 from the US Department of Justice’s Office of Juvenile Justice and Delinquency Prevention (OJJDP) to produce a new investigation training to support Innovative Internet Crimes Against Children (ICAC) Task Force investigations. For the first time, Maltego has been integrated within this training program as an all-in-one cyber investigation platform, to empower investigators to combat internet victimization of children.

The initiative, titled “Innovative Internet Crimes Against Children (ICAC) Investigative Training on Internet of Things (IoT), Open-Source Intelligence (OSINT), Dark Web, and Crypto,” is a collaborative effort between MET’s CIC program, the Anti-Human Trafficking Intelligence Initiative (ATII), the University of Texas at San Antonio, and WestEd, a child welfare-focused nonprofit. OJJDP will also have a leadership role. Dr Kyung-shick Choi, Professor of Practice and Director of Cybercrime Investigation and Cybersecurity Graduate Programs, MET College, Boston University, is the principal investigator, with Senior Associate Dean for Academic Affairs Dr Lou Chitkushev joining as co-PI.

The program’s goal is to introduce a new dimension into IoT forensics and cryptocurrency tracking investigation techniques through the design of multi-leveled training processes to support law enforcement efforts. IoT technologies, like Amazon’s Alexa, Ring camera devices, and other internet-enabled hardware, which have been used by cybercriminals to produce and distribute child sexual abuse material (CSAM), can also be used as forensic evidence in abuse cases. The program will help train state and local law enforcement to mine those sources and lead successful investigations. Additionally, as CSAM is often disseminated via the dark web through cryptocurrency transactions, the program will prepare law enforcement agencies to identify evidence of such activity, which in turn will net a greater number of successful prosecutions.

Maltego has significantly enhanced innovative training programs for Internet Crimes Against Children (ICAC) Law Enforcement, concentrating on Open Source Intelligence (OSINT), Darkweb, and Cryptocurrency Investigations as part of a government project. It serves as an invaluable investigative tool for law enforcement officers.

Dr Kyung-shick Choi

Professor of Practice and Director of Cybercrime Investigation and Cybersecurity Graduate Programs / Boston University MET College

By crafting courses that will teach officers of the law tools and techniques to combat internet victimization of children, this federally-funded program will aim to ameliorate the scourge of online child abuse and sex trafficking.

Maltego’s partnership with Boston University Metropolitan College’s Cybercrime Investigation & Cybersecurity program underscores our dedication to enhancing cybersecurity education. By integrating our investigative tools into their work, we’re empowering the next generation of cybersecurity professionals, aligning with Maltego Grants for Education & Research Program’s mission to foster a safer, more secure digital world.

About the Maltego Grants for Education & Research Program

The mission of the Maltego Grants for Education & Research Program is to bolster students who are driven to change the world. By providing tailored career guidance based on their unique interests, academic fields, and professional objectives, the Program’s goal is to enable students to effectively leverage the ever-advancing digital and technological landscape.

The Program equips students with the necessary skills, training, and qualifications. This ensures that they are prepared to tackle the increasing security risks that have the potential to impede economic development and erode public confidence. Collaborating with educational institutions assists in fulfilling a shared objective of building a more resilient world.

To know more about the Maltego Grants for Education & Research Program, please visit here or reach out to research@maltego.com.

Maltego is Now ISO 27001:2022 Certified!

Mon, 08 Apr 2024 12:18:09 +0000

We at Maltego make data security core to our values and operations. We are therefore excited to announce that Maltego is now ISO 27001:2022 certified and will continue to apply highest standards to secure your data.

What is ISO 27001

ISO 27001:2022 is an international standard to manage information security and help organizations make the information assets in hand more secure. Organizations must complete an audit that ensures they meet the following requirements:

Systematically examine the organization’s information risks, such as threats, vulnerabilities, and impacts.
Design and implement a comprehensive set of controls and risk treatments to address critical risks.
Adopt an overarching management process to ensure the information security controls continuously meet the organization’s security needs.

What It Means for Our Customers, Users, and Partners

The ISO 27001 standard was published to unify companies around addressing global cybersecurity challenges and to improve the trust in the digital systems used today. Making the internet a safer place for all of us is core to Maltego’s mission.

Hence, being ISO 27001:2022 certified helps our customers, users, and partners to compare Maltego’s information security against an international accepted standard. While information security has always been one of our core priorities, we wanted to get ISO 27001:2022 certified to help our customers and partners to speed up their security assessments.

Being ISO certified was not the start to Maltego’s data security efforts. We have always made privacy and security one of our core priorities. Prior to being ISO 27001:2022 certified, Maltego has been GDPR compliant in all aspects of processing, storing, and protecting our stakeholders’ data.

Knowing that data security is central to building trust with our customers and partners, we committed to obtaining the ISO certificate and will continue to ensure ongoing implementation and improvement of our security.

Going forward, Maltego will complete annual surveillance audits conducted by a licensed auditor on our data security measures, processes, and controls. We will also continue to be transparent about data protection through our Data Privacy Policy and Website Privacy Policy.

You can view details of our ISO 27001:2022 certificate here. If you have any question or need information on how Maltego is building data privacy into everything we do, please feel free to reach out.

Happy investigating!

Case Study: Ukrainian Cyber Police Fights Crime with Maltego

Tue, 02 Apr 2024 09:42:30 +0000

The Cyber Police Department of the National Police of Ukraine was established in 2015 to detect and investigate all crimes committed using the information technologies and telecommunications. Since the beginning of the full-scale invasion of Ukraine, the Department has been actively involved in protecting Ukraine’s cyber defence and carrying out tasks related to cyber warfare, as a measure to counter the armed aggression of the Russian Federation.

The Department is tasked with leading various criminal investigations such as computer-related fraud, internet crimes, child abuse, and performing tasks related to protecting Ukrainian cyber infrastructure and more. Their day-to-day work requires them to gather and analyze information from OSINT, social media intelligence, infrastructure footprinting, and other data sources.

Maltego is widely used in daily activities of the Ukrainian Cyber Police

Since 2020, the Ukrainian Cyber Police Department has relied on Maltego to analyze digital traces of suspected individuals across the internet, including social networks, websites, forums, financial transactions, and other user activities across the surface web and the dark web. They use Maltego particularly for the execution and report generation of the following aspects of their criminal investigative work:

Discovering Relationships
Social Network Analysis
Person or Organization Profiling
Domains and IP Address Tracking

According to investigators of the Ukrainian Cyber Police Department, the main advantage of using Maltego is the possibility to apply a flexible approach.

Maltego’s strength lies in its capacity to visualize relationships among Entities, even when dealing with large volumes of data.

Ukrainian Cyber Police

Ultimately, Maltego enables the Ukrainian Cyber Police to quickly obtain information about the subject from the surface web and the deep and dark web.

Download this case study now to learn why the Ukrainian Cyber Police uses Maltego to uncover identities of malicious hackers’ and Russian military personnel.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Beginner's Guide | Mapping a Basic (Level 1) Network Footprint – Part 2

Tue, 12 Mar 2024 17:04:34 +0000

In the previous post, we derived DNS names from a given domain. That returned hostnames which are, or have historically been, part of the domain’s infrastructure.

Continuing Level 1 Network Footprint with Maltego

In this post we explore the next step in mapping the Level 1 network footprint - deriving the IP addresses of the hostnames and the netblock these IP addresses belong to.

At each step in this sequence, we run a Transform on the output Entities of the previous Transform.

Step 1: Pivoting from DNS Names

We start with the DNS Names from the previous post and run the Transform To IP Address [DNS] to obtain IP addresses. This Transform resolves the input Entity using DNS to IP addresses.

Step 2: Deriving The Netblocks from IP Addresses

Next, we derive the netblocks the IP addresses are part of by running the To Netblock [Using natural boundaries] Transform. This Transform by default divides the IP address space into blocks of 256 IP addresses and returns the block where the given IP address fits into. The block size can be configured in the Transform input (little spanner icon next to the Transform’s name in the Transform menu).

How is Netblock Information Obtained

Netblock information can also be obtained from the routing updates published by the Border Gateway Protocol (BGP) on the Internet backbone. The To Netblock [Using routing info] Transform uses this information to assign a netblock to a given IP address.

As with the natural boundaries, we must make a few assumptions regarding the size and validity of the netblocks. The size and validity of the netblock of an IP address depends on the BGP routing view used by the Transform. Therefore, we may get a smaller (or more precise) or larger (less precise) netblock with this Transform. Moreover, the netblock size may not reflect all the recent changes made to it as there is a delay in generating the routing views from BGP routing updates.

Step 3: Return the AS Number Owning the Netblocks

We now pivot on the returned netblocks to derive the Autonomous System (AS) that own them. For this we use the To AS number Transform. This Transform returns the owner of a given netblock by querying the Regional Internet Registry (RIR) databases.

Step 4: Finding Out the Owner of the AS Numbers

Finally, we derive the owner of the returned AS numbers by running the To Company [Owner] Transform. This Transform extracts the owner information of a given AS from the RIR databases. Running the above Transforms on the docs.maltego.com DNS Name Entity shows that docs.maltego.com is hosted on Amazon AWS:

Uncovering Internet Infrastructure By Conducting Level 1 Network Footprint

In this post, we have seen how to derive IP addresses, netblocks, AS numbers, and the AS owners. This, together with deriving DNS hostnames from a domain name, comprises a Level 1 network footprint. It shows us the Internet infrastructure used by services that are provided under a domain name. As companies usually offer their services under their company domain, this footprint maps the infrastructure the company uses for providing the services/products it offers.

If you made it this far, congratulations! L1 foot-printing is common in IT security and running the Transforms introduced in Part 1 and this blog post for new domains is repetitive and tedious. Therefore, Maltego comes with the L1 footprint machine.

Automate Level 1 Network Footprint with Maltego Machines

Machines are like macros that execute a fixed set of Transforms. Learn more about Machines and how to create them this blog post.

You can have all the above Transforms run in the same order by running the L1 footprint machine. To run a machine, click on the Machines > Footprint L1 with your starting Domain Entity selected, and then wait for the magic to complete.

To stay up to date with other cool use cases, product updates and Maltego events, follow us on Twitter or LinkedIn or subscribe to our email newsletter. If you have questions, requests, or use cases you’d like to share, we would love to hear from you on Twitter!

Beginner's Guide | Mapping a Basic (Level 1) Network Footprint – Part 1

Tue, 12 Mar 2024 17:00:03 +0000

This guide shows how a basic (Level 1) network footprint of an organization can be derived. In Maltego, we use “levels” to indicate how deep such footprints go. For example, a Level 1 footprint is all the infrastructure directly observable without having to pivot backwards to discover additional resources.

Level 1 Network Footprint in Maltego

A basic Level 1 network footprint contains:

DNS names currently or previously used by the organization;
Mail exchange servers used by the organization;
Email addresses of the organization’s network administrators;
The netblocks that these IP address belong to; and
The companies owning these netblocks.

In Part 1 of this series, we focus on deriving the DNS names and mail exchange servers used by the organization, as well as their administrative email addresses. In Part 2, we will explore the next step in mapping the Level 1 network footprint

For Complete Maltego Beginners

If you are new to Maltego, please visit Beginners Guide to Maltego: Charting my first Maltego Graph for a brief introduction to Maltego concepts, such as creating a graph, what an Entity is, and running your first Transform.

Maltego Transforms for Level 1 Network Footprint

The next section of this post will focus on how to derive the IP addresses of the DNS names and mail exchanges.

Given an organization’s domain, we can extract the DNS names under that domain by querying DNS resolvers on the Internet. There are also passive DNS databases which keep a historical record of DNS names. Using Maltego, we can query both the current DNS resolvers and passive DNS databases to derive the DNS names. Additionally, we can use the Bing search engine to find DNS names that end with the given name. The following are the Transforms that derive DNS names from a domain.

To Website [Quicklookup]

This Transform performs a DNS lookup for the DNS name derived by prefixing “www.” to the given domain. Upon successful lookup, that DNS name is returned.

To DNS Name [Find common DNS Names]

This Transform will try to discover various common DNS Names in a domain. The common DNS names are tested by prefixing domains with the following names:

mail, mx, ns, ftp, webmail, web, gateway, secure, intranet, extranet, smtp, pop, ns1, mx1, email, admin, dmz, blog, dns, forum, ntp, pub, route, sql, ssh, webaccess, xml, imap

To DNS Name [Attempt Zone Transfer]

This Transform sends a zone transfer request to the Name Server of the given domain. If the request succeeds, the DNS server will give information about all the DNS names in the domain. The Transform then returns DNS names for all the A and CNAME records in the zone.

Note that DNS servers generally do not respond to zone transfer request. Nevertheless, we may get lucky with an old or an ill-configured one.

To DNS Name – SOA (Start of Authority)

This Transform returns the NS record and the email address of the administrative contact of the given domain.

To websites using domain [Bing]

This Transform queries the Bing search engine and returns all the websites with hostnames that end in the given domain. For example: jobs., portal., etc.

To DNS Name [SecurityTrails]

This Transform searches the SecurityTrails passive DNS database for any DNS names that contain the given domain.

To DNS Name (interesting) [SecurityTrails]

This Transform is similar to the previous one, but searches for DNS names containing the given domain and any of the following terms:

VPN
Webmail
Firewall
Test
Scada
Intranet
Secure
SSH
Database

Starting Off: Run the Transforms on a Domain Entity

Right click on the Domain Entity on the graph. In the context menu, you can search for the Transform by typing its name. Once the desired Transform is found you can click on the Transform to run it.

Run the above Transforms on the Domain Entity in any order. What you have on the graph are the DNS names that we can find for the given domain.

Note that the SecurityTrails and the Bing Transforms may return historical DNS names which may or may not be currently available.

As an example, here is the result of running the above Transforms on maltego.com domain:

In our next part of Beginners Guide to Maltego: Mapping a Basic (Level 1) Network Footprint – Part 2, we will show you how to derive the IP addresses from these DNS names, their netblocks and the companies that own them.

READ PART 2

Beginners' Guide | Charting My First Maltego Graph

Tue, 12 Mar 2024 16:51:46 +0000

This post introduces Maltego graphs, Transforms, and Entities. It shows you how to create a new graph, populate the graph with Entities, run Transforms on those Entities to obtain new Entities and copy Entities from one graph to another.

If you have already played around with Maltego to create your first graph, read on about conducting a level 1 network footprint investigation in the next Beginners Guide article.

Creating Our First Maltego Graph

Let us create our first Maltego graph by clicking on the Maltego button in the top left corner and choosing New from the main menu. This creates a new graph for us to work on.

Step 1: Creating Our First Entity in Maltego

In this guide, we will use GNU organization as an example, which is identified by the domain gnu[.]org.

To add an Entity for this domain to the graph, we first search for the Domain Entity in the Entity Palette, which is on the left of the window, and drag a new Entity onto the graph.

By default, Entities come with a default value. In our case, the Domain Entity has a default value of maltego.com. This can be changed by double clicking the Entity value (or pressing the F2 key with the Domain Entity selected) and changing the value to: gnu[.]org.

Step 2: Running Maltego Transforms

What Are Transforms?

Transforms are functions which take an Entity as input and create new Entities as output. The output Entities are then linked to the input Entity. This is how a graph grows in Maltego. This could be compared to the way investigations are carried out: you start with some piece of information and you derive new pieces of information from it.

Each Transform accepts certain types of Entities as input. You can see the list of Transforms that can take an Entity as input by right-clicking anywhere on the graph with the Entity selected.

You can now choose what Transform to run by selecting that Transform in the context menu.

If you know which Transform you want to run, you can search for it using the search box in the Run Transform menu.

Note the + in the menu options: it indicates a Transform Set, where related Transforms are grouped together. Clicking on the Transform Set will show the Transforms in that set. To go back, select the back arrow as shown below, or simply right-click anywhere in the Transform menu.

Run the To Email Address [From whois info] Transform to Find Email Addresses from A Domain

In this example, let us find the contact details for the owner of the domain gnu.org. Expand the “Domain owner detail” Transform set and select the To Email address [From whois info] Transform.

This Transform fetches the “whois” record for the gnu.org domain and extracts the administrative email addresses for the domain. Results from the Transform are added as child Entities to the Domain Entity.

We can also extract any phone numbers present in the whois data by running the To Phone numbers [From whois info] Transform.

Run the To DNS Name [Find common DNS names] Transform to Find DNS Hostnames Under A Domain

To find some of the DNS hostnames that exist under gnu.org, run the Transform To DNS Name [Find common DNS names] on the gnu.org Domain Entity. You can search for this Transform by typing “DNS” in the search box:

The Transform To DNS Name [Find common DNS names] will try to discover various common DNS names in a domain. The common DNS names are tested by prefixing domains with the following names: mail, mx, ns, ftp, webmail, web, gateway, secure, intranet, extranet, smtp, pop, ns1, mx1, email, admin, dmz, blog, dns, forum, ntp, pub, route, sql, ssh, webaccess, xml, imap, and more.

Our graph now contains the administrative contact details and some hostnames under the gnu.org domain.

Run the To IP Address Transform to Look Up IP Addresses of Hostnames

Next, we can look up the IP addresses of these hostnames. This can be done by selecting all DNS Name Entities and running the Transform, To IP address [DNS]. Multiple Entities can be selected by dragging the mouse selection over them – click and drag the mouse to select Entities under the selection box:

This Transform returns us the IP address of these DNS names by querying the DNS.

Remember to Save Your Maltego Graphs

Note: Get into the habit of regularly saving your graph as your investigation progresses. You can do this by selecting Save As in the main menu.

Since investigations tend to uncover and contain sensitive data, Maltego offers the option to encrypt saved Maltego graphs. You can choose to encrypt your graphs by selecting the Encrypt option and providing a password for encryption.

That’s it! The saved graph can be re-opened by entering your password.

Dive into Level 1 Network Footprint with Maltego

In this blog, we’ve illustrated how to create a graph in Maltego, how data is represented as Entities and how to derive more Entities onto the graph by running Transforms.

For a deeper look into some of the Transforms in Maltego, see our next blog post Beginner’s Guide to Maltego: Mapping a Basic (Level 1) footprint—Part 1.

CONTINUE READING: LEVEL 1 NETWORK FOOTPRINT IN MALTEGO

Everything You Need to Know to Become a More Valuable OSINT Investigator

Tue, 12 Mar 2024 09:26:13 +0000

Hashtags, location filters, reverse image searches, Google Dorks, archive services – using these advanced open-source intelligence (OSINT) techniques have become the bread and butter of today’s OSINT investigators.

And there are other tools and tricks of the trade at your disposal. With them, you can achieve much more as an OSINT analyst and improve the effectiveness and accuracy of your analyses.

In this article, we will share investigative tips and resources that will help you become a more valuable OSINT investigator.

Table of Content

How to Stay at the Top of Your Game as an OSINT Analyst

Sharpening your OSINT skills works similarly to how you put together fragmented pieces of information from open-source databases to make connections.

The catch is that, much like the cases you work on, there is no single path, definitive course, or playbook containing all OSINT knowledge that guarantees success. (Though some would argue that Michael Bazzell’s fifth edition of “Open Source Intelligence Techniques” comes remarkably close!)

On the bright side, there are methods and approaches that you can include and replicate to improve the accuracy and integrity of your OSINT analysis.

1. Be Ruthlessly Selective and Validate, Validate, Validate!

Avoid information overload when you add unclassified data to your existing intelligence processes without validating it.

The rule of thumb is to be meticulously selective and strategic about which OSINT data to incorporate and whether you’ll have the means to cross-reference the data, assess the source, and explain its relevance to other collaborators and stakeholders. You should be especially vigilant now with the explosion of AI-generated content, to avoid falling for manipulated information.

Once you have made some assumptions based on data that is available to you, try to poke holes in your own logic. Look for evidence that proves or disproves your hypothesis, and ask the following questions:

Can I validate it?
Can I vouch for this data’s authenticity?
Can I explain its relevance to the overall investigation?
What techniques can I apply to avoid bias?

INVESTIGATOR TIPS

To help you in the process of finding answers to these questions, you can also make use of some additional materials on our blog:

Our cheat sheet outlining 12 essential OSINT tactics also supports you to be truly selective among the vast amounts of online data coming from various sources.

These guidelines will help you establish structure and direction for your investigations, whether you are gathering online evidence for ongoing cases or preparing to request subpoenas.

DOWNLOAD CHEAT SHEET

2. Repeat the Motto: Security, First!

We have already used up a lot of digital ink on our blog to list the best operational security (OPSEC) principles and practices and how to apply them in your daily work. But the topic of compromised credentials is so vast and crucial that it’s impossible not to mention it when speaking about increasing your professional skills.

Expert investigators not only follow the OPSEC rules of the company where they work. They independently and proactively check whether their own or their collaborators’ credentials have been compromised, and advocate for new principles and measures to be adopted by their peers.

What if a compromise does occur? Keep a cool head at all times and inform whoever needs to be informed while keeping your ego in check. A valuable investigator is not only someone who can effectively complete investigations but also someone who can admit a mistake sooner (way sooner!) rather than later.

After all, what counts is making your operation safe, and it’s a team effort. Having an immediate response checklist at your disposal to refer to and informing the rest of the team without hesitation can only improve the speed at which you can assess, contain, and recover from data breaches, adding another point to your resume.

INVESTIGATOR TIPS

Here are some additional tools that can help you protect your identity, which you might find useful to try:

Check Your Hack – verify if your credentials have been compromised and listed for sale on the Genesis Market
Fake Person Generator – create a fake persona to hide your real information
Google Voice – conceal your phone number by designing a “fake” number that gets routed to your phone

For more information on adding an extra layer of security to your operations, explore our other resources:

3. Learn from Other Investigators

Many OSINT professionals and enthusiasts write about their experiences and share case studies on their blogs or in closed forums. The key: Instead of merely reading about an interesting case, you should actively try to replicate those use cases. This helps you identify systematic approaches to data collection, analysis, and verification, along with developing useful workflows for future reference.

Additionally, you learn about the capabilities and limitations of various tools and technologies in a practical setting. You can then use this knowledge to assess whether your current toolkit is sufficient for the types of investigations you conduct and which methodologies are effective for the investigators you follow.

Although you won’t always have access to exactly the same data or tools, you will be able to identify and utilize the patterns and approaches in the investigator’s train of thought when tasked with a similar case.

INVESTIGATOR TIPS

If you want to connect with fellow OSINT investigators, check out our ready-to-download list featuring 15 reliable OSINT and cyber threat intelligence (CTI ) organizations and associations.

DOWNLOAD INFOGRAPHIC

For more OSINT learning materials, check out our list of over 100 websites, blogs, podcasts, YouTube channels, and books, covering not only OSINT but also Cybersecurity, Cybercrime, and Trust and Safety insights.

4. Build up Your Credibility

While communities like these offer a wealth of practical knowledge, administrators of more closed and niche groups may be selective and careful when admitting new members.

The reason is that investigators may be hesitant to reveal all their techniques in public spaces because they need to be cautious about disclosing information in case malicious actors exploit their expertise. How can you prove you’re there for the right reasons?

There is some work to be done on your part to help open the doors for you to access this wealth of knowledge. Demonstrating that you work for a renowned organization is one thing, but don’t let it be your only ace in the hole.

You can build your credibility by sharing your contributions in various other, more accessible communities, attending industry events, participating in capture-the-flag contests, and expanding your network.

INVESTIGATOR TIPS

While you’re working on your contributions to the community, keep these things in mind:

Share information because you want to help, not because you seek fame. OSINT professionals have a remarkable attention to detail and know how to read between the lines. They will notice whether your motivations are genuine, such as improving yourself and supporting others’ work, or not.
Share OSINT knowledge and techniques securely, with obfuscated data, and without compromising your organization and clients — Don’t let adversaries use your hard work against you.
A jack of all trades is a master of none. To make your contributions truly valuable and not replicate obvious industry truisms, identify your strengths and focus on specializing in your area of expertise, from which other experts like yourself can benefit.

5. Be Critical of Expert Information

Do you remember the first tactic? “Be Ruthlessly Selective and Validate, Validate, Validate!” – this applies not only to the use of data in your investigations, but also to the expert information you consume.

Be mindful of whose advice you follow. If an investigator consistently shares faulty results, this should be a clear signal to you.

What if you only follow “the most popular” and “the most renowned” experts?

Always Question Ready Assumptions!

Continuously question the status quo and scrutinize your own reasoning by seeking out evidence that supports or contradicts hypotheses.

6. Collect Insights from Maltego Experts and Partners

Our Maltego Subject Matter Experts are also keen to contribute to the OSINT community. We share our expertise and often leverage our network to partner with other industry experts.

We consistently publish insights on applying OSINT in cybercrime investigations and cyber threat intelligence:

For existing and new Maltego users, we also offer access to our learning platform, Spark, where you can explore a full catalog of courses, both live and on-demand, and participate in live sessions hosted by Maltego SMEs. These resources enable investigators to leverage their OSINT knowledge to the fullest within the platform.

Download Your OSINT Resources

While this article has provided some insights and methods to enhance your investigative skills, there’s always more to discover and apply in the ever-evolving field of OSINT.

Below you can find resources we recommended in this article to further equip you with more knowledge for advanced open source intelligence work:

12 OSINT Steps to Gather Online Evidence

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

15 OSINT and CTI Communities and Organizations to Follow

DOWNLOAD INFOGRAPHIC

We hope these materials will inspire you to continue learning and refining your skills with Maltego. Keep investigating, stay curious, and don’t forget to check back for more insights that we share on our blog, Twitter, LinkedIn, and Mastodon, or email newsletter.

Happy investigating!

About the Author

Daphnée Aguilar

Daphnée is a Criminologist with more than 10 years of experience as an Intelligence Officer. She specialized in developing actionable intelligence for identifying, preventing, and neutralizing threats and risks from Transnational Organized Crime. Driven by the feminist movement, her last research was on the Effects of Gender and Racial Bias on Gender-Based Violence Policies. She considers herself a professional taco taster.

Pattern of Life Analysis with Maltego

Wed, 21 Feb 2024 04:18:04 +0000

Are humans creatures of habit? When you observe the people around you, it becomes clear that each person develops a unique adult personality, characterized by distinctive habits and behaviors.

Viewed from a broader perspective, these behaviors often seem repetitive, highlighting our natural inclination toward certain activities, performed in specific ways. In the investigative world, these predictable patterns can be a valuable source of information and may be part of what is known as a pattern of life analysis.

In this blog, we will explore ways in which investigators can understand the habits or behaviors of their persons of interest, using the example of analyzing fitness-tracking device data in Maltego. For this investigation, we will focus on tracking data from the Strava application that have allegedly led to exposing the location of an assassinated Russian submarine commander, Stanislav Rzhitsky.

What Is Pattern of Life in OSINT?

Pattern of life analysis aids OSINT investigators in interpreting large quantities of data about a target to understand their habits and behaviors. This then helps discern patterns that help reach informed conclusions and complement person of interest investigations.

Alternatively, by noticing and then investigating unusual or curious behaviors, you can uncover the underlying causes that will lead to identifying the person involved in these actions.

If you want to know what data sources you can use for your pattern of life analysis, download the infographic below.

DOWNLOAD INFOGRAPHIC

Why Use Pattern of Life in OSINT Investigations?

Regardless of the approach, there are several reasons why pattern of life analysis can be beneficial in investigative work.

1. Gaining insights into anonymized datasets: By applying open-source intelligence (OSINT) and signals intelligence (SIGINT) methodologies to metadata, investigators can generate intelligence from communications without needing access to the content of those communications.

INVESTIGATOR EXAMPLE

Imagine you have access to a database of an online delivery service like Uber Eats that was leaked, and you see there is a pizza order every second Tuesday of the month to an address of a government building. This might give you a hint that there is a scheduled monthly meeting of a team. Imagine all those orders were made by the same phone number, which you can find within an OSINT database linked to an analysis department.

2. Identifying suspicious activities: Pattern of life analysis enables investigators to establish a baseline of “normal” or repeated activities. Once this baseline is set, it becomes easier to spot unusual activities.

INVESTIGATOR EXAMPLE

There is an increase in social media posts about luxury items and vacations from a suspect usually posting about a modest lifestyle. This change coincides with large, unexplained bank transfers. By correlating these posts with financial data, you identify potential financial fraud, using the suspect’s deviation from normal behavior as a key indicator of suspicious activities.

3. Collecting predictive intelligence: If we know what the usual patterns of behavior of targets are, we can make pre-emptive operational decisions.

INVESTIGATOR EXAMPLE

For instance, consider the analysis of airline ticket purchases made by known drug traffickers. By identifying specific patterns in their travel habits, border surveillance investigators can strategically decide which flights to monitor more closely or intercept.

How OSINT Investigators Can Use Data from Fitness-tracking Devices?

One example of a database that can be utilized for a pattern of life analysis is fitness-tracking devices. By exploring data shared via these applications, you may be able to track commonly used running routes and identify the frequency of their use, as well as discover connections between people using the same application.

Source: Strava

Let’s consider the example of the heatmap feature in the Strava application, which tracks running and cycling routes and displays them on an online global heatmap.

However, from an investigator’s perspective, what appears to be harmless and inquisitive behavior could actually help in uncovering patterns of user activity. Sometime after releasing this feature, press and social media commentators noted that Strava’s heatmap could have been used to identify military deployments.

Source: Wired

This occurred because the routes and performance of soldiers stationed at certain locations were tracked in the fitness application. Consequently, this incident inadvertently compromised their operational security (OPSEC), a topic widely commented on across popular social media channels and news websites.

How to Conduct a Pattern of Life Analysis in Maltego?

Similarly, the media reported that data from a fitness application could have compromised the whereabouts of a Russian submarine commander, Stanislav Rzhitsky, who was assassinated in 2023 while running. Allegedly, his assailant tracked his daily routes in the fitness application.

We will focus on this case in more detail in our whitepaper to illustrate how shared fitness tracking data can be utilized in an investigation.

DOWNLOAD WHITEPAPER

Target Information

Stanislav Rzhitsky is believed to have been targeted in retaliation for a Kalibr missile strike in Vinnytsia, Ukraine. His death is thought to be linked to his use of a jogging application that uploaded data to the popular fitness platform Strava. His profile, which was left open to public view, detailed some of his frequently taken routes. Authorities suspect that the assassin used his fitness tracking data to locate him.

Source: Kyiv Post

Goal of the Analysis

The goal is to explore how the data shared by Stanislav Rzhitsky on his Strava app could have been leveraged by the assassin to locate him.

Source: Kyiv Post

Download Whitepaper

Our whitepaper will provide a demonstration of the initial discovery of our person of interest, followed by an illustration of a pattern of life analysis in Maltego.

With this guide, we aim to assist law enforcement agencies in their day-to-day investigations and raise awareness among other organizations about the importance of physically protecting their personnel by preventing the disclosure of sensitive information in public and enhancing their OPSEC. Such information could otherwise be used by individuals with illicit intentions to target them.

You can download the guide down below for a full pattern of life analysis in Maltego.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

What Other Data Sources Can OSINT Investigators Use for Pattern of Life Analysis?

While fitness tracking data is one example you can use to complement your investigation of a person of interest with a pattern of life analysis, there are numerous other sources you should consider that may fit your use case.

Download the infographic to find out now.

Download Infographic

DOWNLOAD INFOGRAPHIC

If you are interested in more guides on cybercrime investigations, you might want to explore our blog on person of interest investigations using OSINT and Maltego, which includes a ready-to-replicate workflow. Alternatively, you could watch a webinar on investigating FSB agents’ phone numbers to learn how to leverage breached data in your investigations.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter to stay updated on the latest tutorials, use cases, and webinars!

Happy Investigating!

References

About the Author

Carlos Fragoso

How to Store and Prepare OSINT and Maltego Evidence for Prosecutors

Fri, 02 Feb 2024 07:05:53 +0000

Conducting an investigation with Maltego can be instrumental in revealing hidden connections and sources related to criminal activities and the individuals involved. Your investigative work in Maltego, however accurate, represents only the initial step that requires refinement before presentation in court. Why is this so?

When presenting your findings to a prosecutor or in a legal context, it is crucial that the information is as clear and comprehensible to them as it is to you, enabling immediate and intuitive understanding.

This process involves more than just presenting your Maltego graph. You need to substantiate the data used, integrate it with other evidence gathered using different methods, and confidently support your findings in a legal setting.

In this content piece, we try to bring out some actionable practices for preparing information from Maltego Graph for your evidence report for prosecutors and explain how Maltego Search can assist you in establishing data lineage.

How to Prepare Your Maltego Graph for Presenting the Case

We will look at immediate changes you can make in your Maltego graph, how to prepare cross-references for Maltego findings, and then focus on your delivery.

Cleaning Maltego Graph

The key lies in simplifying your Maltego graph and focusing on key data connections. For this reason, it is necessary that you retain only the Entities and Links that are directly relevant to the investigation’s objective.

Ask yourself: If someone inquiries about an Entity or Link and its relevance to the case, will you be able to provide an immediate answer? By avoiding overcrowding the graph with information of little relevance to the subject at hand, you will prevent confusing the audience and diluting the impact of the findings.

Next, try grouping related Entities using the collection feature. This organizes Entities with strong connections, making it easier to identify key relationships. For example, group company officers who are under sanctions and the organizations they are linked to.

Finding all the meaningful connections in a complex graph can be quite challenging. To emphasize important relationships between different Entities, you can utilize advanced functions like Add Path.

By clicking the Add Path button, you select all the Entities that connect the two chosen Entities, making it easier to present your findings effectively.

You may also facilitate understanding for yourself, the prosecutor, and others involved in legal proceedings by using visualization techniques. In Maltego, you have features like bookmarks, link sizing, or notes at your disposal to highlight critical data connections.

Last but not least, analyzing and understanding the content of your graphs can be simplified with Layouts or Search functions. These tools enable you to grasp some information and interpret your graph better.

However, when dealing with datasets too large for each Entity to be individually evaluated, it is best to rely on Views, which are an invaluable tool for discerning the data in your graph and demonstrate it in a visually clear and logical fashion.

We have dedicated an entire blog series on using Maltego Views effectively, so be sure to familiarize yourself with these features here. Read about Maltego Views now.

Evidence

While OSINT cannot be the sole source of evidence, to build a solid case, you will need to incorporate other sources, such as public records, interviews, or documents, to support and strengthen the findings from OSINT analysis. For example, matching information on the graph with witness statements.

Additionally, you will need to cross-reference findings. In other words, connect the evidence obtained through OSINT with other sources to demonstrate how the data from different avenues converge to form a comprehensive understanding of the investigation. Maltego can really help you with that as it provides links to the source, and if they’re no longer available, historical snapshots are also accessible.

INVESTIGATOR TIP

When explaining data sources, focus on the methodology used, such as online searches or consulting public records, rather than specific Hub items or platforms. Emphasize steps taken to verify data accuracy and reliability, like cross-referencing multiple sources or conducting independent verification.

Delivery

For the narration and presentation, simplify the graph’s description by including a clear legend to clarify the meanings of various shapes, colors, and lines in the graph, especially for those unfamiliar with Maltego.

It is important to remember that your presentation should explain the significance of the graph and its implications in the broader context of the investigation. You can achieve this by providing background information and clearly articulating the relationships and connections depicted in the graph to help the audience understand the findings.

Finally, prepare for your presentation by anticipating questions from the prosecutor and readying additional information or clarifications. Before presenting the evidence, you can practice discussing the graph’s content to ensure a confident and clear delivery.

How to Verify the Legitimacy of Your Maltego Data

It is your responsibility to provide reliable evidence and to maintain transparency throughout the investigative process. This also means understanding the data you use and being able to reconstruct the connections identified in Maltego to present when requested in a legal setting.

For example, consider independently verifying your findings. Imagine a scenario where you trace a link from an email address to a username, and then to a Facebook profile, using search engines or email lookup tools for confirmation. This independent verification, when coupled with cross-referencing findings with other sources such as public records, news reports, and our internal databases improves the credibility of the data.

Let’s look at some more examples.

In your graph, Entities and Links have traceable sources. For instance, the authenticity of usernames from Alias Entities are typically sourced from social media profile URLs and can be verified by visiting the actual profiles.

Let’s take an example of Social Media Entities. When you open the Entity Property, you will be able to open and see social media account links that can be used for direct verification of data accuracy.

Geolocation Data

For geolocation data, you can rely on links to Google Maps in the Detail View, as well as location pins in social media posts that are often sourced from device GPS. However, these require cross-checking for potential alterations or spoofing.

If you rely on internal data, you can ensure that your graph indicates location accurately when importing your data by mapping location information to Entities in the initial mapping configuration.

Once you open your new graph, you will be able to select all the Location Entities and normalize them to retrieve their geolocation.

View prior to normalizing locations:

View after normalizing locations:

You will also be able to open their properties to see and present the full address, including city, country, street address, area code, and more.

This visualization and immediate insight into the properties will facilitate the clear and visual presentation of connections and location details in court.

Company Data

The company data retrieved on your graph during company investigations can be cross-referenced with official registries used by our Data Partners. These registries extensively cover officials, addresses, registration, and/or sanctions.

Find out how to equip your team with the essential intelligence all in one place, and within your budget and needs with Maltego Data Pass.

Breached Data

For data breaches, information coming from exposure data provided through our Data Partners can be corroborated with other breach notification sources or cybersecurity reports.

INVESTIGATOR TIP

The key is to prepare documentation that includes the data source, the established connections, and any independent verification conducted. Among the data provided to the court are also the results of the subpoenas sent to online service providers to verify the data of the accounts or their activity and to ensure that variables such as time match with the crime committed. By preparing this documentation, you will provide a transparent and accountable record of the investigation’s trajectory, ensuring that the case is robust and legally sound.

How to Use Maltego Search for Presenting Data Lineage

Tracing back through a data’s lifecycle to its source helps understand its journey and identify information relevant to a given investigation. This is why data lineage is critical when it comes to managing digital evidence, as it establishes the origin of each data point.

While Maltego graphs and supplementary materials are useful for outlining data lineage, leveraging the browser-based Maltego Search offers another approach.

Each result from Maltego Search comes with a clear data lineage, detailing how the original search input led to the specific result. This includes the types of data queried and the data sources used. If the same data connection is identified through multiple data sources, multiple lineages will be presented to indicate their relevance.

Let’s consider a sample search in Maltego Search where we start by looking up an email address of our person of interest.

Similar to the Maltego Graph, Maltego Search maps the personal profile of the target by querying data from sources like social media, the dark web, breached databases, and identity databases integrated with the Maltego Data Hub.

Instead of presenting the data query results in a graph view, Maltego Search lists out the results in various categories, which helps users skim through the initial findings before pivoting further.

To discover the data lineage of each query result, we simply click on the returned piece of information to view its Entity Details, which stores information about its origin data source.

Sometimes, a piece of information has multiple data lineage, meaning that the same data connection is discovered in multiple data sources.

The Properties view also allows you to cross-check or verify the retrieved information outside the tool. You can also click open an image of the target from their social media accounts discovered by Maltego Search to verify whether the accounts are relevant.

It’s important to note that, while Maltego Search is designed to protect your operational security, you must employ the necessary operational security measures when visiting these external links.

It is also possible to export your findings in Maltego Search to visualize their data connections in your Maltego Graph or display the information using the web viewer option in your browser.

Here’s how the same information from Maltego Search is visualized on a graph in the web viewer – an example that you can include in your report.

Conclusion

The effective use of the Maltego platform, which comprises Maltego Graph, Maltego Search, and other capabilities, requires not only identifying critical data but also being prepared to explain its relevance and reliability to the investigation in a legal setting.

In this article, we have provided a set of recommendations and key points to keep in mind when preparing your report for the prosecutor. If you have doubts about your findings in Maltego and would like to request expert advice, you can always reach out to us directly or through your Customer Success Manager.

For more information on the Maltego Search or other Maltego capabilities, click below to access our demo and contact us.

EXPLORE MALTEGO SEARCH

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, or sign up to our email newsletter to stay updated on the industry insights and Maltego updates we regularly share with our community.

Happy investigating!

About the Author

Daphnée Aguilar

Fighting Ban Evasion with Maltego

Mon, 22 Jan 2024 06:06:41 +0000

Ban evasion has been affecting businesses since the first online platforms and digital products were launched, and it shows no signs of diminishing. In addition to undermining the integrity and enforceability of a platform’s rules and policies, ban evasion contributes to a less secure and less trustworthy environment for users and advertisers alike.

But are all industries equally affected and vulnerable? How can ineffective handling of ban evasion impact your business, and what are effective strategies to combat ban evaders? Finally, how does Maltego help in tackling ban evasion? These are some of the questions we will explore in this article.

Industries Particularly Affected by Ban Evasion

Ban evasion occurs when individuals or organizations bypass restrictions meant to block them from a platform or service. Banning users and restricting the use of a platform’s services through multiple accounts is often used as a tool by platforms to prevent product abuse. At times, this may involve egregious violations such as spreading illegal content, while at other times, it may be due to violations of policies like signing up for multiple accounts or abusing promotions and coupons.

Ban evasion is a problem across various sectors, but it mostly affects three areas: social media platforms, online sales, and financial services.

Here are typical examples of how ban evasion manifests in these industries:

1. Social Media Platforms

Banned users often create new accounts using alternate login credentials, especially if they were previously banned for reasons like spreading hate speech or misinformation.

They commonly use VPNs or proxy servers to alter their IP addresses and evade detection, enabling them to set up new accounts. There may be situations when platforms ban a range of IP addresses or unique network identifiers when there is known suspicious activity such as bot networks.

Some users may also resort to tweaking their personal information, such as altering their names, dates of birth, or even profile pictures, as a means to slip past detection measures and continue using the platform.

2. Online Sales

Similarly, sellers whose accounts were banned for fraudulent activities or selling counterfeit products often return to the same platforms by creating new user profiles. There are those who go to the extent of managing multiple accounts under various aliases, effectively dodging detection.

They frequently change their contact and payment information and even their physical addresses. Some sellers also employ IP-masking tools and services to further obscure their activities.

There’s also a tendency to engage in feedback manipulation, where sellers create fake buyer accounts to purchase their own products, deceitfully boosting their review scores. This manipulation can easily mislead genuine buyers who often trust these ratings, leading them to believe in a falsely earned reputation on the platform.

3. Financial Services

Within the financial services sector, ban evasion takes on a more complex form. Individuals or companies previously banned for fraudulent activities might attempt to access services again under different business names. This tactic is particularly prevalent among those who are currently under sanctions.

Ban evaders are also known for creating and using shell companies to open new accounts or carry out transactions. Through this practice, they manage to conceal the identities of the actual account holders who have been banned.

Lastly, legitimate accounts are sometimes hijacked through identity theft or social engineering, which are then used to circumvent personal bans. These strategies highlight the extent to which individuals or entire organizations will go to bypass restrictions in the financial sector.

If you have observed instances of ban evasion on your product or platform, you can use your internal data in Maltego to prevent new ban evaders or tackle existing ones. You will find out how to do this in the final section of this article. Click the button below to discover the steps now.

FIGHT BAN EVASION NOW

Impact of Ban Evasion on Your Business and Platform

The effects of mishandling ban evasion or failing to act decisively can be broadly categorized into two main areas: platform health and business impact.

Platform Health

Influx of Inappropriate Content: When ban evaders return, they often bring along content that violates platform guidelines. From mildly offensive to outright illegal material, this content compromises the integrity and safety of the platform.
Loss of Trust: If harmful activity continues and inappropriate content circulates on the platform, user trust erodes, a value that is difficult to restore.

Business Impact

Decline in Genuine User Engagement: A drop in activity from genuine users as a result of the unpleasant environment created by the continuous harmful activity and fake or inappropriate content. This decline in engagement can also lead to a decrease in valuable user-generated content.
Increased Incidence of Fraud: Particularly in online sales and the financial sector, ban evasion may lead to a rise in fraudulent activities and direct financial losses. For example, online sales platforms may suffer from fraudulent transactions, while financial services might face unauthorized access to sensitive financial data.
Legal and Regulatory Consequences: In the heavily regulated financial sector, failure to effectively manage ban evasion can lead to hefty fines and legal compliance issues. Non-compliance with regulatory standards can tarnish the reputation of the institution and lead to long-term trust issues with clients and regulators.
Loss of Advertisement Revenue: Advertisers prefer to associate their brand with safe and reputable platforms. If a platform is perceived as poorly managed or unsafe, advertisers may pull out and cause losses in revenue.

Strategies to Fight Ban Evaders

The two most impactful strategies your team can follow to fight ban evaders are:

User Data Analysis

As part of the sign-up and access process, platforms collect the identity data of users as well as other data such as browser-agent data, IP addresses, device identifiers, and unique cookies. These data points allow platforms to make inferences about ban evaders who change some of these characteristics to bypass registration controls.

Even seemingly uninteresting data, such as account creation time, can help make these inferences. For example, analyzing the time elapsed between a ban and the creation of a new account can provide insights. However, in thousands of lines of records, it is often not straightforward to make connections. In the demo example presented below, we will show how to address this challenge in Maltego, using the different user data points just explained.

Manual or Automated Pattern Analysis

Through manual investigative work in more advanced and complicated cases, platforms employ user reviews not just on their platform but on the same actor’s behavior across other accounts as well, to identify whether they are ban evaders.

In doing this, platforms often use techniques such as social network analysis to identify intersecting connections, reposting the same or similar content, causing coordinated harm, and other. Platforms also focus on looking for violations of the policy for which a user was banned in the first place.

Steps in Fighting Ban Evasion with Maltego

To put these strategies into practice, and even automate some parts for better and quicker response, your team can investigate ban evaders in Maltego.

Your first step would be to import internal data directly into Maltego where you will be able to visualize networks and look for connections between ban evaders on your graph.

To find out how to create your first Maltego graph, check out this step-by-step guide on our blog.

In fighting ban evaders, one of the ways of combatting ban evasion effectively is to figure out the real identity behind the person setting up the accounts or discern a common pattern of behavior. Maltego enables investigators to do so with its access to reputable breach data and dark web investigative capabilities, all done in a safe and anonymous environment.

To understand the steps needed, we will now mimic a potential platform and ban evaders to illustrate a short investigation in Maltego. For the convenience of referencing our example, we will name this fictitious platform ‘XYZ.’ We will use canned data and a set of custom Transforms that you can easily build within the tool to show you how it all looks and gets connected.

Check the Maltego documentation to learn how to import data into and export data from Maltego, and generate reports.

To understand the steps needed, we will now fabricate a potential platform and ban evaders to illustrate a short investigation in Maltego.

Maltego in Practice

As the first step, we will paste a number of accounts from our internal database. These are accounts that recently signed up to the XYZ platform. Our aim is to investigate them to see whether and how they are connected.

We will run a local Transform To user [BannedUser], specifically designed for this investigation. It will retrieve User Entities on the XYZ platform that come from the previously imported database. This will be the first step towards visualizing static data points in a graph.

Learn how to write your Maltego integrations to fully customize your investigations.

What all the User Entities have in common are logins, or in other words, records indicating the details of when they logged in, on what device, using which browser, or even the operating system. This is precisely the kind of data we want to extract.

The custom To login [BannedUser] Transform populated our graph with numerous logins, or in other words, records of every time a user has logged in.

Every application or platform keeps track of this data, and you can take advantage of it in investigations like this one.

Depending on the range of results you have initially set up, your graph will display from a few login data points to hundreds of logins.

Once you open the Login Entity in your Maltego, you will see, among other things, information about the device language, time of login, device type, login IP, login ID, browser, operating system, and screen resolution – all valuable data points that will help us determine whether these accounts are connected.

INVESTIGATOR TIP:

If you find a list of users with the same properties, but who, for example, logged in 2 minutes after they were banned from a different account, this gives you a good reason to assume they’re connected, and you should investigate further. That is an interesting direction to take but also difficult to execute if you can only rely on manual means.

However, we do not want to spend hours combing through the data and opening each login, as this would take time and, in the meantime, the ban evaders might be causing more damage. For this reason, Maltego provides the advantage of selecting all the data points and searching through them automatically using dedicated custom Transforms.

For this investigation, we will run the To Device ID Transform, and see how these different Login Entities are connected.

You can observe that Maltego retrieved a unique hash connected to over 250 Login Entities. This means that all these users connect from the same device, a strong indicator that you are dealing with the same individual.

Maltego Use Cases for Protecting Your Brand and Product Integrity

Fighting ban evasion is just one of the many use cases that Maltego can serve. It’s a pre-built tool used by analysts from teams like Risk Management, Fraud Detection, Digital Security, and Trust and Safety that deal with:

DOWNLOAD PRODUCT BRIEF

As each platform and product is different, the challenges faced by fraud and security teams also vary. However, the core use of Maltego remains the same: accelerating and simplifying investigations through link analysis with easy internal and external data integrations.

Without Maltego, it would take much longer to conduct investigations, and the chances of following the wrong leads would increase drastically. Essentially, Maltego displays only what is relevant. Instead of stifling through mountains of data, the data relationships are painted on the Maltego graph. With the time saved, we can investigate deeper into the assets and currency laundering before the assets actually land in the players’ wallets.

Maksym Gryshchenko

CCP Games Security Team

If you want to discover a real-life story of how one security team used Maltego to suspend over 90,000 malicious user accounts, check out our case study below. You will learn how the CCP Games company deployed Maltego to become the go-to tool they use to detect and identify in-game fraud.

You can download your free copy now:

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

On our blog, you can also read more about product and platform abuse or check out how to further automate your investigations by using Maltego Machines with our step-by-step guide.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

Investigating the Threatscape of Incel Community

Wed, 17 Jan 2024 09:00:42 +0000

In the evolving landscape of modern societies grappling with climate change, terrorism, and cyberattacks, the most significant challenge we face is adapting to a rapidly growing information ecosystem, largely driven by the internet and social media networks.

Especially in the digital information sphere, the message can be easily amplified or modulated, leading to a dangerous influence that may manipulate simple opinions into facts. Disinformation and misinformation have become increasingly significant issues, causing greater polarization in our democracies and fueling the radicalization of individuals.

Who benefits from this chaotic landscape? Extremist groups seem to be seizing the chance, exploiting the widespread misinformation to radicalize individuals with ideologies. With its vast and intricate network, the internet is not only a medium for communication but a breeding ground for radical ideologies.

In this whitepaper, we will map out the digital footprint, comprehensive networks, strategies, and operational methods of one of these extremist groups called “Involuntary celibates (Incels)” who believe they are entitled to a relationship with a woman, but they are incapable of finding a partner. Multiple acts of extreme violence and even murder have been attributed to this group.

To gain a better understanding of incels, there are two highly recommended resources to explore:

Before we explore this group, let’s first understand the discipline of threat assessment.

What is Threat Assessment?

Threat assessment is the practice of determining the credibility and seriousness of a potential threat, such as the one posed by extremist groups, as well as the likelihood of these threats becoming reality. According to J. Reid Meloy, Ph.D., the discipline…

…aims to interrupt people on a pathway to commit predatory or instrumental violence, the type of behaviour associated with targeted attacks”

J.Reid Meloy, Ph.D., co-editor of International Handbook of Threat Assessment (2013)

Threat assessment comprises the following key components:

Identification: Identifying threats to commit a potentially unfavorable act
Assessment: Determining the seriousness of the threat
Management: Developing intervention plans to address the underlying issue
Follow-up: Continuous assessment and Safety Planning

Investigate Involuntary Celibates (Incels)

In this whitepaper, we provide a detailed exploration of the world of incels, offering insights into how to assess the threat landscape and identify their networks, infrastructure, and operational methods using Maltego.

For the demo, we used Maltego Data Pass: Person of Interest along with several Transforms to investigate the community’s dynamics:

Disclaimer: The information gathered in this investigation may vary from current online findings, given that online threats and related information are subject to change.

Understanding and dismantling these networks is a critical step in protecting vulnerable individuals from radicalization and preventing acts of violence and hate inspired by such radical groups. This information is invaluable, especially for law enforcement agencies, governmental bodies, and other organizations, such as anti-hate NGOs in developing targeted strategies to counteract and prevent the incidents.

Download this whitepaper about counteracting radicalization and the spread of extremist groups and learn how to conduct your own threat assessment now!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon or subscribe to our email newsletter for more whitepapers, case studies, and investigation tips like this!

Happy investigating!

About the Author

Carlos Fragoso

Hunting Phishing Sites in the Festive Season with Maltego

Wed, 20 Dec 2023 01:00:00 +0000

In November 2023, amid the bustling holiday sales, with buyers eagerly clicking on Black Friday discounts and Cyber Monday specials, phishing incidents saw a staggering 237% increase in the first half of the month, compared to the period between September and October.

This article will analyze why and how attackers use phishing and how you can use Maltego to detect and investigate the malicious infrastructure behind these attacks.

Source: Statista

In addition to a skyrocketing surge in phishing incidents, we have seen a dramatic increase in new phishing sites in recent years, especially around significant events such as after the COVID-19 pandemic or during the holiday season.

Attackers exploit the eagerness for deals and the season’s general chaos around these events to increase their campaigns’ success rate. It is estimated that 90% of successful cyber-attacks start with phishing.

What Companies Should Know about Phishing

By now, most of us are familiar with spam – those unsolicited commercial emails companies send, pushing their products or services. But hidden among those annoying emails lies a more sinister type of communication: phishing emails.

Between May 2022 and May 2023, Cloudflare detected over 250 million suspicious emails, that’s more than 700 thousand emails, like the one below, flooding our inboxes daily.

Source: Cloudflare

This is important because responding to and mitigating the effects of phishing attacks requires significant resources. Cybersecurity teams are already swamped with thousands of alerts daily, so they must be especially vigilant and prepared to deal with an increased volume of potential threats during the holiday season to protect their organization and its assets.

How Phishing Works

Unlike straightforward spam, phishing emails are crafted with the intent to deceive through identity impersonation. This method of attack isn’t limited to just emails, it also occurs through other channels such as text messages via SMS or messaging platforms like WhatsApp.

These messages often create a sense of urgency or invoke fear - such as a warning about an unauthorized login attempt on your bank account or an incredible deal that expires soon. They might also include requests for a delivery address or to update your data immediately. By pushing the recipient into hasty action, the attacker hopes to bypass rational scrutiny.

Attackers generally use phishing to:

Acquire personal identity or financial information
Acquire login credentials to certain services or systems
Acquire confidential business intelligence or internal data
Acquire control over compromised computers or network systems

You can read more about phishing in our article “Phishing Attacks Part 1: What You Should Know About Phishing Activities.”

Common Techniques in Online Frauds

The typical Tactics, Techniques, and Procedures (TTPs) used by attackers in online frauds, especially during high-traffic shopping events like Black Friday and Cyber Monday, can be sophisticated and varied.

These threat actors frequently resort to proven techniques such as cloning legitimate websites of well-known brands and waiting until the last minute to register their domains to avoid detection. Let’s talk about these commonly used TTPs in phishing.

Cloned websites

One of the most common and successful techniques attackers use is the impersonation of legitimate brands or websites. According to Proofpoint’s 2023 State of The Phish report, 44% of people think an email is safe if it comes from a familiar brand, which is why threat actors love this technique.

Source: KnowBe4

Attackers clone and host fake instances of legitimate websites to trick their victims and harvest personally identifiable information (PII), credentials, and banking details. This data is then sold on dark web forums or leveraged to launch social engineering attacks.

Newly Registered Domains

According to Cloudflare’s 2023 Phishing Threats Report, one-third of detected threats featured newly registered domains. These domains usually resemble legitimate brands like Amazon to trick their victims.

Generally, most phishing domains, especially those themed around events like Black Friday, are registered within 24 hours of the event to avoid detection.

INVESTIGATOR INSIGHT

In order to test this, we can perform a review searching for registered. domains that contained keywords like Amazon, (black+friday), and (cyber+monday). 3 million new domains can be found between November 1st and November 30th.

An important spike in domain registrations within 24 hours of Black Friday and Cyber Monday was found, confirming our mentioned hypothesis.

We can also observe that the registrations drop back to zero immediately after the events. These results underscore the vigilance and preparedness of cybersecurity teams during this season, emphasizing their crucial role in maintaining security amidst these trends.

Using Maltego to Find Phishing Domains

Maltego already has great articles describing how to investigate phishing domains. Building on this, we will illustrate how to use Maltego to identify suspicious domains while filtering irrelevant data. Additionally, we will show you how to get a fresh list of interesting domains using urlscan.io, a free service to scan and analyze suspicious URLs.

Urlscan.io allows you to search for domains, IP addresses, hashes, filenames, and more. It also offers multiple filters to help you achieve the best results, which we will take advantage of.

Our goal is to find domains that mention Amazon in their name but are not related to standard Amazon domains like amazon[.]com or amazonaws[.]com. Considering this data source has a rich query syntax, we can use the following one to get what we are looking for.

page.domain:(/.*amazon.*/ AND NOT *amazon.com AND NOT *amazonaws.com)

Some interesting domains like amazone[.]am can be easily spotted, and a few that might be legitimate Amazon domains like amazon[.]in or amazon[.]it Don’t worry, we can use Maltego to find the bad ones. In fact, we don’t need to go to urlscan’s website at all, as we can get the same results directly in Maltego.

All you need to do is add a Phrase Entity to a new graph in Maltego, paste the same query we have just used on urlscan’s website, and then run the Search in Other Scans [urlscan.io] Transform.

Keep in mind to adjust the Results slider depending on the number of maximum hits you want to manage, by default Maltego returns 256 urlscan Result Entities.

These types of Entities contain a lot of useful information like the URL, the website title, and the geolocation of the website.

Now, we need to extract the URL from the properties to continue our investigation. Let’s select all the urlscan Result Entities and run the Extract Submitted URL [urlscan.io] Transform.

We can immediately observe some legitimate sites between the suspicious URLs. A few of these might be associated with the same website. We can run the To Website [Convert] Transform to group URLs into their main site to find those connections.

Phishing domains tend to use the name of the legitimate site they are impersonating or use keywords like login, access, billing, and account, so a couple of sites immediately stand out from the results. A quick search for those keywords returned the following results.

Let’s check when these were registered. Phishing domains have a short lifespan, so if any of these were recently registered, that would increase the chances of these being used for malicious purposes.

First, we need to extract the domain connected to the URLs. Let’s run the To Domains [within Properties] Transform on the URL Entities.

Then, run the To WHOIS Records [WhoisXML] Transform to extract the latest WHOIS records for each domain.

As we suspected, most of these were recently registered. Let’s check the information for one by double-clicking a WHOIS Record Entity.

We can see this one was registered just a few days ago, and I’m pretty sure Jeff would not ask someone named Johnny Bobby to register its domains but use corporate legal names for this. This domain has all the red flags of an actual phishing domain, but I will let you confirm that.

Here’s a guide extracted from the Phishing Attacks Part 2: Investigating Phishing Domains article to help you with the next steps.

In case you want to deep-dive to find the scope of this threat, historical information can be used. We can continue by using the To Historical WHOIS Records [WhoisXML] Transform to extract the email used to register the investigated domain.

This freshly found email can be now extremely useful to search other domains registered by the same identity through the dtEmail2HistoricDomains Transform available from our partner DomainTools:

It looks like Amazon was not the only target (Netflix, UPS, amongst others) of our “friend” Johnny Bobby. ;)

I hope you found this guide useful, and if you decide to follow along, please share your graphs with us on social media and tag @MaltegoHQ and @MarioRojasChin with the #madewithmaltego and #phishing hashtags.

Conclusion

Phishing attacks typically operate on a large scale, with threat actors launching multiple operations under the guise of legitimate websites to entrap as many individuals as possible. In this context, the urgency to preemptively detect and neutralize phishing domains cannot be overstated. The key to thwarting these threats is identifying phishing domains before attackers exploit them against unsuspecting users.

To actively track down a potential cybersecurity threat and gain insight into its network, tools like Maltego can be instrumental. Maltego enables us to uncover and analyze these fraudulent domains efficiently. By leveraging Maltego’s extensive list of integrations, we can stay ahead of cybercriminals. Remember, in the battle against phishing, proactive defense isn’t just a strategy – it’s our most robust line of defense.

Stay informed and connected with us on Twitter, LinkedIn, and Mastodon, and sign up for our email newsletter, so you never miss any updates and news!

Happy Hunting!

About the Author

Mario Rojas

Fighting Resale of Counterfeit Goods Using OSINT and Maltego

Thu, 07 Dec 2023 09:23:04 +0000

The online marketplace has opened up possibilities for consumers to easily purchase goods and take advantage of the best deals they find online. A popular trend includes influencers on prominent social media platforms promoting luxury goods and other products with enticing discounts.

Often, people are naturally excited to take advantage of these promotions without fully considering the potential consequences for themselves and the market. Sometimes, knowingly or unknowingly, what they assume to be a good deal is, in fact, a successful attempt at marketing a counterfeit product.

In this article, we will discuss the consequences of the illegal resale of counterfeit goods for companies and users, the difficulties investigators face in probing these activities, and demonstrate how you can use Maltego to protect your goods effectively.

The Scale of the Counterfeit Market in Numbers

A report by Visual Capitalist reveals that over 25% of consumers have inadvertently purchased non-genuine products online, while the U.S. Government Accountability Office study found that around 43% of brand-name items bought through third-party online retailers were counterfeit.

The economic repercussions for companies and brands are immense. The National Association of Manufacturers reports that counterfeit products account for 3.3% of global merchandise trade, costing the U.S. economy about $131 billion and 325,000 jobs in 2019 alone. At the same time, The Guardian estimates that up to 10% of all branded goods sold could be counterfeit.

Source: OECD

Want to start investigating counterfeiters right away? Download your free cheat sheet with step-by-step guidance and replicate the workflow in your Maltego now.

DOWNLOAD CHEAT SHEET

Consequences for Users and Businesses

Counterfeiting impacts both the manufacturing and services industries, affecting sectors such as luxury goods, pharmaceuticals, and electronics.

While it may seem that counterfeiting only causes minor economic harm through the sale of inferior quality products and primarily affects big businesses, this illicit practice may pose significant risks to consumer health and safety due to the lack of quality and safety standards in counterfeit products, such as drugs.

For businesses, counterfeits siphon off market share, revenue, and profits from legitimate businesses and can erode consumer trust in authentic brands, as consumers may associate the inferior quality of counterfeit items with the genuine brands.

Finally, the counterfeit market is frequently intertwined with organized crime, with profits potentially fueling other illegal activities such as drug trafficking and money laundering.

Watch the webinar to see step-by-step how you can protect your products from illegal resellers with Maltego.

Challenges and Solutions When Combatting Counterfeit Sales

Even though combatting the sale of counterfeit goods seems straightforward (identify the goods, reduce the search scope, and identify the sellers) the reality is more complex.

Let’s look at the associated problems of the usual workflow for combatting counterfeiting and what Maltego can do for you to solve these problems.

Discovery of Counterfeiters

Problem:

Counterfeiters constantly evolve their methods. They change sales strategies, utilize various platforms, and alter product marketing. The discovery of counterfeit products and their sellers is dynamic; they might directly approach potential buyers or use their influence on social media.

Solution:

Investigators can rely on gathering all possible intelligence on where and how goods and services that are counterfeit are being sold. At the same time, they study their own data to identify networks and connections.
Maltego makes it easier for investigators to connect and analyze data from open sources, internal databases, and even the deep and dark web in real-time. This facilitates the visualization of data relationships, assisting investigators in uncovering and mapping out the digital trails left by counterfeiters, including those left on social media profiles and closed groups.

Different Types of Pivot Points

Problem:

Investigative breadcrumbs could be a seller’s online post, a phone number, an email address, or even just a social media handle. Working without a unified tool makes tracking and reporting these diverse pivot points challenging.

Solution:

A unified interface that aggregates data from different databases can streamline the collection and analysis of various pivot points, enabling investigations to be scaled up without adding to the investigators’ workload.
Maltego allows investigators to start their search from various entry points – be it a username, email, image, location, or phone number – and analyze them in a unified interface. This integration simplifies the process and ensures efficient tracking and reporting.

Language Constraints

Problem:

Investigators often encounter language barriers. Counterfeiters use various languages and specific jargon or slang, making it challenging for those unfamiliar with the language.

Solution:

To overcome these barriers, investigators opt for translation tools and machine learning solutions to analyze language, identify key patterns, and decode complex jargon.
Maltego addresses this challenge by providing translation Transforms within the tool and the option to add notes, aiding investigators in overcoming language barriers and ensuring efficient collaboration among team members.

Time-Consuming Repetitive Tasks

Problem:

OSINT investigations can be time-consuming, filled with repetitive tasks like searching for specific keywords, images, and pivot points. Each discovery, such as a phone number or email, requires a specific response, adding to the workload.

Solution:

This process can be streamlined by developing ready-made workflows. This will involve mapping out an investigation process, identifying areas with repetitive tasks, and then simplifying or automating these steps.
In Maltego, investigators can use the so-called Maltego Machines to automate patterns of Transforms run on a regular basis in a set sequence, mirroring their manual operation.

Read this guide to find out how to speed up repetitive steps in brand protection investigations with custom Maltego Machines.

Unveiling Online Counterfeit Threats with Maltego

Investigating unauthorized sales by digital and offline resellers is challenging not only for the reasons previously mentioned but also because illicit sellers adeptly blend into popular e-commerce and social media platforms, marketing counterfeit goods alongside legitimate ones. This complexity complicates identification and intervention.

By using keywords or images of illicit goods, investigators can use Maltego to map out networks of companies and individuals involved in counterfeit goods resale, aiding in the development of effective counter-strategies. Let’s see two ready workflows you can follow.

One method to identify illegal resellers using Maltego, especially when you have no initial suspects, is by utilizing common keywords associated with the sale of illegal goods.

INVESTIGATOR INSIGHT: Using this workflow, your approach to identifying illegal resellers will be more targeted, especially when initial suspects are unknown. This method capitalizes on pattern recognition and the commonly used terminology in the counterfeit market.

STEP 1

As a starting point, you can employ the Google Dorking search operator site: along with keywords like your company or product name plus some terms that are commonly used among illegal resellers, such as ‘first copy’, ‘duplicate’, ‘replica’, or ‘knockoff’, to refine your search. Alternatively, you could also try variations in the spelling of the brand or product name.

This approach often returns a list of websites, including social media posts, where these keywords are used.

Google dorks are useful tools that can significantly improve your corporate and fraud investigations. Download the full list of useful Google search operators for OSINT investigators.

STEP 2

From these URLs, Maltego’s Transforms can be used to extract various Entities such as usernames, phone numbers, and email addresses found on those websites. These details can lead to other related social media profiles.

STEP 3

Further investigation can reveal additional information about locations and accounts associated with these profiles. This information is crucial for conducting investigations into persons of interest or companies, helping to gauge the extent of the problem and gather sufficient data for reporting to relevant social media platforms or for initiating legal action.

STEP 4

Investigators can also use discovered phone numbers or email addresses as starting points, checking them against breach data within Maltego to build a holistic picture of a subject’s online presence and measure the extent of their potentially illegal activities. This includes locations, contact numbers, emails, names of individuals, associated companies, and more.

Watch the webinar to see the step-by-step demo of this investigation run by our Subject Matter Experts and learn how to recreate it in your Maltego Client.

Fraud analysts can also identify illegal resellers of counterfeit goods by analyzing images of counterfeit products that they post on social media platforms, such as Instagram or TikTok, and their websites.

INVESTIGATOR INSIGHT: As investigators, you might find images of products that are not the stock images used by the brand for advertising. Instead, these images could show the counterfeit products being held by the seller or placed in a unique setting. For instance, consider a product seen on popular e-commerce websites that are drop-shipped from a seller in another country. If you search using the images from the e-commerce site, there’s a chance you might find the original seller or the network using the same product.

STEP 1

The investigation begins by extracting posts and images from a single social media profile. For example, an Instagram account with numerous images of products promoted for sale by an unauthorized reseller.

STEP 2

Focusing on one of the extracted images, this image serves as the starting point for analysis in Maltego. It allows analysts to pivot to other websites where the image is posted, helping to assess the extent of the counterfeit goods’ availability.

STEP 3

A quick search will yield a list of websites advertising the product from the original image for sale, providing substantial results for fraud analysts.

In Maltego, it’s also possible to delve deeper to determine if any of these websites are linked to additional counterfeit sites or to each other.

STEP 4

By exploring relationships between these websites, investigators may find, for example, IP addresses, Google Analytics tags, and other indicators on their graph, offering further avenues for investigation.

Watch the webinar to see the step-by-step demo of this investigation run by our Subject Matter Experts and learn how to recreate it in your Maltego Client.

This workflow, like many other repetitive tasks, can be easily automated using Maltego Machines. To learn how to create your own custom Machines, which, for example, can help identify individuals and networks associated with counterfeit goods sold online using a single image as your input Entity, check out our guidebook. It provides detailed instructions on building your custom Machine and integrating it into your daily investigations.

Access Your Free Resources

If you’re interested in starting investigations on counterfeiters using Maltego, or if you want an in-depth overview of a sample investigation, remember to download your copy of the cheat sheet with a ready workflow.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

For a more interactive learning experience, watch a webinar recording featuring Maltego’s subject matter experts. They delve deeper into combating counterfeit goods, demonstrating the workflows mentioned in this article. Each step is explained in detail, focusing on key aspects to consider and outlining the next steps in your investigation.

WATCH RECORDING NOW

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy Investigating!

Staying Anonymous During Your Investigation with Maltego

Fri, 01 Dec 2023 08:28:47 +0000

Anonymity is not a choice for investigators – it’s a necessity. The reasons extend far beyond personal safety and weave into the very fabric of successful investigative work.

In this guide, we focus on the dangers of exposure when investigating fraud or conducting corporate investigations for the investigators, the company they work for, the clients they serve, and the success of their investigations.

In the later part, we will share a cheat sheet that outlines the measures that each investigator should take to protect themselves and their organization when using OSINT and explain how Maltego can help maintain anonymity throughout the entire operation.

Consequences of Data Exposure on the Entire Operation

The internet never forgets, and retracting shared information is practically impossible. Compromising an investigator’s identity or revealing that a target is under scrutiny can affect operations that could be ongoing for weeks or months.

The Domino Effect of Exposure

When adversaries become aware they are being monitored, their responses can lead to serious consequences.

Evidence Tampering and Loss

When bad actors realize their activities or accounts are under scrutiny, their immediate reaction often involves erasing their digital footprints. This can range from deleting incriminating accounts and information to moving their operations to more underground or obscure online spaces, or even offline. This hampers investigations and risks the loss of crucial evidence, particularly if it hasn’t been adequately preserved through downloads, screenshots, or other means.

Physical Threats to Investigators

Beyond digital threats, there have been doxing incidents targeting employees involved in fraud management, brand investigations, and similar fields.

Compromised Company Security

Engaging with websites or sources riddled with malware or other privacy-intrusive technology without adequate precautions can lead to the compromise of sensitive company data. This not only affects the investigative team, but also jeopardizes the security of the company’s entire infrastructure and its clients or partners.

There are tried-and-true measures you can take to maintain anonymity at each stage of your investigation. Download your cheat sheet with do’s and don’ts for every investigator now.

DOWNLOAD YOUR CHEAT SHEET

Common Data Exposure Scenarios You Should Avoid

Investigating the roots of data exposure reveals a mix of factors stemming from an inadequate toolkit, insufficient policies and best practices, and a lack of training or awareness. Even simple complacency, leading to sloppy habits and time pressure, can contribute to these vulnerabilities.

Each of these elements, in isolation or combined, can inadvertently open the door to exposing your identity or revealing information about your company. Let’s look at some examples.

Social Media Oversights:

Scenario: Inadvertently alerting the person of interest when investigating them on social media.
Cause: Using a personal or easily traceable account instead of a carefully managed sock puppet account.
Example: Viewing a person of interest’s profile on platforms that notify users of profile visits can lead to exposure or accidental interactions like following or liking a post can raise alarms.

Find out how to carry out your person of interest investigations with Maltego with this step-by-step video guide, and download your cheat sheet for a person of interest workflow.

Web Browsing Vulnerabilities:

Scenario: Accessing unknown websites. A mere URL access can reveal an investigator’s IP address and other digital footprints.
Cause: Insufficient use of secure browsing tools and techniques that leads to exposure of device ID, system name, geolocation, and browser details.
Example: Without proper safeguards, visiting a new forum or website might result in cookies tracking the investigator.

Process and Technology Gaps:

Scenario: Inadequate processes and technology used that create vulnerabilities during investigations.
Cause: Lack of proper protocols for new or unfamiliar digital environments can lead investigators to improvise, increasing the risk of exposure.
Example: Encountering a new type of online platform without a predefined approach can lead to insecure browsing practices.

Human Error and Complacency:

Scenario: Common investigator lapses or oversights.
Cause: Complacency, time pressure, or lack of awareness can result in careless actions.
Example: Liking an old photo of a target, even using a sock puppet account that signals to the target that they are under surveillance.

INVESTIGATOR TIP: With Maltego, you remain anonymous at all times, and there is no need to set up a sock puppet since Maltego acts as a proxy. This ensures your identity is protected at every stage. For high-profile investigations, you can use a stealth mode that completely restricts the desktop client from downloading data or information directly from the internet. We will explain this in the later part of this article.

PROTECT YOUR IDENTITY WITH MALTEGO NOW

Do’s and Don’ts for Every OSINT Investigator to Maintain Anonymity

To avoid those compromising situations, fraud and threat analysts can adopt several reliable measures. Here’s just a couple of do’s and don’ts for you:

Do This When You Run an Investigation

Align Research Timing with the Target’s Time Zone: Conduct your investigations during the target’s local working hours (such as 9 am to 5 pm) to blend in and avoid raising suspicion.
Operate on Secure Networks: Always work on secure, trusted networks. Avoid public Wi-Fi networks where your traffic can be intercepted. This is especially important in the era of remote work.
Carefully Select OSINT Tools: Choose open-source intelligence tools that are known for their reliability and security to reduce the risk of exposing your digital footprint.
Use a Paid VPN for Web Research: Employ a reputable Virtual Private Network (VPN) to mask your IP address, especially when researching websites. This step is crucial to prevent website owners, including potential targets, from tracking your visit back to you.

Don’t Do This When You Run an Investigation

Ignore Time Zone Differences: Avoid conducting research at times that would seem unusual or suspicious in the target’s local time zone.
Mix Personal and Work Devices: Keep your personal devices separate from the ones you use for investigations.
Use Unverified OSINT Tools: Steer clear of tools without a strong reputation for security, as this can lead to data leaks or digital footprint exposure.
Rely on Free VPNs or Skip VPN Usage: If possible, don’t ever run an investigation without a VPN as this can leave your IP address exposed to website owners and potential targets, especially during website investigations. Ideally, you should also avoid free VPNs as they are easier to spot and might alert your target that someone trying to obscure their location is investigating them.

These tips are just a few key examples of how you can maintain your anonymity during an investigation. We have prepared a separate 4-page-long cheat sheet with do’s and don’ts for you, which is tailored to every investigator. Make sure to download your free copy and share it with your team!

DOWNLOAD YOUR CHEAT SHEET

Conduct Investigations Securely with Maltego

In your quest to maintain full anonymity, you may choose to restrict your investigation to a single platform that can support you in avoiding the common exposure scenarios we described earlier. With Maltego, you can address the need for anonymity through several essential features.

Secure Environment for OSINT Investigations

Maltego allows investigators to probe social media profiles and online content without creating sock puppet accounts or risking exposure through personal accounts. It does this by querying platforms and aggregating the data in a secure sandbox environment.

This setup enables investigators to analyze content, such as translating posts or extracting images, without directly opening someone’s profile and webpages on a browser.

Transform Queries and Data Privacy

While investigating with Maltego, you will retrieve results from a given start or pivot point using the so-called Transforms to discover new connections that will help you carry out the next step in your investigation.

As you deal with sensitive cases and use internal data, the tool does not store details of the user’s Transform queries, ensuring that the investigator’s identifiable information remains concealed during data mining from public OSINT sources or online intelligence databases.

Privacy Modes

If you wish to take even more precautions, you can go one step further and switch between the two privacy modes in Maltego:

Normal Mode: In this mode, the Maltego Desktop Client can fetch certain data types directly from the internet. While generally safe, this method might expose the user’s IP address in the target’s traffic log, which could be a concern when investigating sensitive targets.
Stealth Mode: This mode ensures a higher level of confidentiality by preventing the desktop client from directly downloading data from the internet. This restriction includes blocking the fetching of website images or overlays. It’s recommended for situations requiring strict confidentiality or when there is concern about IP exposure. However, even in stealth mode, Transforms might contact the target via the public CTAS server or the user’s computer.

Download Your Cheat Sheet

There can still be situations where you might need to use a browser. This is why we recommend using Maltego in combination with other best practices, as outlined in the cheat sheet we prepared for you. If you haven’t already, you can download it now.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Step-by-step Investigations with Maltego

Now that you understand how Maltego can help you remain anonymous during an investigation, your next step should be to explore hands-on how Maltego can assist in your daily work. To do that, check out this step-by-step guide on automating your brand protection using Maltego Machines to speed up repetitive steps in your investigation conducted in Maltego.

AUTOMATE REPETITIVE STEPS

If you are also interested in seeing how Maltego can be practically used to track down individuals responsible for online counterfeit sales, don’t miss the opportunity to watch this webinar demo recording.

WATCH RECORDING NOW

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

Maltego Teams up with the Collegiate Penetration Testing Competition for the First Time

Thu, 30 Nov 2023 08:59:12 +0000

Maltego partners with the Collegiate Penetration Testing Competition (CPTC) for the first time to empower the world’s top cybersecurity students. The upcoming CPTC focuses on mimicking the activities performed during a real-world penetration testing engagement conducted by companies, professional services firms, and internal security departments around the world.

Through the Maltego Grants for Education & Research Program, Maltego provides the CPTC Team with its all-in-one cyber investigation tool, which accelerates and simplifies investigations through link analysis and seamlessly uncovers patterns and multiple order data connections.

How the CPTC First Began

The CPTC began small in 2015, in a classroom at the Rochester Institute of Technology (RIT). Now in its ninth season, the competition boasts over 100 schools that compete across eight global regions.

From San Francisco to Dubai, these top cybersecurity students gain real-life experience that will benefit their eventual work environments. Hosted by the RIT, one of the premier institutions in the world for cybersecurity education, training, and research, the CPTC intends to provide opportunities for as many interested teams as possible, within the limits of the space available at each regional event.

The Collegiate Penetration Testing Competition (CPTC) is now in its ninth season. Photo Credit: Rocio Slobodzian.

More on the 2023 Theme

This year’s theme for the CPTC is an airport with an onsite people mover (monorail). The structure of the competition involves students starting in five U.S. regions, three international regions, and a global at-large category.

Regional hosts for this year’s competition include University of New Haven (CT, USA), Baldwin Wallace University (OH, USA), Tennessee Tech University (TN, USA), Augusta University (GA, USA), Stanford University (CA, USA), Coastline College (CA, USA), Concordia University (QC, CAN), RIT Dubai (UAE) with co-host Princess Sumaya University (Jordan), and remotely Kanazawa Institute of Technology (Japan).

“Now in our 6th year of hosting the CPTC Western Regional at Stanford University, our student team has also competed for the last 7 years,” said Alex Keller, Senior Systems Security Engineer, School of Engineering, Stanford University. As a staff advisor and coach for Stanford Applied Cyber, a student group focused on all aspects of cybersecurity, he adds, “It is a joy to host a competition that provides such an engaging and rewarding experience for the competitors. The premise of CPTC is refreshingly unique – student teams take on the persona of a professional security firm working on behalf of a fictitious client business to conduct a mock penetration test of an authentically complex network infrastructure. Since the early years of CPTC, elements of open-source intelligence (OSINT) have been incorporated into the contest, an aspect largely absent in other collegiate cyber competitions. Just like the real world, OSINT can be a key differentiator when paired with human and infrastructure intelligence to assert a significant advantage in the competition.”

Each of the eight in-person regions accommodates up to ten teams of students, and the at-large category fields dozens of teams.

This competition is different because we attract the most elite cybersecurity students in the world, who are hungry to engage with our competition infrastructure. Each year, we work closely with leading manufacturers and technology companies to create a digital facsimile of a unique critical infrastructure. This year, we are particularly excited to work with Maltego to help create additional realism for this year’s airport infrastructure theme.

M Pelletier, Justin. Global Director, CPTC and Director of the Cyber Range and Training Center in RIT’s Global Cybersecurity Institute.

About the Maltego Grants for Education & Research Program

The mission of the Maltego Grants for Education & Research Program is to bolster students who are driven to change the world. By providing tailored career guidance based on their unique interests, academic fields, and professional objectives, the Program aims to enable students to effectively leverage the ever-advancing digital and technological landscape.

As one of the global partners of CPTC, Maltego will be made available to the world’s top cybersecurity students. Through the Maltego Grants for Education & Research Program, Maltego’s goal is to enable students to effectively leverage the ever-advancing digital and technological landscape. Participating at CPTC will help them gain valuable experience for the students’ career, and we at Maltego are excited to be an integral component of impactful investigations at the CPTC.

With up to 600 of the most talented and motivated cybersecurity students from the top 100 cyber programs, CPTC will see the top 15 teams from across the globe competing in the international finals on January 12th to 15th, 2024. The event is expected to be held in-person at Rochester Institute of Technology in New York.

We at Maltego are extremely excited to be part of the CPTC initiative and look forward to collaborating on more avenues with the RIT in the near future.

To know more about the Maltego Grants for Education & Research Program, please visit here. To explore how we can support your university, student cyber club or collegiate cyber competition, reach out to research@maltego.com.

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

Using One Tool to Analyze Internal and OSINT Data Sources

Fri, 17 Nov 2023 13:58:21 +0000

Tasked with sifting through volumes of internal and external data, fraud analysts keep products, organizations, and their users safe by combating scams, abuse, and fraud. The challenge of managing multiple, often disconnected, data sources can complicate their investigations, often leading those teams to wonder if there could be a simpler way—a single platform that would bring all this information together.

However, the choice between adopting an existing tool or creating a custom one is not straightforward and involves weighing immediate functionality against specific needs, cost considerations, and other factors.

This article aims to help you decide whether to build your own tool for investigative data analysis or buy a pre-built one.

We will demonstrate how a unified interface can ease the workload for fraud and threat analysts and explain why a pre-built tool often outperforms the lengthy and resource-intensive process of developing a custom solution in-house. Finally, we will illustrate how Maltego can enhance your manual investigative processes in just a few steps.

Multiple Data Sources Without a Unified Interface Impair Effectiveness

But first, let’s look at the situation where analysts don’t have a unified interface. We will focus on two common scenarios: one where they deal solely with internal data, and another where they handle both internal and external data.

Using Only Internal Data Sources

Ideally, a company would centralize the data for their analysts, simplifying the process of comparison and insight extraction. However, in reality, this ideal is disrupted by rapid organizational growth, frequent changes in toolkits and software, or other factors, leading to data being scattered across different systems.

Consequently, investigators’ operations are hindered by:

Fragmented Access: Multiple datasets are not uniform in format or structure, nor do they share a common interface. This fragmentation hinders the ability to quickly and efficiently retrieve the necessary information.
Inconsistency: Common issues include varying data types and quality problems, which force analysts to spend considerable time cleaning and normalizing data. This time could be better utilized on more critical tasks.
Inefficiency: Often, data retrieval is a manual process that requires significant data processing skills. Sometimes, teams may even need assistance from other departments due to the complexities involved in data storage and access. This inefficiency also impedes collaboration – sharing investigations across team members or working with other teams becomes cumbersome and time-consuming.

Using Both Internal and External Data Sources

Just as reading without glasses could result in blurry and incomplete comprehension, relying solely on internal data can limit an analyst’s ability to fully understand a situation. Without additional context provided by external data sources, crucial details and the broader picture may remain obscured.

To that end, analysts often need to consult external sources such as sanctions data, corporate databases, breach data, and social media data. This enriches their insights into scams, incidents, or broader trends but poses several challenges:

Workload: Retrieval from various data sources is often a manual, browser-based process. Although digital risk and brand protection teams typically have standard operating procedures (SOPs) for such investigations, including a list of sources to consult or a process to follow when encountering or investigating a particular data type, these procedures add multiple layers of tasks, thereby prolonging the process and diverting attention from more critical investigative work.

If you wish to save time on manual and repetitive tasks and focus on more meaningful investigative work, we have prepared a guide for you. Download your copy and learn how to automate your investigations with Maltego Machines now.

AUTOMATE YOUR INVESTIGATIONS

Analyst Exposure: Investigations involving scam websites or social media can risk adversaries gaining information about the teams. Even when practicing operational security by using measures like sock puppet accounts, proxies, and VPNs, these are not foolproof and always carry the risk of exposing sensitive information such as IP addresses, device information, or user agents.
Limited Data Access: While analysts utilize OSINT, they also require data from other sources about companies and individuals. Access to these sources, often through browsers or APIs, adds complexity and workload to the integration process, especially when accessing new providers.

Collaboration Challenges

The absence of a unified tool causes problems when handling multiple internal and external sources, but it also leads to inefficiencies in the daily collaboration challenges of investigation teams.

To understand the complexity of their work, let’s step into the shoes of these analysts and view what their work involves:

An everyday task is writing and running complex queries to retrieve data from multiple databases. Once this data is obtained, the next step is to clean it and ensure its quality for reliable analysis and decision-making. This often requires using another tool to manipulate, process, and visualize the data, adding an extra layer to an already intricate process.

To obtain this data in the first place, accessing data sources through APIs or browsers is necessary, which requires adaptability to even more platforms and their unique interfaces.

Finally, investigators are usually responsible for writing detailed reports on their findings, often accompanied by screenshots for evidence. When handing off investigations to other team members, they must write comprehensive mid-investigation reports detailing all steps taken to ensure continuity and clarity.

Maltego allows you to export data from your graph and generate reports automatically, which you can share with your peers and supervisors. Read this article to discover five methods for generating reports in Maltego.

A Unified Tool for Analyzing Diverse Data Sources Enhances Effectiveness

The challenges mentioned highlight the need to adopt a unified tool or interface to streamline the investigative process.

It’s important to keep in mind that this is not just about improving the work of a single analyst, but also about enhancing the success of the investigation and the efficiency of the team as a whole in a number of ways:

Time Efficiency: Utilizing a unified tool simplifies data pulls, making them more straightforward and less time-consuming. This alleviates complex workflows and frees up valuable time for investigators.
Ease of Data Access: Having both internal and external data available through a single interface streamlines the process. This not only makes data processing easier but also reduces the learning curve for investigators, allowing them to adapt more quickly.
Simplified Data Quality Management: With a unified tool, the complexity of ensuring data quality is significantly reduced. Investigators no longer need to clean or normalize data extensively. They can combine internal and external information and search in one place, making their investigations more effective.
Data Protection: If the tool also aggregates data, it can protect investigators’ sensitive information as it acts as a proxy, mitigating the risk of exposure during the investigative process.
Scalability and Efficiency: The ability to collate and analyze data in a single interface facilitates scaling investigations on a large scale without adding to the investigators’ workload. This approach also lends repeatability and consistency to the investigations.
Enhanced Reporting: A unified tool enables one-stop tracking of workflows. Investigations can be easily reproduced, verified, and made compliance-ready, improving the overall quality and reliability of reporting.
Improved Collaboration: The tool allows multiple investigators to work in tandem and track each other’s work efficiently. This feature fosters better collaboration and ensures smoother handoffs between team members.

Building Your Own Tool vs. Buying a Pre-Built Tool

When your team recognizes the pressing need for a single collaborative tool to access all data sources, you start contemplating whether to build an in-house tool or opt for a ready-made solution.

On one hand, developing your own tool should mean that it meets all your specific requirements and fulfills your team’s checklist. On the other hand, ready-made solutions already exist in the market, allowing for immediate implementation and benefits.

Building a Custom Tool requires a company-wide effort to restructure and clean existing databases, upskill end-users, and maintain the tool. However, it also risks being a single point of failure if maintenance resources are unavailable, and ensuring compatibility with both internal and external systems is essential. Non-personnel and technical costs further add to the overall expenses.
Buying a Pre-Built Tool offers faster deployment and immediate use, with vendors handling technical maintenance and updates, thus reducing the load on internal teams. These tools often come with expert support to aid in implementation and usage. Although the initial cost might be higher than that of custom solutions, long-term costs are often lower. There may be potential limitations in customization, which necessitates looking for a vendor that designs solutions with flexibility and scalability in mind to accommodate organizational growth and evolving needs.

Making this choice requires a careful evaluation of your organization’s resources, needs, and long-term strategy. It’s not a decision to be made overnight but it is essential for the success of your investigations and for effectively addressing security and compliance concerns.

If you’re planning a session with your team to discuss both options, take the ready cheat sheet that we prepared for you to ensure you cover all points.

DOWNLOAD YOUR CHEAT SHEET

Accelerating Your Investigations with a Pre-Built Tool

Maltego is an example of a pre-built tool used by analysts coming from Fraud Detection, Digital Security, and Trust and Safety teams. Some of the typical investigations that it supports are:

DOWNLOAD PRODUCT BRIEF

Its capabilities enable investigators to explore and connect large sets of internal and external data and conduct link analysis using the so-called Transforms which fetch and process data from various sources, converting it into insightful visualizations.

Within a single interface, Maltego allows you to visualize complex data relationships from open sources, internal databases, and even the deep and dark web and enables multiple investigators to work on the same case simultaneously. Furthermore, it includes tools for generating reports, which aids in presenting findings coherently and professionally.

Finally, Maltego can significantly reduce your workload through custom Maltego Machines that let you automate nearly any repetitive steps in investigations like Brand Protection, Person of Interest, and Resale of Counterfeit Goods. For more detailed, ready-to-use steps to automate these types of investigations, check this guidebook.

Download Your Cheat Sheet

If you haven’t done so already, remember to download your comparison cheat sheet for building a custom tool versus buying one for analyzing both internal and external databases for investigations.

Feel free to use it when discussing both options with your team. This cheat sheet should help you cover all the key points.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Nitish Chandan

Nitish Chandan is an experienced trust and safety professional with expertise in product risk assessment, crisis response, and investigations. He is currently a Subject Matter Expert at Maltego, where he works with platforms to support their trust and safety investigation needs by developing use cases and investigation pathways. He also regularly conducts training for trust and safety teams to build capacity in risk assessments and fraud investigations. In his last role at Twitter, he was a Senior Product Trust Partner, focused on Twitter’s revenue products and product compliance in the JAPAC region.

The Pivot Podcast: The Evolution of OSINT and Digital Safety Strategies with Jezer Ferreira!

Wed, 15 Nov 2023 12:12:57 +0000

In this last episode of the first season of The Pivot Podcast, we welcome our guest, Jezer Ferreira!

Jezer Ferreira, a passionate professor with recognized expertise in OSINT, has made significant contributions to the field. He serves as the Coordinator of Cyber Intelligence Training at the Cyber Hunter Academy and is also a professor of OSINT and CySA in the Master of Cybersecurity and Cyber Defense program at the University of Santiago de Compostela, Spain.

Furthermore, he is the founder of the Osintomático Conference, the largest OSINT and Social Engineering event in Europe. In recognition of his collaborative efforts with the police to combat cyberterrorism, he was honored with ‘The Holy Guardian Angels - Friends of the National Police’ medal.

In this episode of The Pivot, we journey through Jezer’s beginnings in the OSINT realm, discuss the dynamic evolution of the discipline and its interconnected fields, and examine the generational shifts in social media engagement. Beyond insights for OSINT and cybersecurity professionals, Jezer also offers valuable advice on how everyone can navigate the internet confidently by cultivating safe digital habits.

Watch the video version with English subtitles below or listen to this podcast episode on Spotify, Apple Podcasts, Google Podcasts, or the Maltego YouTube channel!

WATCH INTERVIEW

The Pivot, Your OSINT and Infosec Podcast

Brought to you by Maltego, The Pivot is your OSINT and infosec podcast that dives deep into topics pivoting from information security to the criminal underground. Through The Pivot episodes, we aim to share insightful information for beginners and seasoned investigators alike, shedding light on all things OSINT and infosec from an insider’s perspective. 

Each episode features one or two of Maltego’s Subject Matter Experts as the host and an external expert, researcher, or industry leader invited to share their projects, stories, experiences, and advice. 

Closing the First Season of The Pivot Podcast

The first season of The Pivot comes to a close with the 20th episode. We’re deeply grateful to our listeners for being a key part of this enlightening journey. We also wanted to thank all our guests for sharing their knowledge.

While awaiting the new season, you can revisit your favorite episodes and refresh the insights shared by tuning in to previous episodes on Spotify, Apple Podcasts, Google Podcasts, or by watching the video version of each episode on the Maltego YouTube channel.

The last episode with Jezer Ferreira as a guest stands out as it is entirely recorded in Spanish, making it a special treat for our Spanish-speaking audience.

For our non-Spanish speaking audience, we have included English subtitles in the video version below for your convenience, ensuring everyone can enjoy it.

The Evolution of OSINT and Digital Safety Strategies with Jezer Ferreira

Tune in to the interview with Jezer to delve deeper into:

How the OSINT discipline and its related areas are evolving
The meaning of preventive OSINT and its application by companies
Digital safety measures that OSINT and cybersecurity professionals and individuals outside the industry alike can adopt to protect themselves, their families, and friends
The reasons why OSINT and cybersecurity professionals should embrace a hacker mindset and other essential skills they must possess to excel in the field

For Spanish speakers: You can dive into a full conversation with Jezer Ferreira discussing the evolution of OSINT and sharing cybersecurity tactics for both companies and individuals — all in Spanish! You can find this podcast episode on Spotify, Apple Podcasts, and Google Podcasts.

Check out Jezer’s work on Twitter!

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.

Happy investigating!

Protecting Your Brand from Product and Platform Abuse

Mon, 06 Nov 2023 13:52:23 +0000

Many of us recall the days when we innocently created fake profiles on social media during our adolescence or used cheat codes in games like The Sims to build lavish mansions. Most would agree that these actions, while bending the rules, were benign and are a far cry from the more severe product and platform abuses.

Where Pushing Boundaries Ends and Product Abuse Begins

While it’s easy to jump to the conclusion that product or platform abuse is synonymous with malicious intent, this isn’t always the case. Many instances of what we label as “abuse” might simply be curious users discovering novel ways to utilize a platform or product. They stumble upon new, unintended ways to use a product or platform, driven by curiosity rather than malice.

This benign exploration shouldn’t overshadow a significant concern: for every user pushing boundaries out of innocent curiosity, there are malicious actors diligently searching for loopholes to exploit for their gain.

These graver offenses include malicious activities such as scams, bullying, and doxing, and their repercussions can be severe, leading to reputational damage, financial losses, or breaches in operational security.

Reflecting on the past decade or so, it’s commendable how far products and platforms have evolved in their fight against abuse. They’ve tightened security, refined user guidelines, and enhanced monitoring mechanisms. Yet, given the uptick in malicious abuse, platforms must redouble their preventive efforts.

If you want to find out more about examples of real-life product and platform abuse, the full version of this blog article covers six case studies of abuse experienced by leading global companies and offers strategies to protect your brand. Download your copy now!

DOWNLOAD

The Scale of Product and Platform Abuse in Numbers

The extent of product and platform abuse is challenging to measure accurately, primarily because each platform maintains its proprietary data on misuse and every country keeps its distinct records of online harassment.

To offer some perspective on the scale of this issue:

A 2021 study by Pew Research Center revealed that a staggering 41% of Americans have experienced online harassment at some point.
Between 2017 and 2018, England and Wales reported 1,605 online hate crimes. This number, while seemingly specific, only scratches the surface of global incidents.
While the same study estimates that only about 1% of online content is abusive, it’s crucial to understand the vastness of the digital sphere. Even 1% translates to a monumental amount of abusive content when considering the billions of digital interactions taking place daily.
Interestingly, abuse tends to concentrate more on niche platforms. For instance, platforms like 4Chan, which cater to a more specific user base, are estimated to contain as much as 8% abusive material.
Reflecting on German statistics, the country recorded a significant 146,363 instances of reported cyber crimes in 2021. Worryingly, only 29.3% of these cases were solved.

The data highlights a grim truth: abuse in the digital realm is pervasive and often goes unchecked.

Tangible and Intangible Consequences for Organizations and Users

From a business standpoint, the effects of product and platform abuse are multi-faceted, affecting organizations and users.

For Users:

Trust Erosion: Users seek platforms they can rely upon. Experiencing or witnessing abuse can erode their trust, making them reluctant to engage or transact, potentially reducing the user base.
Reduced User Engagement: Fear of harassment or encountering malicious content can lead to reduced user activity or total withdrawal from a platform.
Financial Loss: Users can become victims of scams or fraudulent schemes, leading to direct financial losses. This can have a domino effect, where they avoid online transactions altogether, affecting businesses relying on e-commerce.
Emotional and Psychological Impact: Users subjected to bullying, doxing, or other forms of harassment carry the emotional and psychological scars, which can deter them from engaging with online platforms in the future.
Data Privacy Concerns: Malicious actors often seek personal data. A breach can leave users vulnerable to plenty of issues, ranging from identity theft to unauthorized transactions.

For Organizations:

Reputation Damage: The most significant casualty for businesses in the wake of product abuse is their reputation. Once tarnished, it can take years and considerable resources to rebuild trust.
Financial Implications: Apart from direct losses due to fraud or scams, organizations may face decreased revenue from diminishing user engagement or transactions. There’s also the potential cost of lawsuits or regulatory fines.
Increased Operational Costs: Addressing abuse means investing in more robust security measures, hiring specialized personnel, and possibly facing higher insurance premiums.
Decreased Market Valuation: Publicly traded companies may see a decline in their stock prices following significant instances of product abuse or data breaches.
Loss of Competitive Advantage: As users flock to safer, more secure platforms or start using products that did not suffer consequences of malicious exploitation, businesses with unchecked abuse might find themselves losing their competitive edge.
Regulatory Scrutiny: Failing to curb abuse can draw the attention of regulators, leading to investigations, penalties, or stringent operational guidelines, adding to operational challenges.

Insights from Real-Life Product Abuses across Industries

While we often focus on the theoretical aspects of product and platform abuse, understanding the real-world implications offers businesses not only actionable insights but also promotes risk mitigation and can help safeguard their reputation.

To highlight the gravity of product abuse, we’ve created a whitepaper with six case studies from prominent global companies that have faced abuse. Each case provides insights and lessons for businesses looking to strengthen their defenses against such threats.

Download This PDF to Gain Insight into

Direct experiences of renowned companies grappling with product and platform abuse
Effective strategies to neutralize and prevent these challenges
Key areas for Trust and Safety teams to concentrate on to maximize their efforts

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

If you’re keen on exploring the hands-on aspects of Trust and Safety operations, you may want to delve into how mapping tools enhance the efficiency and effectiveness of these dedicated teams on a daily basis.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter to stay updated on the latest tutorials, use cases, and webinars!

Happy investigating!

About the Author

Jules Brahms

Jules Brahms is a Subject Matter Expert at Maltego, where she supports the trust and safety needs of brands, companies, and platforms, drawing on her experience as a trust and safety professional with a background in incident response, product abuse, and misinformation prevention. In her role, she develops workflows for trust and safety practitioners and conducts training with teams to build capacity in risk assessments, the handling of misinformation and electoral manipulation, and person of interest investigations. Previously, Jules worked as a Subject Matter Expert for online radicalization and misinformation at trust and safety provider ActiveFence, which delivers trust and safety solutions to leading online platforms.

Analyzing Threat Actor Profiles Using Social Media Intelligence

Thu, 02 Nov 2023 14:34:32 +0000

We live in a world that is becoming more interconnected by the day. The vast amount of information shared on social media platforms offers a treasure trove of insights for the discerning eye. This is where Social Media Intelligence, also known as SOCMINT, steps in.

SOCMINT refers to the collective tools and solutions that allow cyber threat investigators to systematically organize, analyze, and interpret data from social media sources. This data, ranging from tweets, posts, images, links, and more, can be invaluable in understanding threat actors’ behaviors, patterns, and intentions.

In this article, we will delve into the world of SOCMINT and uncover its importance, applications, and challenges.

The Significance of SOCMINT for Analysis

For cyber threat intelligence analysts, SOCMINT is not just a supplementary source of information; it is a critical component of their investigative toolkit. The digital footprints left on social media platforms often contain a wealth of information that can reveal patterns, behaviors, and even intentions for analysts.

In a world where threats evolve rapidly, real-time insights from platforms with billions of interactions can be the difference between spotting a threat proactively and reacting to a breach.

The Broad Scope of SOCMINT

Source: datareportal

Although the image above only covers traditional platforms, you should expand your perimeter to cover other sites like:

Forums and Blogs: These spaces often host in-depth discussions, code-sharing, and sometimes covert planning—anything from hacking forums to sites like 4chan.
Non-traditional Platforms: Sites like GitHub or Stack Exchange can be goldmines for spotting malicious code or discussing vulnerabilities.
Region-Specific Platforms: If you are investigating a threat from Russia, Vkontakte should be on your radar. The same goes for Weibo, one of the biggest social media apps targeting the Chinese market.

Strategies for Effective Use of SOCMINT

With so much data at our disposal, it’s sometimes challenging to sift through it all to find meaningful connections and focus on what’s most relevant at a given moment in our investigation.

Here’s what you can do to harness SOCMINT effectively:

Broaden Your Horizon: Beyond mainstream platforms, delve into forums, blogs, and region-specific sites.
Prioritize Quality: Although some tools can gather substantial amounts of data, manual exploration is often necessary to uncover subtle details. A comment on a niche forum or a discussion on a lesser-known chat group can sometimes provide the most revealing insights.
Define a Workflow: Creating a workflow for investigating specific social media platforms or specific types of information like email addresses or phone numbers helps to reduce the risk of missing vital information and ensures a standard quality of analysis across the board. I highly recommend the OSINT Attack Surface Diagrams shared by the OSINT Dojo to help you define a custom workflow for your investigations.

Source: osintdojo

To take this a step further, you can use a mapping tool that will help you combine and analyze all the data from a single interface. This is where Maltego stands out in the SOCMINT landscape, as it allows investigators to gather intelligence from a wide range of diverse sources. Maltego also streamlines tasks like deduplication, visualization, automation, and report generation, which can be beneficial when collaborating with other investigators.

Profiling Threat Actors with SOCMINT

Now that you have your strategy and tools in place, you can start leveraging the available SOCMINT sources that you consider relevant for your investigation. Here is a quick breakdown of how you can use them to profile threat actors:

Profile Identification: Analysts can identify profiles or accounts associated with known threat actors or suspicious activities.

Example: A user on a forum discussing specific hacking techniques or sharing malware code snippets.

Communication Patterns: By monitoring conversations and interactions, analysts can discern communication patterns, helping identify networks of malicious actors.

Example: Tracking interactions between suspicious accounts on platforms like Twitter or Telegram to uncover a network of collaborators.

Sentiment Analysis: Analyzing sentiments can provide insights into threat actor’s motivations, intentions, or potential targets.

Example: A surge in negative sentiments towards a specific organization might indicate it as a potential target for hacktivist groups.

Content Analysis: Reviewing shared content, such as images, videos, or links, can give clues about a threat actor’s capabilities, tools, or methodologies.

Example: A user sharing screenshots of a compromised system or tutorials on exploiting specific vulnerabilities.

Temporal Analysis: Observing the timing of posts or interactions can provide insights into threat actors’ active periods, potentially revealing their time zones or operational hours.

Example: A threat actor consistently posts or interacts during a specific time, hinting at their location.

Geolocation Data: Some social media platforms provide geolocation data, which can be invaluable in tracking the physical location of threat actors.

Example: A tweet or post with location data enabled, pinpointing a threat actor’s location.

Network Analysis: Social media platforms are inherently about connections. Analyzing these can reveal affiliations, hierarchies, or group dynamics.

Example: Identifying followers or mutual connections of a known malicious account to uncover a broader network of threat actors.

Trend Monitoring: Monitoring trending topics or hashtags can provide early warnings about emerging threats or campaigns.

Example: A sudden spike in discussions around a specific vulnerability or exploit.

Beyond threat actor profiling, SOCMINT has many other applications. For example, analysts can predict threats by monitoring online discussions about vulnerabilities. Social media, a hub for information warfare, can be navigated using SOCMINT to counteract disinformation campaigns. Meanwhile, early detection of employees discussing sensitive issues online allows for prompt interventions, preventing potential security breaches or issues.

Challenges in the SOCMINT Arena

While powerful, SOCMINT is not without its pitfalls:

Volume Overwhelm: Every day, billions of posts, tweets, shares, and comments flood social media platforms. This massive influx of data can quickly overwhelm analysts. It’s like trying to find a needle in a haystack, but the haystack is constantly growing. Without the right tools and techniques, crucial information can be missed, or analysts can spend excessive time on irrelevant data, reducing efficiency.
Disinformation: Not everything on social media is as it seems. Fake news, altered images, and misleading narratives are everywhere. These are often intentionally planted to mislead or divert attention. Analysts must learn to distinguish between genuine threats and decoys. Misinterpreting disinformation as an actual threat can lead to wasted resources and incorrect threat assessments.
Ethical and Legal Hurdles: The digital world has its own set of ethical guidelines and legal boundaries. Techniques like using sock puppet accounts to gather information can be seen as deceptive or intrusive. Moreover, scraping data or accessing private information without consent can breach privacy laws and platform terms of service. Analysts must strike a balance between gathering comprehensive intelligence and respecting digital rights. Overstepping boundaries can lead to legal repercussions, damage to reputation, and potential loss of access to vital platforms.

Maltego: The SOCMINT Powerhouse

Maltego has emerged as a favorite tool for many analysts diving into SOCMINT. It facilitates the process by:

Maltego delivers detailed reporting ideal for stakeholder communication and further analysis. Moreover, it offers an all-in-one tool that aggregates information from diverse sources within a single interface, enhanced by its visual analysis that presents actional insights. This eliminates the need to toggle between platforms, providing users with an efficient and value-driven data analysis experience.

Conclusion

In the complex landscape of social media, every post, tweet, and like can be a potential lead. SOCMINT stands as a pivotal tool for cyber threat intelligence, transforming digital chatter into actionable insights. Recognizing the nuances of data, discerning genuine threats from disinformation, and navigating the ethical maze are all part of the process.

With powerful tools like Maltego, analysts can streamline the data analysis to find patterns, anomalies, and indicators that, when pieced together, reveal a comprehensive threat narrative. As cyber threats evolve in complexity, mastering SOCMINT isn’t just a recommendation, it is a must.

To learn more about using Maltego and SOCMINT in your investigations, download the handbook below.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Discover more resources related to Social Media Intelligence here and follow us on Twitter, LinkedIn, and Mastodon, or subscribe to our newsletter.

Happy investigating!

About the Author

Mario Rojas

Investigator Toolkit October 2023: Cheat Sheets for Faster and Spot-on Workflows

Mon, 30 Oct 2023 10:01:04 +0000

Since June 2022, Maltego has launched a new social media campaign that provides Maltego users and investigators with cheat sheets showing how to best use our Hub items for certain workflows. Check out the Investigator Toolkit October roundup in this article!

Investigator Toolkit: Quick Starts to Using Maltego Hub Items in Real-life Investigations

Presented to you by Maltego, the Investigator Toolkit series showcases each Maltego Transform Hub item with a sample workflow applicable to certain types of investigations. This series aims to help you quickly learn how to include a particular Hub item in your existing workflows.

Where to Find the Investigator Toolkit?

You can find the Investigator Toolkit series on our Twitter, LinkedIn, and Mastodon channels, with the hashtags #MaltegoMonday and #InvestigatorToolkit. Every Monday, each Investigator Toolkit post comes with a workflow cheat sheet and a blog article or webinar as an additional demonstration.

2023 Investigator Toolkit Roundups

Investigator Toolkit October Roundup

In October, we featured the following four Hub items and their use cases in the Investigator Toolkit series:

Let’s dive straight into how to use these Hub items for supplier network investigations, malicious domain investigations, breached data investigations, and social media online footprint examination!

OCCRP Aleph: Supplier Network Investigation

With the OCCRP Aleph Transforms in Maltego, investigators can securely access large amounts of data, querying companies’ registries, contracts, procurement databases, and many more in a single interface.

ZETAlytics Massive Passive: Malicious Domain Investigation

By leveraging the ZETAlytics Massive Passive Transforms in Maltego, investigators can query historical domains, email addresses, and name servers, spotting relationships between different threat actors and known associates.

Check out how we investigate suspicious IP addresses and trace back to the source of malware entry starting from a Domain Entity, exploring one network infrastructure point to another with ZETAlytics Massive Passive’s comprehensive database.

Darkside: Breached Data Investigation

To unravel a subject’s online presence, investigators can utilize the Darkside breach database built by District 4 Labs, gathering personally identifiable information.

In our latest joint webinar, Maltego SME, Mathieu Gaucheler, and our partner, District 4 Labs, showed how investigators can use breached data to spot hidden patterns in large volumes of data within Maltego, conducting a live demo with leaked FSB agent phone numbers.

Using the Have I Been Pwned Transforms in Maltego, investigators can easily check if their online account has been compromised in a data breach and whether they are at risk of potential cyber threats.

And that’s a wrap for the Investigator Toolkit series!

To better assist and provide our community with up-to-date information about Maltego Hub items, we are bringing an end to the Investigator Toolkit series to launch a new and exciting campaign. Thank you all for showing your support toward this initiative!

While we are working on the re-upcoming campaign, don’t forget to follow us on Twitter, LinkedIn, and Mastodon so that you don’t miss any updates!

Happy Investigating!

Spark: Ignite Your Learning with Maltego

Thu, 19 Oct 2023 11:19:01 +0000

In June 2023, we successfully rolled out our new online learning portal, Spark. The excitement did not end there. This month, we are thrilled to launch Spark Premium – The choice of learning for thousands of OSINT and Maltego investigators worldwide.

Spark is an all-in-one platform for investigators, analysts, and researchers to learn about how to make their work more effective and efficient by using Maltego and other investigative methods. In addition to Maltego-specific training, Spark offers learning resources in the domains of open-source intelligence (OSINT), cybersecurity, and more, to keep practitioners ready for any investigation coming their way.

Spark Premium opens even more learning opportunities and formats. It is included in our Maltego Enterprise Plan, and can be purchased via our webshop as a yearly subscription.

GET SPARK PREMIUM NOW

Learn the Way You Prefer with Spark & Spark Premium

The launch of Spark comes with the release of a wide range of multi-format learning resources that serve learners with diverse preferences and learning habits.

We took feedback from our existing learners as well as external trainers who collaborate closely with Maltego to understand how people learn best and how we can help shape their learning experience. We reviewed, revamped, and redesigned all our existing E-learning courses and introduced a comprehensive catalog of new, supporting resources.

While we will continue to expand the topical and structural variety of our learning content, we launched Spark today with the following three learning offerings:

A Series of On-Demand E-Learning Courses for Maltego Users

Spark offers a series of on-demand courses that serve your Maltego learning needs.

The Maltego Foundations 1 and Maltego Foundations 2 courses focus on getting users familiarized with the Maltego tool to perform investigations. Spark Premium subscribers can upskill further with the Maltego Advanced course which showcases Maltego’s customization and automation capabilities.

For Spark Premium subscribers, we also offer on-demand courses centered around specific Maltego data integrations on the Transform Hub, so that our users and customers can upskill in areas most relevant to their day-to-day operations.

A Collection of In-Depth Investigative Masterclasses

Masterclasses are our newest learning offerings that aim to help investigators upskill their domain knowledge. We are excited to work with industry leaders and experts to make their expertise accessible.

Our first Masterclasses include exciting topics such as:

Citizenship for Sale: Uncovering Criminal Operations where Mario Rojas, threat intelligence expert and former Maltego Subject Matter Expert, takes us into the hidden world of fake document supply chains and sales. This Masterclass showcases how he navigates the dark web and the surface web to map out a broad network of sites offering these illegal services, personal identifier data associated with them, and individuals possibly behind the operation.
Company Analysis with Maltego where Andrew Fordred, cyber intelligence expert and former cyber investigator, covers the OSINT tools, data sources, techniques, and workflows that can help find information related to businesses and organizations and produce the best outcomes.
Enhancing Information from Phone Numbers and Email Addresses where Andrew Fordred tackles the difficult task of creating intelligence starting with only a simple piece of information. He demonstrates how to effectively use Maltego and OSINT to match phone numbers and email addresses with people and organizations.

Check out our extensive Masterclass collection now!

A Catalog of Maltego Handbooks, Articles, and Videos

Finally, the launch of Spark comes with a large catalog of Maltego resources with which you can learn at your own pace.

Our Handbooks for Incident Response, Cyber Threat Intelligence, and Social Media Investigations have proven to be useful to learn about essential Maltego workflows and data integrations relevant to each operation. As a Spark learner and Maltego user, you also have unlimited access to all Maltego case studies, use case demos, and whitepapers.

Learn the Best Way Possible with Spark Premium

More than just an online library, Spark is a modern learning portal that offers learners a thoughtful learning experience while gaining knowledge. Learners can take advantage of intuitive site navigation, simpler course registration, direct access to materials, and an attractive web interface to make their learning journey as enjoyable as possible.

Your browser does not support the video tag.

With Spark Premium, our learners will have access to even more interactive learning options for our learners, including monthly Ask-Me-Anything sessions with a Maltego trainer, monthly full-length live training sessions, and asynchronous Capture the Flag challenges which encourage learners to put their knowledge to test. These interactive learning activities will help you put your skills into practice and connect you to the rest of the Maltego Community.

The potential of learning with Spark and Spark Premium is immense, and we are thrilled to be able to explore, develop, and provide such opportunities to our valuable community.

Start Learning with Spark & Spark Premium Today

Want to get started with Spark? Head over to Spark and sign up as a new user. All requests will go through a short vetting process from our team to ensure the best possible learning experience, which will be completed within 1-3 business days. You will then receive an email when you can start learning with Spark. So let the learning begin!

Want to learn more about Spark Premium? Check out the details of our learning offering here or start your yearly subscription directly from our webshop.

GET SPARK PREMIUM NOW

Online learning is more important for us than ever before. The launch of Spark and Spark Premium signals our commitment to ensuring that you always have something new to learn that will enhance your ability to perform impactful investigations. Please expect new courses, documents, videos, and more to be released on Spark from Maltego as we invest further in user education.

For any questions about Spark or Maltego’s learning offering, please reach out to your Customer Success Manager directly or email training@maltego.com.

Most importantly, start learning with Spark today!

Happy investigating!

Automating Repetitive Steps in Trust and Safety Investigations with Maltego Machines

Wed, 18 Oct 2023 10:01:42 +0000

Routine tasks often consume a large portion of the time of Trust and Safety teams. Conducting the same investigative steps on different persons of interest, overseeing brand protection on corporate domains, or performing regular risk assessments all drain valuable resources.

These repetitive workloads shift the focus away from decision-making and proactive risk management, resulting in internal challenges such as disengagement, reduced productivity, strained resources, and hindered scalability. Externally, they can cause delays during growth or high-demand periods, impacting customer experience and stakeholder perception. Manual handling of these tasks may also introduce errors and inconsistencies, as well as underutilization of skilled professionals’ expertise.

Implementing automation and optimizing processes is therefore crucial to improving operational efficiency and maintaining a positive organizational image. In this article, we’ll demonstrate how to automate some of the common repetitive workloads using Maltego Machines, offering practical examples for your Maltego setup.

How Maltego Automates Trust and Safety Workflows

When conducting an investigation with Maltego, investigators can often execute various Transforms in sequence, using the results from each Transform as the input for the next step. This process may be repetitive and automated across many different investigations.

Methodizing these processes can be hugely beneficial and timesaving for Trust and Safety teams. Maltego makes this achievable through automation using Machines. Machines will repeat a pattern of Transforms you predefined as if you were operating the tool yourself. They can run Transforms both in parallel and sequentially.

To illustrate the use of Maltego, we will first reproduce a scenario in which a threat analyst in a multinational organization wants to periodically conduct brand protection investigations on the corporate top-level domains (TLDs), as well as identify potentially forgotten domains.

Using PayPal as our illustrative example, we’ll first introduce the steps necessary to conduct this investigation, and later showcase how to automate these investigative processes utilizing Maltego Machines to streamline our future periodic brand protection checks.

For additional insights, you can access a downloadable PDF where we demonstrate how to build two other Maltego Machines: one for person of interest investigation and another for tracking counterfeit products.

DOWNLOAD YOUR COPY

Launching a Brand Protection Investigation with Maltego

In the first use case, our analyst wishes to conduct a brand protection investigation on the corporate top-level domains (TLDs) and identify potentially forgotten domains using Maltego Data.

This entails identifying all TLDs with PayPal as the hostname, determining which of these actually belong to PayPal, and then finding out if there are any unused www DNS names.

This can be easily done in Maltego with a few simple steps:

STEP 2

We open a new graph in Maltego, drag a Domain Entity from the Entity Palette onto it, and change the input value to “paypal.com,” which will serve as the starting point of our investigation.

STEP 2

We aim to identify domains with the same hostname but different TLDs. To achieve this, execute the To Domain [Find other TLDs] Transform on the Domain Entity.

This Transform searches for domains observed on the internet with the same hostname but different TLDs.

Maltego retrieved hundreds of results, such as paypal[.]me or paypal[.]tk, some of which are not associated with websites. Our goal is to determine which websites could be parked or engaged in cybersquatting — in other words, registering, trafficking in, or using an Internet domain name with a bad faith intent to profit from the goodwill of a trademark belonging to someone else.

STEP 3

We can examine the DNS records to check if there are active websites associated with the domain, using the To Website [Quick lookup] Transform. We want to identify which of these domains could be parked or involved in cybersquatting and which are legitimate websites owned by PayPal.

STEP 4

To do so, we need to run the To Certificate Transform on all Website Entities. SSL certificates are a great way to ascertain the domain under the control of a single organization.

The resulting graph shows several PayPal domains with the same DigiCert EV certificate. Others use free SSL certificates, while some do not have SSL certificates at all.

While these steps were relatively easy and quick, they can become repetitive and still consume considerable time to execute, especially if done periodically. Let’s proceed to build a Machine to automate the process and further expedite it.

Automating a Brand Protection Investigation with Maltego Machines

In this demonstration, our analyst starts their investigation by building a Maltego Machine following the steps below.

STEP 1

Select the “New Machine” option under the Machines tab in the Maltego menu.

STEP 2

The Machine needs to be named and given a unique ID (this is autogenerated by Maltego, but can be changed to whatever you prefer) and an author. You can also add a description if you wish. This can be especially useful if you are planning on sharing the Machine with other users.

STEP 3

There are different types of Machines:

Macro Machine: Will only run once when started.
Timer Machine: Runs periodically until stopped.
Blank Machine: A completely clean slate.

For our purpose, a Macro Machine is most suitable.

STEP 4

After all the info has been put in, the Machine editor will open automatically.

Machines are written in the Maltego Scripting Language (MSL). When the Machine editor opens, the header contains metadata about the Machine, while the actual Machine content is enclosed in the “start {}” brace. The editor contains some boilerplate code to get started, but we will remove the two example Transforms from the autogenerated code to start.

As a reminder, this is the sequence of Transforms we want to automate:

Domain name
Other TLDs
Website
Certificates

It’s important to note here that each Transform uses the results of the previous Transform run to work with.

If you are interested in learning how to build a Machine that executes several Transforms on the same Entity, head to the free PDF version of this article, which explains how to set up such a Machine.

DOWNLOAD YOUR COPY

STEP 5

Machines use Transform IDs to determine which Transform to run. We can find the ID on the right-side pane of the Machine editor. We can filter Transforms by Input Entity type and select them from seeds installed in the Transform hub. We can either drag and drop the Transform or double-click it. It will be added to where the cursor is.

STEP 6

We want to start with a Domain, so we set the Filter by Input field to Domain. This way, we will only be shown Transforms that run on Domain Entities, ensuring our Machine runs correctly.

Now we find the To Domain (Find other TLDs) [WhoisXML] Transform under the Maltego Wayback Machine header.

STEP 7

We will do the same with the other Transform, To Website [Quick Lookup], before changing the Filter by Input to Website and adding the To Certificate Transform.

STEP 8

Next, let us click the test button to see if the Machine was set up correctly and can run, and then click save once you see the “success!” notification.

STEP 9

We can now use our Machine on the URL Entity by going to the Machines tab in the Transform window and running our Machine.

You will see a couple of out-of-the-box Maltego Machines for network footprinting and your custom Machine. In our example, we, of course, want to run the custom Machine we named Paypal Brand Protection.

STEP 10

This immediately ran the Transforms we defined in the Maltego editor.

How to Automate Person of Interest and Resale of Counterfeit Goods Investigations with Maltego

We have just illustrated how automating Transforms can significantly reduce the workload of trust and safety investigators. While this is just an example, you can create custom Machines to automate nearly any repetitive steps in Maltego.

To provide you with more ready examples that you can immediately replicate in your Maltego Client, we have created two additional step-by-step guides for automating two common workflows among Trust and Safety teams, namely:

Person of Interest Investigation
Resale of Counterfeit Goods Investigation

You can download the PDF below, where you will have the opportunity to follow detailed steps for building and running custom Maltego Machines that will help you explore the online footprint of persons of interest, as well as conduct checks on individuals selling counterfeit company products online in one click.

This resource will equip you with an in-depth understanding of how to effectively use Maltego for these investigations, enabling you to practice building Machines on your own and use them in your daily trust and safety operations.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Jules Brahms

Why Trust and Safety Teams Need a Mapping Tool for OSINT Investigations

Tue, 17 Oct 2023 10:24:25 +0000

In various industries such as financial institutions, consumer goods companies, and pharmaceutical manufacturing, Trust and Safety teams are the bedrock of maintaining user security and an organization’s integrity and compliance in the face of escalating digital threats.

However, despite the critical nature of their work, these teams often encounter challenges due to a lack of unified toolkits and the overwhelming amount of dispersed data that requires processing to identify meaningful connections. This holds them back from realizing their full potential, as a significant portion of their time is consumed by repetitive tasks—a precious commodity in their line of work.

When dealing with the challenges of managing an excess of internal and external databases, a mapping tool like Maltego proves to be a valuable asset as it can automate the commonly repetitive and manual tasks, and help advance the investigation.

What Trust and Safety Teams Do

In order to understand where automation is most needed, it is important to note that the roles and responsibilities of these teams can differ based on the industry and the types of investigations they conduct.

Adding to the complexity, Trust and Safety teams aren’t always referred to by the exact same name. Different organizations may use titles such as digital risk teams, brand protection teams,or fraud and abuse teams.

While teams go by various names, there are some core duties that these teams universally grapple with:

What Challenges Trust and Safety Teams Face

While this list is not exhaustive, it reflects commonalities in all these tasks. The challenges of repetition and efficient management of scattered and sometimes irrelevant data are prevalent, regardless of the industry or profile of a given Trust and Safety team.

We also cannot overemphasize the importance of proper documentation for Trust and Safety teams. Documentation provides a clear record of the investigative process, supports knowledge sharing within the team, and aids in analyzing and enhancing investigative workflows. However, this is impeded by varying data formats and sources.

Lastly, an inadequate toolkit or an abundance of tools that fall short in presenting data effectively and identifying concealed connections exacerbate the situation.

How to Solve Trust and Safety Problems at Scale with a Mapping Tool for OSINT Investigations

Stepping back, it’s evident that data lies at the heart of all these challenges. Without a solution that integrates these various data sources, automating these tasks and overcoming such hurdles is out of our reach.

How we process, manage, and handle data, and the insights we gather from it, can either propel our investigations forward or hinder our progress if we don’t find an effective way to combine our data sources.

Download This PDF and Find out:

How data solves Trust and Safety problems at scale
In what way a mapping tool can help simplify Trust and Safety workflows
What methods to use in a mapping tool to find connections across multiple databases
How using OSINT can help with brand protection, person of interest, and other investigations
What the step-by-step process of mapping data looks in Maltego

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

If you want to find even more information on automating your brand protection using Maltego, check out this article about Maltego Machines – a feature that can vastly help speed up repetitive steps in an investigation run in Maltego.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Nitish Chandan

Investigating the Impact of Potential Data Breaches with Maltego

Thu, 05 Oct 2023 10:49:29 +0000

Compromising digital assets, disrupting daily operations, or exfiltrating sensitive data are among the most severe consequences of a breach, a prospect that sends shivers down the spines of many CISOs. What adds to this daunting reality is the staggering cost of data breaches, with the global average reaching $4.35 million in 2022.

As soon as threat actors gain privileged access to our infrastructure and we become aware of it, containing the breach becomes our top priority. Nevertheless, recovering full control without completely restoring compromised systems and data poses a significant hurdle, as does identifying the root cause and ensuring that threat actors do not retain access.

In this article, we will delve into the impact of breaches on organizations, explore how to establish the initial breach scope using Maltego, and share a downloadable playbook for investigating potential breaches with Maltego.

The True Impact of Data Breaches on an Organization

A data breach is one of the most severe events an organization might face as it often triggers high-impact incidents.

These range from compromising business or customer data, including sensitive personal information such as addresses, phone numbers, credit cards, and bank accounts, to data privacy concerns like profiling individuals based on religion, sexual orientation, or political interests.

For global companies, data breaches could involve datasets with thousands or millions of customers from different regions, leading to two major concerns:

Reputational: How a company manages communication and responds to affected individuals and agencies will likely determine how the public perceives their diligence in addressing the issue. Sometimes even small details about the root cause, such as inadequate security measures, can greatly influence how others view the company’s trustworthiness in the future, and restoring that trust can become a daunting task.
Regulatory: Breaches in critical infrastructure, or those affecting a large volume of sensitive PII data, require immediate disclosure to regulators. Depending on the incident’s management and data type, sanctions can range from hundreds of thousands to millions.

How to Identify a Data Breach

Data breaches can affect companies differently, so various teams within your organization should stay on the lookout for early signs or indicators that require verification. There are several triggers to watch out for:

Third-party notifications: Follow alerts about data, such as stolen credentials, found during a criminal investigation revealed by national Computer Security Incident Response Teams (CSIRTs) or intelligence agencies.
Infosec vendor or threat intelligence reporting service warnings: These may indicate threats that have impacted your organization or similar ones in your industry or country. For example, financial institutions in Mexico being targeted by a threat actor.
Alerts about criminal activity: Your threat intelligence team may detect discussions about your organization in the dark web or hacking/criminal forums, including the sale of access or stolen data.
Suspicious security events: Your SOC team may detect activities related to sensitive users or environments, such as active directories, or a significant number of systems communicating with an external system that could be linked to criminal infrastructure.
Relevant techniques, tactics, and procedures (TTPs) or indicators of compromise (IOCs): Your threat hunting team may discover well-known threat actor patterns in your systems while analyzing the threat landscape.

If you want to find out how to investigate a potential breach in Maltego, download the playbook now!

DOWNLOAD PLAYBOOK

How to Determine the Extent of a Breach

Whether using Maltego or other relevant tools, your cybersecurity teams can conduct a set of activities to assess the extent and severity of the breach.

Here’s what we recommend as starting points:

Triage and collect artifacts to generate an initial set of IOCs for investigation.
Obtain threat intelligence from current IOCs to identify ongoing campaigns and attribute them to well-known threat actors.
Perform threat hunting over the endpoint/network infrastructure to gauge the number of impacted systems.
Conduct lateral movement analysis to trace how the attacker moved between systems.
Engage in forensic analysis of the top compromised systems to gain insights into the attacker’s TTPs.
Analyze exfiltration to understand potential access to data and identify remarkable outbound data flows.
Monitor the dark web and other criminal data sources to identify any potential activities related to selling access or data to your infrastructure.

How Maltego Accelerates Your Breach Investigation

As an investigative tool, Maltego enables you to connect to a wide range of data sources through a single interface, saving precious time needed to minimize damage during a potential breach.

Maltego enables you to:

pivot from IPs, domains, or hashes, to threat intelligence data to uncover ongoing campaigns and related threat actors, identifying IOCs and TTPs
search identified IOCs in various data sources, including SIEMs and log management platforms, to reveal additional compromised or impacted systems
perform triage or preliminary analysis of host and network activity on compromised systems to gather more attack information and identify other abused systems
investigate criminal data sources like the dark web for specific information related to the identified group or our organization linked to the incident
visualize information obtained by responders and analysts to better understand TTPs, such as lateral movements between systems and exfiltration activities

Having the right tools is essential, but preparation is also crucial when dealing with a potential breach. To aid you, we have prepared a free playbook for investigating potential breaches with Maltego. Inside, you will find ready workflows for:

Performing Incident Triage
Collecting Threat Intelligence
Hunting IOCs
Analyzing Lateral Movement
Investigating Exfiltration

This playbook is valuable for teams that have already experienced a breach and need to act swiftly with Maltego. It is equally beneficial for infosec professionals who want to simulate and practice their response using fake data.

Download the FREE Playbook for Investigating Data Breaches

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter to stay updated on the latest tutorials, use cases, and webinars!

Happy investigating!

About the Author

Carlos Fragoso

Useful Google Dorks for Open Source Intelligence Investigations

Tue, 26 Sep 2023 13:24:42 +0000

Search engines, like Google, make finding information online quick and simple, particularly when we are performing broad searches like online shopping, finding a new restaurant, or looking for a job. However, when searching for information about individuals, persons of interest, businesses, or other more specific targets, the number of results returned from Google can be overwhelming.

Luckily, Google has incorporated methods of narrowing results into their search engine that can support you in your day-to-day analyst work. These are commonly known as Google dorks (or Google hacking). Today, we are going to go over some of the most common and useful Google dorks for open-source investigations.

How Do Google Dorks Work?

Most of us begin our online searching by merely typing keywords into the search bar, but in doing so, we have already missed an opportunity to optimize our results. Google dorking makes use of commands called operators that allow users to modify their search results in many ways.

For instance, a user searching for information related to private universities in the United States could type Harvard AND Stanford into Google to return only search results that contain both keywords. Note that Google dorks are case-sensitive, so typing Harvard and Stanford would not generate the same results. While this is a very simple Google dorking technique, there are many more that allow users to modify search results in more profound ways.

Many of these techniques are useful on their own. Still, much of their utility is derived from the user’s ability to combine them to return very specific results from Google.

By using these operators in combination with each other (and the many others that exist), users can target specific information more easily.

Examples of Google Dorks

Let’s look at a couple of basic operators quickly to see how they work together to return specific results:

The site: operator allows us to perform a Google search that will only return results that are hosted on the designated site. For instance, Harvard site:Wikipedia.org will only return search results related to the keyword Harvard from Wikipedia.org.

The – (minus) operator allows the user to exclude specific results from their search. By combining these two operators we can create the search Harvard -site:Wikipedia.org, which will return search results from Google while excluding any results from Wikipedia. As you become more proficient with each operator, you will also find more ways to combine them to find useful information regarding your investigations.

By employing Boolean operators AND, OR, you can combine keywords to refine your search results. Suppose you are conducting research on universities and want to find information about both Harvard and Yale on educational websites. In this scenario, using Yale University AND Harvard University site:.edu narrows your search to pages where both universities are mentioned.

In this PDF cheat sheet, we list out the most useful Google dorks along with specific use cases for your day-to-day investigative work. Download the cheat sheet now and start using them!

DOWNLOAD CHEAT SHEET

How Can You Use Google Dorking in Your Investigations?

While anyone can benefit from using Google dorks, the focus of this article is to highlight the usefulness of these techniques for those conducting open source investigations, particularly regarding person of interest investigations.

Investigators have been turning to the internet, search engines, and social media for years to find information that might prove helpful, but Google dorking techniques can take your OSINT information gathering to a new level.

Let’s look at a couple of unique examples that might be useful in your next investigation.

If you are like most people, you probably have one username that you use for many different accounts across the digital landscape. This username sometimes contains bits of personal information that you can take note of, such as:

Person’s name
Year of birth
Location of their whereabouts
Favorite sports team
Job or profession
Significant dates

The real value in terms of an investigation is finding out whether that username has been used elsewhere online. While someone may take precautions to maintain privacy or security with an account that is tied to criminal or mischievous behavior, their other accounts may not be as well guarded.

Let’s assume that you are looking into a person of interest, and the only information you have about this individual is a username: BadGuy1.

While a search for BadGuy1 might return other instances where the username shows up online, by using the Wildcard operator and searching for BadGuy1*com, we can instead see if any email addresses are publicly available online that use this username as the unique identifier.

While this will not always return significantly different results to searching the username itself, it can serve as a quick method for identifying an email address that can later be tied to other accounts.

2. Uncover Documents Relevant to Your Target

Perhaps you have a subject’s name, but you have little else to go on to learn more. There is a lot that we can learn about an individual given only their name, but our subject, John J. Doe, has a small digital footprint on typical social networking sites or apps. Instead, let’s see what we can find out about our subject using documents hosted online.

In the search bar, we can enter “John J. Doe” filetype:pdf OR filetype:xlsx OR filetype:docx, which will give us only PDF, Excel, or Microsoft Word documents containing the exact search term John J. Doe.

Here we have combined three different search operators to improve our results, which can save a lot of time and effort over the course of an investigation.

For John J. Doe, most of the documents that were returned used a fictitious name to make examples or protect identities. However, when using a real person’s name, the documents found might include court records, resumes, or other official documents that can give insight into a person’s life, finances, family, or friends.

3. Gain Information Through Social Media

Even though John J. Doe doesn’t have much of a social media presence, that doesn’t mean that other persons of interest won’t. Social media platforms offer a wealth of information related to people, places, businesses, and networks. This information is often publicly available and poorly secured, making it a go-to place to search for knowledge to benefit an investigation.

To search social media platforms, we can use the site: operator again. This time, we will search Harvard site:twitter.com to return only results on Twitter. The initial results that we receive are primarily dedicated to different Twitter accounts related to Harvard University. However, diving deeper into the search results shows specific tweets, videos, and more.

Another interesting application is to search multiple social media platforms at the same time using Boolean operators. In our example, we use the OR operator to find accounts that are linked to the same individual across multiple platforms.

In addition, let’s say that our subject sent a tweet, but we want to see if that exact language appears anywhere else online. We could search “subject tweet content” -site:twitter.com in order to see if that exact phrase is used on another platform or by another account. This can help unmask networks of individuals working together, multiple accounts run by one individual, or accounts across different platforms that may have varying levels of security.

What Other Techniques Can Help You Gather OSINT Data?

Google dorks are useful tools that can significantly improve investigations for cybersecurity and cybercrime investigators. There are many other resources out there that dive deeper into the uses of Google dorks, but we hope that this introduction has piqued your interest!

If you want to learn more about dorking techniques for the Bing search engine, check out our blog post here.

Follow Maltego on Twitter, LinkedIn, and Mastodon for more tips and tricks, and subscribe to our email newsletters to learn more about how we can help with your next investigation!

Download the Full List of Useful Google Search Operators

Download our Google Dorks cheat sheet now to see the full list of useful Google search operators. Print it out and share it with your colleagues and teams!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Investigator Toolkit September 2023: Cheat Sheets for Faster and Spot-on Workflows

Mon, 25 Sep 2023 17:00:37 +0000

Investigator Toolkit: Quick Starts to Using Maltego Hub Items in Real-life Investigations

Where to Find the Investigator Toolkit?

2023 Investigator Toolkit Roundups

Investigator Toolkit September Roundup

In September, we featured the following five Hub items and their use cases in the Investigator Toolkit series:

Let’s dive straight into how to use these Hub items for due diligence investigations, domain infrastructure footprinting, Ukrainian corporate investigations, and brand monitoring!

OpenSanctions: Due Diligence Investigation

Thanks to the v3 Transform Protocol, investigators can now run the OpenSanctions Find Path Transform on multiple Entities to find any hidden relationships in between with the graph-in feature.

Host.io and IPInfo: Domain Infrastructure Footprinting

To effectively map out the infrastructure of a website, investigators can leverage the Host.io and IPInfo Transforms in Maltego, building a complete picture of the target network. See how we uncover ExxonMobil’s internet infrastructure in a few clicks with Host.io and IPInfo.

EntitiesUA: Ukrainian Corporate Investigation

With the EntitiesUA Transforms in Maltego, investigators can easily conduct due diligence on their Ukrainian counterparties by identifying the company structure and verifying it for sanctions.

SSL Certificate Transparency Transforms: Brand Monitoring

The SSL Certificate Transparency Transforms in Maltego help brands to monitor any SSL certificates issued to their domains, preventing business disruptions, brand impersonation, or phishing attacks.

Follow the workflow in the article and avoid any potential threats or phishing attacks to your brand using Maltego and the SSL Certificate Transparency Transforms.

Check out the Investigator Toolkit series now!

In the following months, we will continue digging into different Hub items available in Maltego and providing best practice tips for investigators.

Happy Investigating!

The Pivot Podcast: A Real Deep Dive into the World of Cybersecurity with Daniel Card

Fri, 15 Sep 2023 11:50:16 +0000

In this episode for The Pivot podcast, we welcome Daniel Card!

Daniel is a seasoned technology and cybersecurity professional who has worked with organizations globally to help protect, detect, and respond to cyber threats. He is active in the UK cyber community, serving on the UK Government Cyber Security Advisory Board. You can usually find him online conducting innovative research and seeking new ways to combat cybercrime.

In this episode, we draw upon Daniel’s extensive experience and expertise as we delve into the world of cybersecurity together. We discuss some of the challenges posed by laws, the lack of understanding or misunderstanding from the public, as well as the collaboration between companies and cybersecurity professionals. During our conversation, Daniel also shares some commonly practiced security methodologies and examines the issues from personal, organizational, and global perspectives, calling for greater focus on global cyber defense.

You can listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

The Pivot, Your New OSINT and Infosec Podcast

Where to Listen to The Pivot? 

The Pivot podcast is available on Spotify, Apple Podcast, Google Podcast, and the Maltego YouTube channel. Each episode is 45 to 60 minutes long and is released on the 15th of every month. Stay tuned with us for more updates! 

Where did you start your cyber journey? How did you get into this world?

Daniel: I started playing games when I was a kid. I used to play Wolfenstein 3D and have an Amiga. I’m one of those like Afterburner on the Spectrum where you have to use cassettes to start the game. You had to rewind the cassette because it didn’t start from the last time you played it, so you put cassette number one in, and you were on the runway, got to the end of the runway, put cassette number two in, then you take off and put cassette number three when you launch a missile. I wanted to be a game designer, so I used to make some half-life levels and did stuff in World Craft in quake and doom levels. I was bad at all of that stuff, but I really liked technology. Although I can’t remember how old I was, I went and killed malware using floppy drives.

These stuff are what made me sort of get into this space of the security world and the IT world. People have got very, I think, odd views because IT, security, and technology are pretty much the same stuff. There are completely different mindsets, lenses, skills, and specialties absolutely. What we’re talking here is about how we secure people using computers. We’re saying how we protect people on computer systems, and that’s really where my journey started. As a kid, I played games, learned how to code badly, created level editing, graphics design, 3D modeling, and all the stuff, explored computers that way, and then, obviously, when you’re a kid you like to break things because who doesn’t?

From a professional point of view, I’ve done lots of different roles in tech, even though I moved quite quickly into design roles. I designed solutions, re-architected, understood businesses, and looked at the fun parts, like the operating model, the organizational structure, the finances, the portfolio, the ROI, and all of the bits that you need to be doing. Without any of the logistics, resources, money, drive, and motivation to do anything, you aren’t going to be playing with some cool technology. These things don’t exist in isolation. I find a lot of people like to exist in isolation, and that’s fun for me to look at things like this. Then I sit there going, “Okay, great. What do I do with this information?” One of which is obviously trying to help people, and the second part is like, “Oh, there’s a marketing angle to it.” Don’t get me wrong. I might write a blog post that sits on SharePoint, and the article might not always be released. There is that sort of point.

What are the commonly employed methodologies companies actively apply to secure themselves?

Daniel: Literally, the driving force in most scenarios, I’d say is a contractual requirement to meet. Security posture X is what drives organizational changes. That has been my experience, and I’m not saying that this is always the case. Looking at a lot of contracts and security postures, I can tell you that they don’t always align. I think it’s important to understand that you don’t do security in isolation. If you do it in insolation, it’s just the cost and friction. It won’t be aligned, relevant, and probably suitable for the business or the organizational outcomes you’re going for. It has to be taken from a quality, safety, and risk perspective with operational excellence being secure. Is everything always about, “Oh my God, we need to stop the baddies?” Of course, we do need to stop them. However, security to me isn’t that, it’s everything. It’s got to be the whole of society, the whole of life, and the whole of organization.

It needs to be excellence. If you have an excellently operated and managed system, it will be secure. It depends on the inputs. If you have no security input, knowledge, and experiences thrown in, it could still be efficient, but it’s a leaky bucket. That’s how I see the differences. If you care about quality and the details and you’ve got a motivating reason from a business and organizational perspective to do it well, you’re not asking what looks good from an abstract point of view. Instead, you need to be asking, “What looks good for my company? What keeps me, my team, my brand, and my customers safe? How does my supply chain fit into this? How does this work with the organization?” Or if it’s not business, “How does it work from a personal level?”

Everything is about hunting the bad guys, but isn’t it a bit too late to chase the bad guys when things already happened?

Daniel: I work in like offensive and defensive security, and I don’t really care about labels so much. Nonetheless, there is not a focus globally on defense, when I say defense, I mean, cyber defending of organizations, and I think the Cyber Threat Intelligence (CTI) world is obsessed with chasing bears and pandas and putting them together like cartoons. I don’t mean that this is not slum CTI as a practice because the practice is cool. Sometimes I think to myself, given that for a cyber defensive world to exist, a cyber offensive world must also exist, and therefore industries that thrive on crime, it does beg questions such as, “Why aren’t there real conversations about country level attack surfaces? Why are there not honest conversations about what systems are like?”

I think, in the cyberspace, there’s all this idea that you can be perfect and you’ll be all-knowing and omnipotent. I go into lots of organizations and look at their networks as well as their people processes and decks. Strategically, there’s loads of good stuff around education and cyber awareness. We’ve even got a whole month dedicated to the thing and there’s money being put into the initiative of Cyber First for the UK and CSC. Nevertheless, I’m seeing gaps. If you tell someone you’re going to go and cyberpunch them, you probably should make sure that you’ve got a shield first whereas I’m not seeing the shields. I reckon someone could take that out pretty quickly if they were motivated.

I try to be measured and balanced in how I talk about tax services about cyber stuff as I think it can scare people as well. I mean, it scares me sometimes when I go and look at some stuff thinking, “Jesus, how is this still how is this online? Is it pwned?” There is a probability factor in here just because something is vulnerable doesn’t mean it’s exploitable. Just because it’s exploitable doesn’t mean someone has exploited it. It also doesn’t mean they will exploit it. I literally build honeypot networks, where I’ve done this with entire simulated full networks.

You have to have the right alignment of stuff. There’s a saying that defenders have to be right every day while an attacker only has to be right once. For an attacker to be right, there’s usually about a minimum of seven things that have gone systemically wrong. All have to be in alignment for things to work. If you get into someone’s perimeter network, it doesn’t necessarily mean you’re going to be able to move. People do not talk about how difficult some of this stuff is. In 90 percent of networks, it is a problem. I think it’s complicated and it goes back to the communication. Anyone who’s worked in sales will know that if you try and sell something complicated, it’s a lot bloody harder than if you try and sell something simple. I think that we’re at risk from a society point of view of oversimplifying everything and then making the wrong calls because the hard calls the hard, and the decision-making on complexity is more complex. That’s my kind of view of the world.

What challenges cybersecurity professionals might encounter when working with organizations?

Daniel: I’ve been asked very quickly after scanning significant numbers of assets about what the top five things for the organization to fix are. I don’t know your business, and it depends, doesn’t it? It depends if it’s a long-term customer or if it’s a short-term engagement as well as if this happens often. I talked to people when we did a transformational piece by asking, “How long do you use your probationary period stand for in a contract? If you hire someone. Is it three or six months? In two weeks, for example, what do you think someone’s going to be able to tell you about your business that you don’t already know? How do you think you’re going to come up with an answer of what to do off the back in a day?”

I’ve seen this in the world where a sales organization will parachute a technical person into an organization, and they’ll do a day’s workshop, producing a roadmap. It’s like, “ Okay, I found 50,000 vulnerabilities and 100,000 criticals across 20,000 assets. I have no idea what you should do, mate. I think what you should do is put together a financial package and a structure that tells you what’s really important to make sure you’ve got some money.” Without any money and resources. It doesn’t matter whether you identify five things or 500, you won’t be able to fix them, You don’t just sit there and go run through the process of saying, “Cool, we need a project.” You need to go and get the right support from leadership.

You might as well sit there and make a decision that says, “I don’t care that it’s not batched.” You might shore it up and isolate it on the network. Still, I don’t think I’ve ever walked into an organization and gone, “Is everyone bored sitting around doing nothing?” Largely speaking, teams are overutilized as it is, and that’s with their 90% having a bad posture. Then you throw on a bucket load of vulnerabilities, security requirements, and contractual. Sometimes the answer is just silence.

In some European countries, it’s illegal to scan and finger websites and domains. Is that also the case in the UK?

Daniel: I’m specific with what I ever looked for, and I use loads of passive sources of data. I want to be careful how I phrase this. People should be considerate and careful while looking at legal. We also need to educate people on how this works because the criminals are scanning and doing whatever they want 24/7, 365. We run honeypot networks, and I can find serious, organized crime quite quickly. I don’t think people know exactly how the Internet works. For example, some people are like, “A bazillion cyber attack occurred.” Nonetheless, it’s not a bazillion. They may have sent you to 2 million packets. Trying to define what it is and isn’t a cyber attack, what is an event, what’s an incident, and how to put metrics. That’s one actor.

Also, people from a policymaker through to a personal person don’t really quite get how this works. There is a risk and I’m hoping that at some point the UK government and other governments will reform and change the computer misuse, so we are enabled to defend the country, do research, and do business. There are commercial implications of laws prohibiting basically benign passive actions. Bear with me as I’m not a lawyer. If I write a bit of software for research to ransom with a computer that I own. That shouldn’t be illegal, and it probably would be under the Computing Machines Act as it’s written.

There’s a huge visibility gap. You’ve got what people could use the Donald Rumsfeld Analogy, what people can see, different companies like Audio Visual (AV) providers, DNS providers, Internet Service Providers (ISPs), and lots of telemetry. Nonetheless, there’s a gap as they’re disparate and siloed. Not everyone is going to share their data and build the same picture when they smash different data sources. There is no omnipotence on the internet. I mean, you can send a cat gif, and it could be malware while no one knows about it. Thus, I think it’s important that people understand crime research is much needed.

There’s More! Listen to Our Full Interview with Daniel!

If you have found those interview snippets interesting, don’t miss out on the complete version!

Listen to our full interview with Daniel to learn more about:

Why Daniel believes humans are the greatest strength in protecting their organizations
Three characteristics people should adopt to get into the world of cybersecurity
Daniel’s perspective on cyber attacks from global, national, organizational, and personal levels

And much more!

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, and the Maltego YouTube channel, and follow us for future episodes!

Check out Daniel’s work on Twitter!

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.

Happy investigating!

Case Study: CCP Games Ensures Game Integrity with Maltego

Thu, 14 Sep 2023 18:19:27 +0000

Launched by an Icelandic gaming company, CCP Games, EVE Online is a persistent world, massive multiplayer online role-playing game (MMORPG) renowned for its scale and complexity with regard to player interactions. Players engage in unscripted economic competition, warfare, and political schemes, which often include free transactions of in-game assets. The in-game economy highly resembles that of the real world and thus, poses risk for fraud similar to the real world.

Malicious players exploit EVE Online through three main platform abuses or fraudulent activities which include:

Bot Farming: Using automated bots to accelerate completion of game missions and objectives in order to generate game currency and assets to be re-sold on real-world trading platforms on the surface and/or dark web.
Real-Money Trade: Hacking user accounts to acquire game currency and assets to re-sell on real-world trading platforms on the surface web and/or dark web.
Money Laundering: Using stolen credit card credentials to buy in-game assets on real-world trading platforms on the surface web and/or dark web, only to re-sell the assets to obtain “clean” money.

The CCP Games Security Team is tasked with addressing these fraudulent activities and ensuring integrity of the game. However, the process of manually monitoring and cross-referencing user activities is extremely tedious and time-consuming.

To make their work easier, CCP Games deployed Maltego to become the core tool they use to detect and identify in-game fraud.

Maksym Gryshchenko

CCP Games Security Team

Download this case study now to learn how CCP Games uses Maltego to help suspend more than 90,000 malicious user accounts and make their games safer.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

How to Conduct Operational Threat Intelligence Research with OSINT

Tue, 12 Sep 2023 05:07:28 +0000

Conducting operational threat intelligence research involves systematically gathering, analyzing, and disseminating information about current or emerging threats that could impact an organization’s operations.

In this article, we will delve deeper into the importance of this type of research and its methodologies. By the end, you’ll have a clearer understanding of how to transform data into actionable insights that can help you protect your organization from ever-evolving cyber threats.

What Is Operational Threat Intelligence?

Operational threat intelligence (OTI) is a focused subset of cyber threat intelligence (CTI) which drills down into specific cyber-attacks or ongoing campaigns. While CTI offers a panoramic view of the broader digital threat landscape, OTI provides a granular view of the details of distinct attacks.

For security professionals, the granularity of OTI is invaluable as it provides a comprehensive understanding of a cyber-attack’s nature, the underlying intent (financial, data theft, hacktivism), and the expected duration or progression of the campaign.

With this knowledge, analysts can effectively respond to the immediate threat, and strategize for potential future developments to safeguard their organizations.

How to Conduct Operational Threat Intelligence Research?

1. Define the Objectives –Start with a clear goal:

What are you trying to achieve?
Are you attempting to gain an understanding of industry-specific threats, or investigate a specific incident?

2. Data Collection –Dive deep into both open and closed sources:

Security blogs and websites like KrebsOnSecurity, Dark Reading, and the SANS Internet Storm Center offer insights into the latest threats and vulnerabilities.
Public Forums and communities like InfoSec Exchange on Mastodon or the NetSec subreddit often discuss emerging threats.
Free threat intelligence feeds like AlienVault (OTX) and ThreatFox by AbuseCH.
Paid threat intelligence providers like Recorded Future and CrowdStrike offer threat intelligence feeds that provide data like indicators of compromise (IOCs) or tactics, techniques, and procedures (TTPs).
Industry groups and alliances like the Financial Services ISAC (FS-ISAC) or the Health ISAC share threat intelligence relevant to specific industries.
Honeypots & honeynets: Systems set up to act as decoys, attracting attackers and recording their actions.
Intrusion detection systems (IDS) and intrusion prevention systems (IPS) logs: These systems generate alerts based on recognized malicious patterns.
Firewall and proxy logs: These can reveal potentially malicious traffic or access attempts.

It is important to note that while these sources can provide valuable insights, not all sources are suitable for every organization. The quality and accuracy of intelligence can vary, so it is essential to vet and corroborate information before acting on it.

3. Data Processing –Once you have the data, standardize it. Remove redundancies, enrich it, and filter out the noise through:

Normalization: Threat intelligence can come from many sources, each with its own format and structure. Normalization ensures that all collected data adheres to a consistent format, making it easier to analyze and correlate.
Deduplication: Given the vast amount of data collected, there can be many redundant pieces of information. Deduplication ensures that each piece of threat intelligence is unique.
Enrichment: Raw threat data can be enhanced by adding context. An IP address can be enriched with information about its geographical location, associated domain names, or known malicious activities.
Filtering: Not all collected data is pertinent to an organization’s threat landscape. Filtering ensures that only relevant threat intelligence is retained, allowing analysts to focus on what’s truly important for their specific environment.

4. Analysis –This is where the magic happens! Connect the dots, identify patterns, and pinpoint who’s behind a threat through:

Correlation: Correlation involves linking pieces of information like IOCs or TTPs to identify larger patterns or campaigns. For example, correlating a specific malware hash with an IP address can help identify a coordinated attack from a particular source or attacker.
Trend Analysis: Trend analysis in threat intelligence can help organizations anticipate potential threats or understand the evolution of specific threat vectors. For example, by analyzing the increasing frequency of ransomware attacks in a sector, organizations can prioritize defenses against such threats.
Attribution: Attribution involves determining who is behind a cyber-attack or campaign. This can be incredibly challenging due to adversaries’ use of obfuscation techniques. However, analysts can sometimes identify specific threat groups or nation-state actors by analyzing TTPs, malware types, or even linguistic patterns.

5. Dissemination – Share findings with stakeholders within the organization. This might include IT teams, executives, or other relevant departments.

6. Feedback Loop – Incorporate stakeholder feedback to refine the intelligence process.

7. Operationalization – Convert intelligence into actionable items. Update the firewall rules, train the staff, or recommend further investigations.

8. Review and Iteration – Review and refine the threat intelligence process regularly.

9. Tooling and Automation – Leverage threat intelligence platforms (TIPs) and other tools to automate data collection, processing, and analysis.

10. Training and Collaboration – Train the threat intelligence team on adversaries’ latest TTPs. Collaborate with other organizations, industry groups, and government agencies to share intelligence and best practices.

We’ve also compiled these steps into a PDF that you can take with you.

DOWNLOAD CHEAT SHEET

How Can OSINT Help You Enhance Your Operational Threat Intelligence?

OSINT is crucial in the operational threat intelligence research process, from defining objectives based on ongoing cyber-attack campaigns and trending malware to data collection and analysis.

I already covered some OSINT sources that can improve your operational threat intelligence, so let’s talk about tools now. OSINT tools are not just add-ons to your investigations; they are an integral part of the research process.

Here are some popular and valuable tools:

Amass: An advanced open-source tool designed for network mapping and external asset discovery using OSINT gathering and active reconnaissance techniques.

Use Case:

Identify and map all the external assets belonging to your organization.

Censys: A search engine that allows researchers to ask questions about devices and networks on the Internet.

Use Case:

Identify misconfigured servers, research SSL/TLS configurations, and discover vulnerable systems.

Google Dorks: Advanced search techniques using Google to uncover information that might not be readily visible.

Use Case:

Discover exposed files or databases, identify potential vulnerabilities, and gather data on possible targets.

Maltego: Imagine a tool that not only mines data but deduplicates it, enriches it, and correlates it while visualizing the relationships and making patterns clear. Maltego is a game-changer.

Use Case:

Investigate IP addresses, domains, and email addresses; visualize relationships between different entities and enrich the information using the unique data sources integrated into Maltego.

Onyphe: A search engine for threat intelligence, helping researchers and security professionals gather and correlate information about IP addresses, domains, and other digital assets.

Use Case:

Use Onyphe to find malicious infrastructure like C2 systems.

Shodan: Often dubbed “the search engine for the Internet of Things,” Shodan allows users to discover devices connected to the Internet, ranging from servers to smart devices.

Use Case:

Identify exposed and vulnerable systems, research misconfigured servers or databases, and monitor the exposure of an organization’s assets.

theHarvester: A tool designed to gather emails, subdomains, hosts, and more related to a specific domain.

Use Case:

Conduct reconnaissance on a target domain, identify potential phishing vectors, and map an organization’s online footprint.

Recon-ng: A reconnaissance framework with modular tools to gather data and integrate with popular databases.

Use Case:

Automate data-gathering tasks, find relationships between collected data, and consolidate data for analysis.

SpiderFoot: An automation tool for conducting OSINT and threat intelligence research on IPs, domains, email addresses, and more.

Use Case:

Discover network infrastructure details, identify data leaks, and find potential vulnerabilities.

The Wayback Machine: An archive of the Internet that allows users to see historical versions of websites.

Use Case:

Investigate changes on a website, recover lost information, and research defunct services or products.

If your team is looking for specific threat intelligence providers, you can explore our repository of 36 providers tailored for SOC teams and suitable for other teams that incorporate OSINT into their daily operations.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

How to Make the Most of Your Operational Threat Intelligence?

Operational threat intelligence is not just about collecting data; It is about discerning actionable patterns, understanding connections, and foreseeing potential threats.

Maltego, with its unmatched data integrations and intuitive visualizations, can help you simplify these tasks as it transforms information into comprehensive maps, revealing hidden relationships and patterns that might have otherwise gone unnoticed.

If you want to see how to use it in practice, check out our series on exploring your attack surface and automating your assessment with Maltego, where we demonstrate all the necessary steps.

Don’t forget to download your copy of the 36 top threat intelligence providers below, follow us on Twitter, LinkedIn, and Mastodon, and sign up for our email newsletter so you don’t miss out on updates and news!

Happy OSINT’ing!

About the Author

Mario Rojas

Top 36 Threat Intelligence Providers for SOC Teams

Mon, 11 Sep 2023 05:13:26 +0000

A Security Operations Center (SOC) team is tasked with continuously monitoring its environment to detect, analyze, and respond to remarkable cybersecurity events that might become incidents, ultimately improving the security posture of the organization.

However, for SOC teams to effectively monitor their environment, it is not enough to simply deploy security systems and tools that alert them to an indiscriminate number of events. They need to know what internal or external threat actors are doing, what their activity may look like, and how to find traces of said activity across their infrastructure.

Usually, the traces left behind by threat actors and picked up by the monitoring systems or hunting teams will be known as observables or indicators of compromise (IOCs)—IP addresses, host and domain names, email addresses, filenames, file hashes, and even log entries such as unusual login attempts —which, on their own and out of context, won’t be enough to conduct an in-depth investigation.

For a proper analysis that can lead to an effective assessment, including correlation to known or trending attacks as well as potential attribution, SOC analysts need to enrich and contextualize the traces found in their internal systems. This is where internal information and especially threat intelligence can help.

Threat Intelligence: Sources, Feeds, Platforms, and Providers

Threat intelligence is actionable and timely knowledge rooted in data. It provides analysts with the necessary context to understand threat actors’ motivations, methods, tools, and infrastructure, helping them prevent or mitigate attacks.

Practically speaking, threat intelligence relevant to an organization is generated by combining the traces found in the organization’s internal telemetry—such as firewall and event logs—with industry-specific threat data and information obtained through different intel sources, feeds, platforms, or providers.

Sources and Feeds

Two common threat intelligence sources are open-source intelligence (OSINT) and threat intelligence feeds. OSINT refers to intelligence derived from publicly available information, which is collected, analyzed, and shared to support specific investigations. Threat intelligence feeds are non-prioritized streams of data or digital artifacts and focus on specific areas or data types, such as suspicious domains, malicious URLs, known malware hashes, and IP addresses associated with malicious activity, among others.

While free threat intelligence feeds are usually gathered from open sources, paid threat intelligence feeds provide curated and contextualized data from closed sources, such as the dark web and cybercrime forums, or they may aggregate and process open-source feeds.

Platforms and Providers

A threat intelligence platform (TIP) is software used to organize several feeds—both free and paid—into a single stream. It makes them actionable across different protection, detection, and reaction tools.

Lastly, a threat intelligence provider is a vendor that collects and produces threat intelligence indicators and reports, sometimes using a mix of human and automated analysis. The provider then offers the intelligence via premium data feeds, as a report (an example would be the Mandiant’s APT1 report), or as part of a software product.

The human-generated part may include motivations, tactics, techniques, and procedures (TTPs) and attribution to a known actor, linking to past or ongoing campaigns, signatures for detection and hunting (such as Sigma or YARA rules), as well as response and forensic strategies. The automated part provides lists of observables in machine-readable format.

Incorporating Threat Intelligence into the SOC Team

It’s easy to see how one may stumble around in search of the right product to incorporate into their SOC team just by looking at the variety of options out there. With that in mind, SOC teams should first gain an insider view and comprehensive understanding of the following:

Their network infrastructure
The type of risks unique to their industry
Where their security posture stands based on their current resources and capabilities to manage defensive and reactive activities
Their available budget
Resources they can dedicate to the project

However, even with the previous elements established, it is often difficult for SOC teams to choose the threat intelligence solution best suited to them and to determine how to properly take advantage of the data it provides without further burdening the analysts.

Maltego’s Top 36 Threat Intelligence Providers for SOC Teams

According to the 2022 SANS Cyber Threat Intelligence (CTI) Survey published in February 2022, the types of threat intelligence that are most useful for CTI operations include:

Detailed information about malware being used in attacks
Information about vulnerabilities being targeted by attackers
Broad information about attacker trends
Specific threat behaviors and TTPs of the adversary
Specific IOCs to plug into IT and security infrastructure to block or find attacks

Source: SANS 2022 Cyber Threat Intelligence Survey

Based on these criteria, we have created a list of high-quality threat intelligence options for SOC teams that have proven to be among our end-users’ favorites and are suitable for all budget sizes.

The providers are divided into four categories:

Infrastructure & Network Information (featured providers include: Shodan, Host.io, and VirusTotal)
Malware, TTPs & Vulnerabilities (featured providers include: Recorded Future, Intel471, and alphaMountain)
Deep & Dark Web / Cryptocurrency (featured providers include: CipherTrace, Silobreaker, and SpyCloud)
Endpoint & Security Events (featured providers include: CrowdStrike, IBM QRadar, and Splunk)

The list is sorted in alphabetical order and does not indicate any ranking or preference.

Download Your Free Copy

Download this whitepaper for detailed descriptions and evaluations of the top threat intelligence providers. This will help you make accurate and suitable purchasing decisions for the needs and responsibilities of your SOC teams.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, or sign up to our email newsletter for more whitepapers, case studies, and SOC tips similar to this!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Dispatches from the CTO: Maltego ID, Unlocking the power of Maltego with Authentication

Tue, 05 Sep 2023 12:34:25 +0000

Welcome back to another dispatch from the CTO! This is the second in our blog and webinar series on Maltego’s product roadmap. If you missed the first one, check it out here.

Next Up: Maltego ID

The next release of Maltego is all about identity. For once, this isn’t about the identity of investigation subjects, but a focus on user management.

We’ve known for a while that we have a gap when it comes to serving our organizations with multiple users. Our current user management model has admins manually tracking license keys for software and API keys for data access. The next Maltego Desktop Client release (Version 4.6.0) will put us on the road to addressing this and several other identity and user management related topics.

Starting with the Maltego ID for CE

This fall, we will deploy the new Maltego ID platform for CE users with the Maltego Desktop Client Version 4.6.0 release. As you may know, CE users already access Maltego with a username and password rather than using a license key, so CE users will experience minimal change other than the seamless backend transition to Maltego ID.

With Maltego ID in place, CE users will be able to add multi-factor authentication (MFA) to their accounts. This ensures security for your Maltego CE logins. Existing accounts will continue to function as they do today. Once upgraded to Version 4.6.0, you can trigger the migration of your CE account to Maltego ID simply by changing your password.

We are staging the 4.6.0 release carefully so it will not impact the ability of Pro or Enterprise users’ access to Maltego or any ongoing investigations. Future releases will give other users the option of migrating to Maltego ID and simplifying the management of their Maltego experience.

More capabilities to come, also for Pro and Enterprise

We have several exciting new capabilities in development for the Maltego platform that will layer on top of the Maltego ID to provide additional services. We are keenly aware that centralized user management, single sign-on, auditing, and accounting are all desperately needed features for our enterprise, government, and law enforcement customers. Maltego ID solves many of them directly and makes the rest possible.

I’ve already mentioned that MFA becomes an option for Maltego ID accounts at launch. We know that our users pay careful attention to security, so we will soon release the option for federated authentication (via Microsoft and Google) as we roll out Maltego ID for all Maltego users. If your organization uses either of these authentication platforms, you will be able to configure Maltego ID so that your existing accounts will just work.

Extending the federated options, we will also announce Security Assertion Markup Language (SAML) integration for customers with enterprise authentication requirements. Finally, in terms of authentication, we will offer an on-premise version of Maltego ID that will integrate with internal sources of authentication for eligible customers.

As we deploy Maltego ID to larger audiences, such as Pro and Enterprise customers, we will start migrating some of our related services to Maltego ID, such as our learning platform Spark, the Maltego community, and some new tools that aren’t announced yet. Our goal is to simplify your user experience by reducing the number of accounts and unifying the user experience between Maltego tools.

A centralized admin portal for Pro and Enterprise users

Additionally, with Maltego ID, Enterprise and Pro customers will be able to manage their licenses and user entitlements in a centralized admin portal. This will let you say goodbye to spreadsheets for tracking API and license keys.

Maltego ID will also enable users to load a saved configuration at login. This removes the need for users to enter data provider API keys, as they can be managed centrally. Customers using Maltego in Virtual Desktop Infrastructure (VDI) environments can look forward to a significantly improved experience.

We also have several browser-based tools already in trails which will leverage Maltego ID further. Stay tuned for updates on those tools!

Stay tuned for Version 4.6.0 and more!

I’m really excited about all the new capabilities that Maltego ID will unlock for our customers and user community. We’ve listened carefully to the administrative and security concerns shared by our customers. We think Maltego ID addresses these concerns and sets us up to be well positioned to rapidly support new products and capabilities in the future.

While Maltego ID is the big feature in Version 4.6.0, it’s not the only improvement. We’ll share more features coming and bugs fixed as part of Version 4.6.0 shortly.

Be careful out there.

About the Author

Ben April

Ben April is the Chief Technology Officer at Maltego Technologies GmbH. Prior to Maltego, Ben was the CTO of Farsight Security, Inc. (acquired by DomainTools LLC). In his time at Farsight Security, Ben and his team drove advances in the fields of real-time privacy centric Internet telemetry and Passive DNS technology. Ben is on a lifelong crusade to eliminate the technical and policy barriers that impede robust data-sharing among white-hat security researchers. Ben is also a volunteer sysadmin and coder for some trusted-community security projects.

Investigator Toolkit August 2023: Cheat Sheets for Faster and Spot-on Workflows

Thu, 31 Aug 2023 08:00:03 +0000

Investigator Toolkit: Quick Starts to Using Maltego Hub Items in Real-life Investigations

Where to Find the Investigator Toolkit?

All Previous Investigator Toolkit Roundups

Investigator Toolkit August Roundup

In August, we featured the following three Hub items and their use cases in the Investigator Toolkit series:

Let’s dive straight into how to use these Hub items for network investigation, Bitcoin transaction investigation, and threat intelligence!

News Transforms: Network Investigation

The News Transforms in Maltego allow investigators to search the web for news articles and find context relevant to the persons, companies, locations, and other topics involved in an investigation.

See how we leverage the News Transforms in Maltego to investigate a German company and explore a network of multiple websites publishing far-right views in the US.

Tatum Blockchain Explorer: Bitcoin Transaction Investigation

Thanks to the new V3 Transform Protocol and graph-out feature, investigators can now run the Tatum Blockchain Explorer Peel Chains Transform and retrieve a whole graph as output in one click, focusing on analyzing the data.

Check out our latest CTO Webinar by Ben April to see the Peel Chains Transform in action.

STIX 2 Utilities: Threat Intelligence

With the V3 Transform Protocol and graph-out feature, investigators can now obtain a structured graph of all the Entities referenced in the provided URL in Maltego by running the STIX 2 Utilities Get Graph Transform.

Watch the live demo of Maltego’s CTO, Ben April, demonstrating this new feature to learn more about the powerful capabilities of V3 Transform Protocol.

Check out the Investigator Toolkit series now!

In the following months, we will continue digging into different Hub items available in Maltego and providing best practice tips for investigators.

Happy Investigating!

Everything You Need to Know About Operational Security (OPSEC): Why, What, and How

Tue, 29 Aug 2023 14:18:04 +0000

Operational security (OPSEC) is a fundamental component of any intelligence investigation. Although the term has its origins in the military environment, it has come to have greater importance in the fields of Cyber Threat intelligence (CTI), person of interest analysis and certainly during Open-Source Intelligence (OSINT) investigations. The aim is to ensure protection; be it in regard to the integrity of the investigation, or the safety of the investigators themselves. This guide will serve to help you to define OPSEC, provide a basic methodology for determining your “threat environment”, and provide some mitigation measures to reduce the threat to you by implementing additional protection measures for use during your investigations.

Table of Content

What is OPSEC?

Firstly, what is OPSEC? The definition has been clearly defined in the military as “a capability that identifies and controls critical information, indicators of friendly force actions attendant to military operations, and incorporates countermeasures to reduce the risk of an adversary exploiting vulnerabilities.” In the OSINT sphere, it has also been defined to mean “the collective steps that investigators can formulate into a process that they can follow during an OSINT investigation to remain anonymous and keep their activity undiscovered. OPSEC can be achieved through a combination of software, hardware, and actions.” Both definitions are valuable in that our end goal is to combine elements of both into our particular mission statement.

With OPSEC, we seek to:

Identify and control critical information
Reduce the risk of an adversary exploiting vulnerabilities
Conceal our real identity and seek to remain anonymous
Keep our activities undiscovered or difficult to track

On the one hand, we want to protect practitioners of OSINT investigations from disclosing any information about themselves or those they associate with, as well as to ensure that our targets remain unaware of our scrutiny. As to the first point, OSINT influencer Nico Dekens states, “We all have something to protect or hide”. Were we to expose ourselves to the targets of our investigations, we are providing them with a target; we should always seek to remain hidden, observe and report – exposure means increased personal risk. As to the second point which very much follows from the first, alerting the targets of our investigations may lead them to change their behaviors, with potentially catastrophic consequences. Our target may reduce our access to previously available information by deleting social media accounts, removing images and posts from forums, notifying other target members, etc. Never pretend that the targets of our investigations will not seek to hinder our activities if they can do so.

Because the information which we seek to find, that which we seek to protect, and the types of investigations which we engage in will change, you will need to adapt your OPSEC to your current situation. To do so, you will need to conduct threat modelling. The following section will explain how to do just that.

As a side note, please also remember that OPSEC measures in and of themselves can provide indications as to both who is engaging in an investigation, and their level of professionalism. For instance, using a Sock Puppet account with an IP that can be tracked back to the federal police is a sure way to inform your target that they are under investigation.

How to Threat Model for OPSEC

OPSEC is not a static concept. Depending on the types of activities you are conducting, you will need to adapt your OPSEC measures. In order to evaluate your activities, their risk, and the necessary measures to be implemented, we need to conduct threat modelling. This allows us to determine the degree of security which we want to achieve. This threat modelling can be done in a fairly informal manner, merely by taking the time to write down the basic information pertaining to the following points:

Know your target. A project investigating Threat Actors or organized crime groups, or malware and its developer, has a different level of OPSEC requirements from a project looking into the social media profile of a 16-year-old forum troll.
Identify potential threats. Possible threats to sensitive data need to be identified and potentially documented. Consider that threats may exist externally through third parties, as well as internally. Data theft or breaches (either accidental or deliberate) can publish a wealth of data about you personally without your knowledge.
Analyze security vulnerabilities. You must perform an objective analysis of your current security measure implementation strategy. Look for potential weaknesses which can be exploited. This covers all types of vulnerabilities, from cross-usage of devices to digital foot printing, usage of specific monitoring/tracking tools, etc.
Determine the risk level of each vulnerability. Consider the damage that could be caused should your data be compromised, or if the organization may suffer as a result of your laxity.

It is recommended that, having gathered the information relating to the points, you speak to the relevant individuals who can help you with evaluating whether you belong to the group needing to implement Level 1 OPSEC measures, or Level 2. This may be the Chief Technical Officer (CTO) and/or Information Security Officer (ISO); all organizations are different but should have someone who is an authority and who can help guide your assessment.

Having done this, you can then move on to the next step of the OPSEC process:

Implement a mitigation plan. Having determined all the necessary information, you can start to build up a mitigation plan which includes those technical and organizational measures to ensure that risks are addressed based on their criticality – avoided, transferred, mitigated, or accepted.

Depending on the results of your Threat Modelling, the measures which you may implement could consist of deploying a VPN, creating a Sock Puppet account for the social media platforms you use, and utilizing a password manager.

OPSEC is Integral to Every Operation

Every OSINT investigator should remember that, as stated earlier, there are always risks inherent in investigations. Additionally, OPSEC should be practiced at all times in order to ensure that the behaviors become ingrained and second nature. Even by investigating seemingly innocuous websites, profiles or malware, we may inadvertently put ourselves and others at risk – our OPSEC measures protect us from this potential risk.

Referring once more to the military space, OPSEC is considered integral to every operation as it serves as “a force multiplier that can maximize operational effectiveness by saving lives and resources when integrated into operations, activities, plans, exercises, training, and capabilities.” It may seem hyperbolic, however, better to prepare for the worst and avoid any surprises in the future.

If you leak information about yourself, then you are putting yourself at risk. The types of investigations which you are conducting may sometimes delve into the less savory areas of the internet and focus on real criminal groups or threat actors. Even if these are not the type of investigations you are conducting, and even if you only use Maltego to play with, you should still be following basic OPSEC principles; there are no excuses or exceptions.

Now that you hopefully have a good understanding of the definition, context, and importance of OPSEC, we have provided a list of measures and tools which can assist you here.

Download the Guide to Safeguard Yourself With OPSEC & Security Tools and Measures In Place!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, and sign up for our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Aaron Dixon

Aaron Dixon is a former member of the New Zealand Military who has spent the last 6 years working as a consultant in the areas of IT Security and Compliance, Data Privacy, Digital Forensics and Cyber Threat Intelligence. He holds a bachelor’s degree with a double major in History and Defense Studies, as well as a Postgraduate Certificate in International Security. His primary areas of interest are terrorism and geopolitical conflict, as well as focusing on the foundational processes and principles of the Intelligence Cycle.

OSINT Data to Support Subpoenaing Internet Service Providers

Wed, 23 Aug 2023 14:33:22 +0000

When a crime is committed online or involves digital evidence, prosecuting suspects becomes more difficult. In many cases, the identity of individuals and organizations behind illegal online activities—such as hacking, child sexual abuse, cyberattacks, or online fraud—may be masked or obfuscated. In other cases, digital evidence like websites or emails can be easily modified or erased.

To support their investigations, prosecutors may turn to subpoenaing internet service providers (ISPs). Subpoenas compel these companies to disclose records or information of their customers and users that are critical to building a case against a suspect or shedding light on criminal activities.

Applying for a subpoena order, however, comes with a set of challenges of its own. There are legal restrictions in place to ensure subpoena requests stay within reasonable boundaries and away from privacy violation.

In this article, we will discuss how open source intelligence (OSINT) helps build a subpoena request, and provide a cheat sheet that lists out what OSINT data you should include to successfully subpoena an internet service provider (ISP).

Table of Content

Establishing Relevance is Key to Building Your Case

There is no clear set of rules that helps evaluate subpoena requests, and the approval or disapproval of subpoena requests depends largely on the jurisdiction, the judges, and the evidence at hand.

One of the key challenges to issuing a subpoena request is relevance. Prosecutors must justify the scope of the subpoena and prove relevance between the criminal case and the information requested. This is especially under scrutiny when the disclosure of information can potentially infringe upon an individual’s right to privacy.

Another challenge prosecutors face is compliance. Compliance of the subpoena requests ensures that the subpoena is legally compliant, valid, and enforceable, and that the evidence obtained via the subpoenas is admissible in court.

When subpoenaing an ISP, you need to prove that the suspect has used the ISP’s network services to commit a crime. Each ISP serves a specific region, location, and jurisdiction. It’s important to identify the correct ISP behind the public IP addresses connected to the suspect’s activities.

For example, when starting a case with a domain, the primary goal is to obtain information related to the suspect and their activities connected to that domain.

It is crucial to establish a clear connection between the suspect and the domain in question (domain attribution). This can be achieved through various methods such as examining the domain registry record, analyzing shared IP addresses, or exploring the content hosted on the website associated with the domain.

An example scenario: Let’s assume we have a suspect involved in cybercrimes and we have obtained a domain associated with their activities. Our first step would be to perform a WHOIS lookup on the domain to gather details about the domain owner. Additionally, we could conduct a reverse IP lookup to check for other domains hosted on the same server, potentially revealing related websites.

Once we have confirmed the suspect’s association with the domain, the next step is to obtain the public IP address(es) associated with the domain. This information is vital in identifying the location of the server hosting the domain and the ISP providing those addresses. This will provide valuable insights into the geographical location and jurisdiction under which the domain operates.

All of this comes down to being able to prove in a subpoena request that:

The ISP is indeed the right one to provide relevant information to the case.
The suspect is indeed associated with the evidence and requested information.

Using OSINT to Support Subpoenaing ISPs

It is essential to prepare a detailed written request for subpoenas which describes the investigation, its purpose, and the specific information sought. In the case of online crimes, understanding how open source intelligence (OSINT) data is stored, aggregated, and obtained can be very useful in building your case.

OSINT provides law enforcement agencies and legal professionals with access to a vast range of online information. Having OSINT tools allow law enforcement to have access to information gathered from publicly available sources and aggregated into structured databases.

The use of OSINT in law enforcement faces controversy. However, it is true that OSINT enables investigators to obtain real-time data from the internet, which is crucial for cyber-based crimes where digital evidence often gets destroyed or modified. By cross-referencing OSINT with traditional investigative methods, investigators can form a more comprehensive understanding of the facts of the crime or even pinpoint the identity of the suspects.

Some of the information needed via subpoenaing an ISP can actually be found using OSINT. If you know where to look for information, you might even be able to avoid jumping through multiple hoops of subpoenas and directly build a case that leads you to the most crucial piece of the puzzle.

Solidating Your Subpoena Request with OSINT!

To better support law enforcement officers with their subpoena requests to an ISP, we list out the most relevant domain data you need to build your criminal case, as well as a set of OSINT sources law enforcement can use to obtain each piece of information.

Download the cheat sheet now!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

We hope you find this cheat sheet helpful for you and your team by incorporating OSINT in your subpoena requests to form a comprehensive criminal case that is relevant and compliant.

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Sergio Leal Rodriguez

How to Use Sock Puppet Accounts to Gather Social Media Intelligence

Tue, 22 Aug 2023 14:52:57 +0000

It’s another day operating as an open source intelligence (OSINT) analyst, engaging in digital exploration and online observation of a target person’s social media presence. Yes, there is a euphemism for endlessly scrolling in search of meaningful information for an investigation. And it can be all fun and games until you hit the “like” button under a post at 54 weeks deep. Your heart stops. Your palms are sweaty. Then you remember you’re using a sock puppet account, and the sky is blue again.

This is one of the most common scenarios that an OSINT analyst may face while gathering open source information for an investigation, and it would be terrible if that “like” came from any of our personal accounts.

The second worst-case scenario is that we are indeed using a sock puppet account, but that the target is a tricky one. Oftentimes, a target person may be overly cautious, and decide to look into the curious person behind our follow/friend request – and we, on the other side of the sock puppet, have zero friends, posts, or connections. This would be a large setback, and could set us far, far back.

In this article, we will share useful tips and tricks with all of you, our dear sock puppet accounts managers, on the appropriate operational security measures to take while gathering gated social media information. We also highlight the types of information that can be collected through sock puppet accounts while ensuring the safety of both the investigators and their organizations.

Table of Content

Where to Collect Social Media Information
- Passive SOCMINT
- Active SOCMINT
Must-Do Checklist Before Diving into Investigations Using Sock Puppet Accounts
- Immediately review and set privacy settings for the platform to limit information visibility
- For passive research, keep the account completely locked down and avoid making the profile public
- For active research, create a realistic profile with a suitable backstory, and ensure that it resembles that of a real person
- Use generic landscape photos rather than someone else’s identity, and be cautious with stock images
- Engage in natural activities like posting links and liking pages to mimic genuine user behavior
How to Use Maltego in Combination with Sock Puppet Accounts
Stay Safe During SOCMINT Investigations with Sock Puppet Accounts

To succeed in gathering social media intelligence (SOCMINT), start by identifying relevant information and objectives for your search. You should explore various platforms and public databases that aid comprehensive investigations. The key ones to focus on are:

Investing time to understand a social media platform may seem daunting, but it’s a worthwhile endeavor. Understanding the use of these social networks adds an extra layer of security to our operations.

The availability of this information may vary depending on individual privacy settings, platform policies, and the content users choose to share.

Passive SOCMINT

Some social media platforms allow users to see the target’s information and activities but will notify the target that someone has visited their profile (e.g. LinkedIn). This is one of the reasons why we need to have our sock puppet accounts from different social media platforms ready to go. Even if you are simply browsing for information, you need to make sure to do it without revealing your identity.

Active SOCMINT

On some social media platforms, the content we need–posts, stories, contacts–are not accessible due to the targets’ privacy settings. In the case where we must interact with the target in some way (for example, sending a friend request) to obtain access, we are employing the active SOCMINT technique.

Whether your chosen approach is passive or active, you should always navigate with the idea that all online activity can be monitored and identified. Understanding the functionalities and privacy settings of each platform gives us a huge advantage when using it for investigative purposes. Mastering the workings of these social media sites and platforms will optimize OSINT and SOCMINT investigations and provide optimal results.

Must-Do Checklist Before Diving into Investigations Using Sock Puppet Accounts

If you haven’t yet set up your sock puppet accounts, this article might be beneficial for you to read first, Creating Sock Puppets for Your Investigations. Now that you’re all set, let’s get started in the next steps to make your sock puppet accounts as safe and legitimate as possible:

1. Immediately review and set privacy settings for the platform to limit information visibility:

Take the time to carefully work through each individual platform’s privacy settings, and configure these to restrict the amount of personal information visible to others.
Carefully adjust who can see your posts, personal details, and contact information to minimize exposure to the public and potential adversaries.

2. For passive research, keep the account completely locked down and avoid making the profile public:

If you’re conducting passive research and don’t intend to engage with others, it’s best to keep your account private and locked down.
By limiting access to your profile, you reduce the risk of unwanted attention or intrusion while still being in a position to observe others’ public content.

3. For active research, create a realistic profile with a suitable backstory, and ensure that it resembles that of a real person:

When engaging in active research, such as interacting with subjects, it’s crucial to create a credible and believable profile.
Craft a backstory for the profile that aligns with the persona you want to portray and ensure that it matches the platform’s user demographics.
Ensure your profile has enough friends, followers, and activity to appear authentic, as sparse profiles may raise suspicion.

4. Use generic landscape photos rather than someone else’s identity, and be cautious with stock images:

Avoid using pictures of real people, especially without their permission, as this can lead to identity theft concerns and legal issues.
Opt for generic landscape photos or images that don’t reveal any specific personal details to safeguard your own privacy and respect others’ rights.
Be cautious when using stock images as some social media algorithms can detect their use, potentially leading to account suspension or scrutiny.

5. Engage in natural activities like posting links and liking pages to mimic genuine user behavior:

Once your profile is set up, engage in natural activities that reflect how a real person would use the platform.
Post links to articles or content of interest, like pages related to your profile’s interests, and participate in discussions to appear authentic.
Mimicking genuine user behavior will help convince the platform and other users that your account represents a legitimate user rather than a fake or malicious entity.

How to Use Maltego in Combination with Sock Puppet Accounts

Using Maltego in OSINT and SOCMINT investigations is a safe way to collect information.

Through the use of Maltego, we can gather a significant amount of the information we need in a discreet manner, without the need to directly visit social media sites. This is made possible by utilizing different connectors to consolidate data. However, there are times when delving deeper into social might require the use of proxy accounts, commonly referred to as sock puppet accounts.

In the Properties window of each returned Entity on the Maltego graph, you can find links to the source of the information retrieved, such as the original social media profiles. Visiting the original account may be beneficial and allow you to gather additional information about the target, or simply to verify if this account contains the data you are looking for.

It’s not a bad thing to be switching between Maltego and the browser of your preference. An instance of additional information that we might come across involves the target incorporating data or details about their presence on different social media platforms within their profile description.

In our example, we will start with an Instagram Entity. Here, you can paste the complete ID, Alias, or URL of the Entity you want to investigate.

Now, you will be able to run a Transform to see the Name and Properties of the account of interest.

In this case, the Transform result tells us that this account belongs to Taylor Swift. From here, you may look into other details of the account in question and pivot further to Followers, Following, and other pieces of information that are pertinent to your investigation.

Stay Safe During SOCMINT Investigations with Sock Puppet Accounts

To help you conduct a thorough check on whether your sock puppet operation is properly set up and running, we put together a checklist that you can download. This checklist includes all the steps mentioned above and more tips and tricks to try out.

Download the checklist and share it with your team now!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Daphnée Aguilar

The Pivot Podcast: Women in Cyber and IN Security Movement with Jane Frankland

Tue, 15 Aug 2023 08:00:51 +0000

In this episode for The Pivot podcast, we welcome Jane Frankland!

Jane is a tech entrepreneur, book author, international speaker, and passionate women’s change agent. She is the founder of the IN Security Movement and the author of In Security: Why a Failure to Attract and Retain Women in Cybersecurity is Making Us All Less Safe. With more than 25 years of experience in the field, Jane has built her own penetration company and held senior executive roles at information technology organizations.

Today she is represented by The London Speaking Bureau and is committed to establishing women in security as a standard, not an exception, through her consulting services, training programs, media appearances, speaking engagements, and the Women in Cybersecurity Podcast.

In this episode, Jane dives deep into the current landscape of the cyber world, elaborating on the challenges and presenting potential solutions. She discusses the ’enabler’ knowledge gap between people in cybersecurity and company shareholders, the obstacles that women face when trying to get their foot in the door of the industry, and many more.

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

The Pivot: Your New OSINT and Infosec Podcast

Where to Listen to The Pivot? 

Tell us a bit about yourself!

Jane: My name is Jane, and I work in cybersecurity. I’ve been in the industry for 25 years. I came into the industry starting my own penetration testing company, and I’ve never met anyone who’s done this. It’s absolutely crazy because my background was actually art and design.

After graduating, I fell pregnant with my first son. I’ve got three kids and started working as a designer. I had an agent, and everything was going well, but the money wasn’t coming in. Thus, I was encouraged and decided to change my career. I entered sales, which was also something that I thought I’d never do as an introvert.

I’d always been interested in technology, so I ended up falling into technology by meeting a new boyfriend. We started a company together, and I suggested leading with security since it was something that I was interested in. That’s how I started in the industry, and everything was built from there.

Tell us what you are up to these days!

Jane: I work as a consultant, as a trainer, as a speaker, and also as an influencer. As a consultant, sometimes I go into companies and work with leaders to help them better perform by building performing teams or attracting and retaining more women. From time to time, there’s training and workshop involved to sharpen certain skills and help people become more aware of things like, Why is this important? Why does it matter? What’s in it for me? In general, I help them build awareness and boost certain skills in terms of the consulting and training aspect.

For talks, I’m typically engaged as a keynote speaker. I’ll go in and open events, go onto a panel, facilitate a panel, or even host a whole event at times. That’s how I work as a speaker. As an influencer, I work with big brands by writing to get eyes on what they’re doing or drive my network to an event or a promotion. I only work with brands who believe in the mission I’m working on and meet my criteria.

Aside from all of that, I have the IN Security Movement, which followed on from my book. It’s about how we can improve the current situation so that we are all winning, and the solutions come from research. We don’t have great data or enough data on some situations. For instance, I did some research on events and looked into areas like what happens at events, how targeted women are from a harassment perspective or inappropriate behavior perspective, and how women want to speak at events.

I also act as a voice for the voiceless. I’m self-employed, so I’m able to be more free sometimes with how I communicate. There’s a lot of silencing going on, and people are afraid of or not allowed to express themselves, so a lot of people contact me and say, “This is happening. Help me.” I’ll bring that awareness without naming people out into the market so that there’s more understanding rather than misunderstandings.

What got you into this world of cyber? Did you have a proper foundation that helped or propelled you to where you are?

Jane: I trained as a textile designer, so I see trends and patterns, which come easily to me. I was never a hands-on hacker, although I built a hacking or penetration testing company. Through observing the trends, I can see where the market is going and things of that sort, which is useful for me. I could have gone into the technical part if I’d wanted to, but to be frank with you, I’ve resisted doing that. It’s kind of intriguing to me. I’ve chosen not to do that because I enjoy people and more of the business side to it.

It’s interesting to bring this up due to someone I spoke to recently. I met an amazing woman in the UK, and she talked about the business side of cyber. What she was saying was particularly interesting to me that cyber is actually in the wrong category. It’s been placed in technology. Nevertheless, it should be placed in business, and if we were to do that, perhaps some of our challenges for budget or even recruitment would enhance. For me, it’s always been about the people side and the business side of things that’s been more interesting than being like a hands on techie.

What do you think the gap is in terms of getting shareholders to understand that people in cyber are enablers for business in case of an attack?

Jane: I think we need to expand our thinking capabilities, polish our understanding and awareness, and prevent from becoming so rigid. We need to understand the business much more. There are several aspects in cyber that are very narrow. We are in our little bubble where all we can see is risks around us. The work is coming from that at the moment when you look at how under-resourced many of us are, the attacks that are taking place, and all the opportunities for attackers. It’s even more concerning because there’s so much pressure, demand, and burnout on cybersecurity professionals right now and from a leadership perspective as well.

Same for the business side, too. They need to understand it from us. There should be a meeting between the two or the multiple stakeholders to inform all parties as to what exactly we are doing. Then, we can come together, sort out a problem, and decide who is accountable or not for the given risks. That’s what I would say, better understanding from all parties. There’s an intermediary involved in that. Some companies do have the luxury of being the bridge builder, moving projects on, and helping with that flow, whereas others don’t.

You’ve dedicated yourself to exposing and growing people in the industry. What is that like, and what are the challenges you face?

Jane: I do a lot of development, leadership training, coaching, and mentoring a whole variety of people to evolve. I would say I absolutely love that work because I never know what I’m going to get, and that requires me to think creatively and support the people involved. I love seeing people develop, improve, and just fly. It’s so rewarding, and it makes me proud to have even been a part of their world.

I’m all about relationships. People say to me, “You genuinely care.” I genuinely do because I am a people person, so I love interacting with people and finding out about them. I’ve put 356 women through my the IN Security scholarships to attend Black Hat in Europe, which is about a value of nearly half a million US dollars. What’s amazing is, for me, when women come back and say, “It literally changed my life. I can’t thank you enough.”

Those little stories really keep me going. It isn’t easy to be an entrepreneur in terms of what I’m doing. I’m breaking ground all the time, and there’s no one there to catch me when I fall. There isn’t because I’m a leader of my business. I’m making decisions and taking risks based on signals that I get from the market, having conversations, looking at trends, and also following my intuition.

One of your biggest focus points is empowering more women in the industry, giving them a stronger foothold in the industry, or getting their feet in the door. What has that been like?

Jane: I’m like an ambassador wherever I go. I look for talent and be the ambassador for cyber. I’m not pitching every person that I see, but I’m listening out for clues. I’m always on the lookout for people who could come into our industry. It’s built into my DNA. What I found with this work is that it’s quite hard to get people into the industry. The media reports say that we need to get more women into the industry. However, there are existing blockers. If you are a woman, it’s not uncommon for you to find that it might take you a year or longer to get into the industry. It’s still a challenge.

Be prepared for it to be hard to enter and for you to have to jump through certain hoops in order to do that. One woman that I met at an event was a vet and highly qualified. I want to be specific with this, not a veteran, but a vet, someone who has practiced and been educated for seven years. It’s one of the most difficult degrees to get into because you need all of the sciences and everything. I had a talk with her, and she was very interested and would like to join this industry.

I enabled certain things for her, gave her more information, introduced her to certain people, spoke at events as well as promoted and connected her to other people. She had to come in as a coder and go into software development in order to move into cyber because no one in cyber would take her on. It was that much of a challenge, and sometimes you are going to have to weave your way into security in order to get into it. It’s not as easy as it should be.

Check current job openings at Maltego here.

How do women face more challenges getting into cyber and what can be done to alleviate that?

Jane: It’s really important not to make women wrong. It’s very easy for leaders or hiring managers to say, “We don’t have enough women. There aren’t enough women in the industry.” Then they blame women for the lack of women. The women are there. Women want to come into this industry. I want to be clear on that. We’re doing better when it comes to raising awareness by going into schools, speaking at events, and having articles that are in different papers or magazines. We’re informing early entrance, whether they’re kids in school, in college, university, or even younger women wanting to pivot, telling them, “This is how diverse an industry it is. Come join us. We need you.” Still, we can do more of that. We can always extend our reach and hone our message.

The biggest problem that I see is the recruitment aspect. It’s about enabling women in this case to come into the industry and reflecting on the hiring process like, how biased is it. There’s an unconscious bias toward men. The more you understand that you are biased – because that’s how you’re wired as a human being, the more likely you will be able to de-bias your processes and refine the job specs, the messaging, or the interview process.

But also, women do maybe need to take that step forward and be more courageous when looking at a job spec and say, “Ok, I don’t have that, but I’m going to apply.” Or if they recognize that they are hesitating, they need to reach out to someone that could be a mentor or someone else in the industry or in that company and say, “Look, do you really need that?” Looking from a different angle, women need a support system around them, which often stems from having a network. Just go and build the network, make the connections, and have a support system in place through mentoring or camaraderie support.

There’s More! Listen to Our Full Interview with Jane!

If you have found those interview snippets interesting, don’t miss out on the complete version!

Listen to our full interview with Jane to learn more about:

How companies should refine their job specifications to attract more women to the cybersecurity industry
Why it’s important to have a diverse and inclusive company structure
What is Jane’s perspective on the risk analysis disparity between men and women and what is causing the difference

And much more!

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, and the Maltego YouTube channel, and follow us for future episodes!

Check out Jane’s work on Twitter!

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.

Happy investigating!

Common Pitfalls to Avoid in Vulnerability Risk Assessments

Fri, 11 Aug 2023 05:02:10 +0000

In the world of cybersecurity, like technology, threats are ever-evolving. This constant shift means vulnerability risk assessments must be integral to your organization’s cybersecurity strategy.

What are Vulnerability Risk Assessments?

Risk management is something that your organization is expected to implement to meet the objectives of Annex A.12.1 of ISO 27001. As part of your organization’s responsibilities, it will include assessing the risks.

Organizations conduct vulnerability risk assessments to identify, prioritize, and remediate potential risks in their digital infrastructure. These evaluations are a critical part of the lifecycle of an organization’s vulnerability management process.

The main goal of a vulnerability risk assessment is to uncover weaknesses that could potentially be exploited by cyber attackers. This can be done in eight steps:

Asset Discovery:
- Identify all the assets that will be scanned. From in-house applications to unique endpoints and servers, all the way to internet-facing systems. You need to know what you own to protect it!
Asset Prioritization:
- By prioritizing assets, companies can focus their resources where they’re most needed, ensuring that the most critical systems are secured first.
Vulnerability Identification and Testing:
- Once you have identified and prioritized the assets to be assessed, it is time to initiate the vulnerability identification and testing process. It can be conducted through manual or automated methods.
Vulnerability Analysis:
- Review and analyze the results of the scan.
- Measure, rate, and prioritize vulnerabilities according to a standard, such as the Common Vulnerability Scoring System (CVSS).
Risk Assessment:
- Measure the risk level associated with each detected vulnerability. Each vulnerability level must be matched or calculated against the critical level of the system to define an internal risk score.
Remediation:
- Use the findings to guide the remediation and risk mitigation process.
Documentation and Reporting:
- Document the process, findings, and remediation steps, and report them to relevant stakeholders.
Repeat the Assessment:
- Vulnerability assessments should be repeated regularly to keep up with new and emerging threats and changing environments.

Though the steps involved in conducting one of these assessments vary between organizations, you can use these steps as a basic template to carry out your own.

What Pitfalls to Avoid in Vulnerability Risk Assessments and How OSINT Can Help

Conducting vulnerability risk assessments requires a keen understanding of potential errors that might arise during the process. When overlooked, these common pitfalls could lead to missing critical vulnerabilities or wasting time on irrelevant clues.

To assist you in identifying, classifying, prioritizing, and addressing system vulnerabilities, we have prepared a comprehensive PDF available for download.

This whitepaper will answer the following questions:

What are the five most common pitfalls to avoid when performing vulnerability risk assessments?
What are the best practices for conducting vulnerability risk assessments?
How can open-source intelligence (OSINT) be applied in vulnerability risk assessments?

Download the PDF now to access the answers and enhance your vulnerability risk assessment capabilities.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

We hope this whitepaper was helpful for you and your team to understand the importance of vulnerability risk assessments, avoid common mistakes, and conduct your own assessment using OSINT.

Don’t forget to follow us on Twitter, LinkedIn, and Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

Mario Rojas

Social Media Data Recommended to Build Your Criminal Case

Mon, 07 Aug 2023 08:23:45 +0000

With the prevalence of social media, platforms like Facebook, Instagram, Snapchat, and TikTok are rapidly becoming indispensable reservoirs of legally admissible data for attorneys and prosecutors.

In the past five years, subpoenas to social media companies have been issued in various arenas, including:

Criminal investigations where law enforcement seeks information such as user account details, messages, posts, and other relevant information that could aid in solving crimes.
National security and intelligence where intelligence agencies monitor potential threats, identify individuals involved in terrorism or espionage, and/or track online radicalization or extremist activities.
Civil litigation where social media evidence is used in lawsuits related to defamation, intellectual property disputes, employment discrimination, and personal injury claims.

And many other cases involving regulatory compliance, misinformation, data privacy, and more.

In criminal cases, subpoenas compel social media companies to disclose records or information on their customers and users that are critical to building a case against a suspect or which shed light on criminal activities. This includes information such as user account details, private messages, IP addresses, and more.

While prosecutors often use a subpoena to acquire social media data, some of the information can already be obtained using open source intelligence (OSINT).

In this article, we will discuss how OSINT helps build a criminal case and provide a cheat sheet of OSINT tools and techniques you can use to gather social media intelligence.

Table of Content

Establishing Relevance is Key to Building Your Case
- Relevance
- Information Gathering
Use OSINT to Gather Data In Addition to Subpoenas
SOCMINT Data That Helps Build Your Case
How to Gather These SOCMINT Data for Your Case

Establishing Relevance is Key to Building Your Case

Subpoenas to social media companies are often under scrutiny because the disclosure of information can potentially infringe upon an individual’s right to privacy.

Specifically, there are two primary challenges that prosecutors face when building a case for subpoena:

Relevance
Information Gathering

Relevance

It is important to identify what is absolutely necessary to justify a subpoena request. Prosecutors must justify the scope of the subpoena and prove the relevance between the criminal case and the information requested.

For example, prosecutors must prove that the suspect in question is using a user account, perhaps through images, posts, or location pings that indicate involvement in certain criminal activities.

Information Gathering

Once you identify the information needed to build a subpoena request, the second challenge is finding the information in the vast ocean of online social media data. The smoking gun can easily be hidden—or worse, be deleted—from plain sight.

Use OSINT to Gather Data In Addition to Subpoenas

Open source intelligence (OSINT) is highly valuable for law enforcement in building subpoena cases. It provides access to a wide range of publicly available information which supports evidence collection, suspect identification, and information verification. While the use of OSINT in law enforcement faces discussions, OSINT helps investigators cross-reference and corroborate data, trace digital footprints, and proactively prevent and prosecute crimes—all in a cost-effective and efficient manner.

As a sub-discipline of OSINT, social media intelligence (SOCMINT) is especially crucial.

SOCMINT includes all social media platforms, not only social networking sites. Social networking sites, like Facebook and LinkedIn, only make up one portion of the platforms that can be used to gather data. Information can also be found on media-sharing sites like Instagram, forums like Reddit, image-sharing sites like Pinterest, video-sharing sites like YouTube, microblogging platforms like Twitter, social gaming platforms like Xbox Live, and blogs created using platforms like WordPress.

While prosecutors often use a subpoena to acquire social media data, some of the information can already be obtained using SOCMINT to make advances in the investigations and order subpoenas for the most crucial piece of the puzzle.

SOCMINT Data That Helps Build Your Case

Law enforcement uses subpoenas to social media company to identify suspects. However, for the subpoena requests to be approved, you must establish relevance of the subpoena with the case at hand.

Most of the information you need to build your case can be found using SOCMINT. Moreover, some of the information that normally comes from subpoenas can also already be obtained via SOCMINT.

Here’s a list of social media data that you can gather via SOCMINT to build your case:

User Account Details: Information such as username, alias, registration date, birth date, and other account information if available.
Friends and Connections: Details of inter-profile connections, friends, followers, and followings of the relevant user account(s).
Groups and Communities: Groups, forums, and communities on the social media platforms that the relevant user account(s) participates in.
Timestamps: Timestamps of relevant actions, messages, posts, and images made by or published by the relevant user account(s).
Location: Locations of specific posts or content published, or locations indicated by the relevant user account(s).
Images and Videos: Images and videos relevant to the case or as supporting evidence.
Posts: Content posted on social media feeds (such as a Facebook post, a Twitter Tweet, or an Instagram Story) that is relevant to the case or as supporting evidence.
Post Engagement: Likes, comments, and sharing of social media posts might provide insight to people related to the suspects or involved in the criminal activities.
Erased or Historical Online Personas: Make note of online profiles or accounts that might be deleted or outdated, which might still provide helpful data.
Other Digital Movements and Metadata: Additional digital activities, histories, and metadata that can support identifying accomplices.

We’ve also compiled this into a PDF that you can take with you.

DOWNLOAD CHEAT SHEET

Please note that these are only a few things prosecutors can ask for. The evidence required as well as the requested data will depend mainly on the type and purpose of the investigation. The approval of subpoena requests highly depends on the court’s judgment and jurisdiction. Some companies might not comply with subpoena requests due to the legislation they adhere to, the jurisdiction they are based in, or their own company policies.

Some social media companies, like WhatsApp (owned by Meta), are aware that access to certain information can prevent harm to the life or well-being of a person or a child. Other companies like Telegram, however, are not as cooperative with law enforcement.

It is advisable to research the legal and compliance guidelines of relevant social media companies when preparing for subpoena requests.

How to Gather These SOCMINT Data for Your Case

Knowing which data to gather is the first step. Most importantly, where can you find all the SOCMINT data above?

In social media investigations, it is important to understand:

The available social media platforms and how users typically interact on those platforms: For example, users on Instagram typically share images or videos, whereas Twitter users largely stick to text.
Connections between certain accounts and platforms: For example, a Google user account is also connected to Gmail and YouTube.
Metadata relevant and available on those platforms: For example, we are not simply looking for a username on Facebook, but also social connections of the target to search for additional profiles or suspects.

Resources like the OSINT Framework or OSINT Dojo are great places to learn about how data is related and how you can move through an OSINT investigation knowing that you’ve explored and pivoted to all the crucial data points.

Additionally, there are a few advanced tools and techniques that you can use to gather as much social media data as possible:

Google Dorking: Also known as advanced Google searching, dorking involves using specialized search operators and techniques to find specific information on the internet
Breached Data: These databases include data like breached passwords, email addresses, usernames, and the platforms these user information connects to.
Reverse Image Search: Find the original source or similar images on the internet using and image as the search input.

Download the Cheat Sheet and Try Them out Now!

In this cheat sheet, our SOCMINT expert put together a helpful list of:

13 Google Dorks
3 Breach Databases
2 Reverse Image Search Workflows

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

We hope you find this cheat sheet practical for your social media investigations by understanding how to build a relevant and comprehensive case for your subpoena request, incorporating the techniques and SOCMINT data sources mentioned above.

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author

Daphnée Aguilar

Why Law Enforcement Needs OSINT Tools

Fri, 04 Aug 2023 11:13:41 +0000

Intelligence is driven by data—this means that the more information you have, the better your chances of distilling accurate and comprehensive intelligence. Robert Litt, former General Counsel for the Office of the Director of National Intelligence (ODNI) notes, “If you want to look for needles in a haystack, you first have to have a haystack.”

By embracing open source intelligence (OSINT), you gain access to large haystacks where you can find plenty of needles. OSINT investigations are a crucial method for law enforcement to gather information and evidence because most crimes nowadays leave digital traces. These digital pieces of information either serve as evidence or provide the critical context that leads to evidence.

What is Open Source Intelligence (OSINT)

Mark Lowenthal, Former Assistant Director of Central Intelligence for Analysis (CIA), defines OSINT as “any and all information that can be derived from overt collection: All types of media, government reports and other documents, scientific research and reports, commercial vendors of information, the Internet, and so on.”

Lowenthal, Mark M. (2005), “Open-Source Intelligence: New Myths, New Realities”, in George, Roger Z; Kline, Robert D (eds.), Intelligence and the national security strategist: enduring issues and challenges, Lanham: Rowman and Littlefield, ISBN 9780742540392.

In this whitepaper, we will look at why law enforcement needs OSINT tools and how having the right OSINT tools brings immense value.

Table of Content

OSINT for Law Enforcement Is Important in Setting the Scene for Investigations
OSINT Is Extremely Valuable in Identifying Potential Threats
OSINT Is Proven to Be Useful in Many Law Enforcement Cases
The Right OSINT Tool Can Solve Common OSINT Challenges
Get the Most out of Your OSINT Tools by Understanding Your Data

OSINT for Law Enforcement Is Important in Setting the Scene for Investigations

Context is extremely important in any sort of criminal investigation. Joseph Nye, Former chairman of the National Intelligence Council compares OSINT to the outer edges of a jigsaw puzzle, which gives a sense of boundaries and patterns. OSINT is extremely useful for helping put secret information into a wider context.

One type of context that OSINT helps establish is the provision of leads or starting points for investigations. Law enforcement often relies on subpoenas and online platforms to give them initial starting data, however, OSINT tools can provide similar data or in some cases, even more. For example, you can pull the domain registration information of a suspect website, which leads to a person of interest (the domain registrant) who can then be investigated further.

Another type of context that OSINT establishes is the behavioral pattern of a person—information beyond typical governmental records like date of birth and city of residence. For example, you can investigate the social media activities of a person of interest to understand their “character” —social motivation, cultural background, relative age, interests, and more.

The social groups they join, the pictures they share, the locations they visit, and the comments they both write and respond to—all are signals which can be used to anticipate their motivations, their plans, and the danger they may pose.

OSINT Is Extremely Valuable in Identifying Potential Threats

Monitoring online activities is an active approach to using OSINT in order to gain insights into criminal activities, and to take action to prevent potential threats and risk of danger.

The dark web, for instance, contains a wealth of information because criminals are drawn to its features of anonymity and encryption. For example, law enforcement is able to monitor dark web forums for users looking to purchase a weapon and then pivot to those who respond positively to the post.

Similarly, monitoring social media platforms or online messaging boards can also help prevent crimes. For example, in the recent Capitol Storming in the United States, OSINT played a critical role both after and during the incident.

Of course, OSINT does not guarantee 100% accuracy and is susceptible to misinformation and disinformation. However, as Mark Lowenthal said, OSINT may be more difficult to manipulate given its diversity.

Download This Whitepaper to Learn Why Law Enforcement Needs OSINT Tools in Their Investigations!

These are just a couple of examples of how OSINT can facilitate and contribute to investigations in the context of law enforcement. In the whitepaper, we also cover:

OSINT Is Proven to Be Useful in Many Law Enforcement Cases
The Right OSINT Tool Can Solve Common OSINT Challenges
Get the Most out of Your OSINT Tools by Understanding Your Data

OSINT can help law enforcement keep track of criminal activities, identify potential threats as well as reveal and hunt down the true culprits. In order to achieve this, an OSINT tool is required.

Download it now and get to know more about how OSINT is used in the real-world scenario, what the criteria are when selecting an OSINT tool, and last but least, how to leverage OSINT to the fullest in investigations.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

We hope this whitepaper was helpful for you and your team to understand how OSINT plays a crucial role in law enforcement.

Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

Investigator Toolkit July 2023: Cheat Sheets for Faster and Spot-on Workflows

Thu, 03 Aug 2023 19:26:00 +0000

Investigator Toolkit: Quick Starts to Using Maltego Hub Items in Real-life Investigations

Where to Find the Investigator Toolkit?

You can find the Investigator Toolkit series on our Twitter and LinkedIn channels, with the hashtags #MaltegoMonday and #InvestigatorToolkit. Every Monday, each Investigator Toolkit post comes with a workflow cheat sheet and a blog article or webinar as an additional demonstration.

All Previous Investigator Toolkit Roundups

Investigator Toolkit July Roundup

In July, we featured the following five Hub items and their use cases in the Investigator Toolkit series:

Let’s dive straight into how to use these Hub items for geospatial link analysis, risk assessment and mitigation, person of interest investigations, phishing domain detection, and breach identity data!

Google Maps Geocoding: Precise Geospatial Link Analysis

To reduce noise and merge duplicated Entities, the Google Maps Geocoding Transforms in Maltego help standardize different variants of the same address, making it easier to spot patterns and connections. See how we normalize varying abbreviations and disparate spellings across local languages with the Google Maps Geocoding Transforms in Maltego.

NIST NVD: Risk Assessment and Mitigation

Using the NIST NVD Transforms for Maltego, investigators are able to quickly discover context and insights around CVEs, CPEs, and CWEs included in the NIST National Vulnerability Database.

LittleSis: Person of Interest Investigation

Leveraging the LittleSis Transforms in Maltego, investigators can visually explore the spheres of influence of high-profile figures like politicians, CEOs, and world leaders and see the connections between them.

DNSTwist: Phishing Domain Detection

By combining the capabilities of DNSTwist and Maltego, cybersecurity professionals can rapidly detect and pinpoint potential phishing domains to better protect their systems and networks.

Constella Intelligence: Breach Identity Data

With Constella Intelligence, investigators can unmask aliases, nicknames, and domains and swiftly build a comprehensive profile of a person of interest via curated identity exposure data.

Check out the Investigator Toolkit series now!

In the following months, we will continue digging into different Hub items available in Maltego and providing best practice tips for investigators.

Happy Investigating!

Integrating Wireless Data into Your OSINT Investigations

Mon, 31 Jul 2023 13:46:15 +0000

How Wardriving Contributes to OSINT Investigations

If you have been around long enough, you have probably participated in, or at least heard about Wireless Communities. These consisted mainly of enthusiastic local groups who built wireless networks by deploying wireless access points (APs) with customized versions of well-known, open-source router software such as DD-WRT and OpenWrt.

It was also during this time that a collecting practice known as wardriving became popular. It challenged individuals, called stumblers or wardrivers, to collect wireless data information across different regions.

Wardrivers used cars, bikes, or other means of transportation to listen around and identify APs based on beaconing data, storing that info with the corresponding GPS location. The popularity of wardriving steadily decreased as wireless networks began to be widely deployed, and many people no longer found it useful to map or track this kind of information.

Many devices and applications were designed to passively and actively collect it from smartphones or other portable Wi-Fi-enabled devices. The collection and aggregation of this data on a global scale over time has provided a significant source of Signals Intelligence (SIGINT) that can support various types of investigations.

Investigators and forensicators use this data to find or extract artifacts related to the victim’s or offenders’ system, matching one or more wireless network identifiers known as service set identifiers (SSIDs) or the corresponding wireless radio network card identifier called basic service set identifiers (BSSIDs). Every individual computer or mobile device has a preferred network list (PNL) to reconnect to common wireless networks at home or work.

That is the background story of how Wireless Geographic Logging Engine (WiGLE) came about and evolved into a valuable OSINT resource. In this article, we will explain what WiGLE is and show you how to integrate it into Maltego so that you can use it in your OSINT investigations.

What Is Wireless Geographic Logging Engine (WiGLE)

WiGLE is an online service that houses a vast database of aggregated data on the location and information of wireless networks. The information is collected collaboratively by many individuals worldwide.

WiGLE has impressive numbers with around 430k stumblers, and over a billion wireless networks collected. This data source has evolved to encompass not only Wireless Area Networks (WLANs) but also other valuable wireless data, such as Bluetooth devices (wireless personal area networks or WPANs). It has even introduced cellular 3G/4G Radio Towers in the beta stage.

Once you open a free account on WiGLE, you can start exploring the dataset in a global geographical map and apply different filters to search through its user interface (UI) using GPS/Location or Wireless AP data.

This includes searching by SSID (the logical name of the network set by its administrator) or BSSID (the MAC address of the AP that broadcasts that network).

Integrate WiGLE into Maltego in Five Steps

WiGLE provides a wealth of data that can be used in various OSINT investigations. In the next part of this article, we will demonstrate how to benefit from it in Maltego.

Within the tool, analysts can integrate their favorite data sources and tools by building custom Transforms and combining information into one graph.

Read more about writing local Transforms in our documentation.

To integrate WiGLE into Maltego, we will follow five steps :

We recommend that you open your Maltego Desktop Client now and get ready to follow along.

Preparation

WiGLE has its own application programming interface (API) for automated data collection by machines using tools or scripts. For more details, check out their web interface here.

One of the first things to consider when you want to write a new integration is authentication.

In order to query the API, you will need to generate an API token in your WiGLE account menu while logged in.

That allows you to connect the WiGLE data source to your Maltego Client with pieces of code that query that interface and use it through the local Transform feature.

Design

Before we start coding, let us first mock up the WiGLE integration by dragging three Entities into a new graph in Maltego.

Phrase Entity: to pivot to SSIDs in order to search APs beaconing them
Location Entity: to pivot to location regions to search all the contained APs
MAC Address Entity: to pivot to APs having this attribute on its BSSID

Some of the elements needed for this integration do not exist in the tool by default. That is why we will first need to create some Custom Entities for:

SSID: a wireless network identifier
Wireless AP: a device that broadcasts an SSID and has a unique BSSID
Location Square/Circle: two GPS coordinates or a GPS coordinate with a radius that defines a physical area

SSID and Location are quite self-explanatory but Wireless AP is a more complex Entity that needs to be created as an advanced custom Entity.

It has to include all relevant properties provided by WiGLE that might be useful for an investigator. We might consider using the inheritance from a Maltego.MACAddress for the Wireless Access Point Entity, as a MAC Address is an existing Entity and can be used as a unique key identifier for the device.

To better facilitate the analysis process, make use of the Overlay function to customize the visual aspect of your Entities.

For instance, it is useful to visualize not only the SSID and BSSID but also the country of the AP and whether it is public or protected.

Considering the logical connection between the mentioned Entities, we can identify the pivoting points that will serve as Maltego Transforms in an investigation using the WiGLE dataset. These Transforms include:

Phrase2SSID: generate an SSID based on a specified string
SSID2WirelessAP: find wireless access points matching a specific SSID
Location2Square: generate a square region from a specific location point
Square2WirelessAP: find all wireless access points located in a specific region
WirelessAP2Location: extract location data where the access point is located

We can now create a manual mock-up in the Maltego graph to visualize the investigative pivoting that will be matched by the corresponding Maltego Transforms:

As you can see, we have illustrated a common investigative workflow that can begin with searching the name of a network with the generate SSIDs Transform to identify Wireless APs. Alternatively, you can start with a location to find devices within a defined region using the To Square Location Transform.

Coding

To connect to a data source, we can use some core libraries, such as the requests library in Python, which allows us to establish connections to HTTP interfaces and parse the incoming HTML/JSON content.

However, it is always advisable to explore existing custom libraries that offer functionalities aligned with our requirements. By doing so, we can benefit from the work of people who have already implemented that logic and built an API wrapper.

One such example is pygle, a WiGLE API wrapper available since 2017. It provides various functions to query specific endpoints within the API.

To code our own Transforms, we will use our maltego-trx library and follow a couple of steps:

Create a Python virtual environment to self-contain the project

venv

Install necessary libraries

pip install maltego-trx
pip install pygle

Generate skeleton files

maltego-trx start

You can start developing your own Transform by using one of the existing Transform templates, such as GreetPerson.py, as a starting point.

Many users simply make use of the copy function within an integrated development environment (IDE), such as Microsoft Visual Studio or Jetbrains PyCharm, to duplicate the template.

If you do not want to start from scratch, you may reuse pieces of code created by other individuals who already matched WiGLE data in their code. Here’s an example.

You can also make a copy of the sample Transform implementation available in Maltego’s GitHub repository.

Connecting

In order to use your newly created local custom Transforms, navigate to the Transforms Menu in Maltego. From there, select the New Local Transform option to open the Local Transform Wizard.

At this point, it is necessary to create a unique Transform ID, such as “mytransforms.SSID2WirelessAP,” so that you can use it later in automation through the existing Machines capability. Also, make sure you choose the right Input Entity type so that the Transform appears when selected.

Lastly, provide the following information by customizing the local folder (PATH) where your development project is located in your file system:

Command Line

PATH/wigle/venv/bin/python

Parameters

project.py local

Working directory:

PATH/wigle/project

Testing

Now it is time to test your new code by dragging a Phrase Entity with your favorite wireless network target onto the graph. You should then see the newly mapped Transforms in the Local Transforms section.

Once you have the new SSID Entity in the graph, you can use the combination of Maltego and the WiGLE data sources to obtain a full list of existing wireless APs matching that specific target.

Now it is possible to continue your investigation with the existing Transforms available in the Transform Hub to take maximum advantage of location data, such as Google Maps Geocoding.

This will enable you to thoroughly explore and investigate your target, aiming to identify individuals, companies, or other relevant Entities associated with those locations.

We’re already excited for you to start experimenting with them!

Start Using Your Custom WiGLE Integration

We hope you enjoyed this new custom integration, and that it inspires you to build your own. If you prefer to try it out without coding it yourself, you can simply download it from our Maltego Local Community Transform (LTC) repository.

To learn more about other data integrations available in Maltego, check out the updated list here.

Don’t forget to follow us on Twitter and LinkedIn, or subscribe to our email newsletter for more information on advancing your investigations with Maltego.

Many thanks to Bob from WiGLE for supporting us throughout this integration, and Kevin Metcalf from the National Child Protection Task Force (NCPTF), one of our recognized community members, for inspiring this integration.

About the Author

Carlos Fragoso

Dispatches from the CTO: Houston; We Have a Roadmap

Thu, 27 Jul 2023 15:19:38 +0000

Hi, I’m Ben April. I’ve been the Chief Technology Officer (CTO) of Maltego for almost a year. It’s long past time for me to introduce myself. I hope you can forgive my tardiness; We’ve had lots of news and exciting developments keeping us busy:

Maltego was acquired by Charlesbank with $100 million investment
Maltego got ISO 27001:2013 certified
Linking my community network with the Maltego community at events like RSA, Black Hat (coming up), and others
Updated Maltego’s look and feel with Desktop Client Version 4.4.1 release
Developing a Maltego product roadmap that will amaze and delight

But I’m getting ahead of myself. Who is this guy and why does he think he can make a difference at Maltego?

Who am I

I started in network engineering in the late 90’s. At a small local ISP, I got my hands into everything Support, billing, cabling, routing, sysadmin, essentially everything. I was fortunate to follow the path upstream, learning the ins and outs of operating bigger and bigger networks at every step along the way. After the dot com bubble popped, I found myself at Trend Micro with a focus on security, particularly looking at Internet infrastructure. It was during this period when I got my first opportunity to use Maltego. As a researcher, it changed my life. Before I knew it, I was building Transforms for every source of data I could find.

After Trend Micro, I moved to Farsight Security where I applied my expertise in Internet infrastructure to the passive DNS ecosystem as a data provider. It’s critical to keep the perspective of data providers in mind when thinking about the future of Maltego. Data is the fuel for the Maltego engine - Data comes from various sources, but it’s incredibly important that the quality, structure, and reliability of data meet customer expectations. My time as the CTO at Farsight ended when we were acquired by DomainTools in November of 2021, and I became the Chief Architect at DomainTools.

What A Difference A Year Makes

I have always loved Maltego and saw the opportunity to lead the Product & Tech team here as a chance to make a positive impact on the security of humanity. After multiple trips to Munich to get to know the Maltego team and trips elsewhere to get to know some of our users, I am even more convinced that the work we do makes a measurable difference and with focus and drive, we can have an even bigger impact.

After joining Maltego and studying the state of the Product & Tech organization, I set about making some initial changes while building the new product roadmap. First up, we had to refactor the release plan. There was a 5.0 version of the Maltego Desktop Client in development when I started. While this release came with several amazing new capabilities, it came with a steep cost. The new platform was backwards incompatible with the products that came before it. As exciting as 5.0 was, I took the decision to refactor the roadmap. The new plan is to deliver the new capabilities in a stream of carefully layered incremental releases that preserve backwards compatibility while getting the new capabilities into the hands of our users faster.

Capabilities, Quality, and Stability

Our aim is to balance new capabilities with quality and stability, which is the theme ingrained in our new product roadmap. To achieve that, we are building a release cadence that will deliver 3 minor version releases of the Maltego Desktop Client per year. Each release should include both new capabilities as well as stability and quality of life improvements directly incorporating feedback from our user community.

First Step: Desktop Client Version 4.4.1

You might have already noticed that you have been invited to update your Maltego Desktop Client to 4.4.1 (quickly following 4.4.0) in April 2023. This release includes significant updates to the look and feel of the user interface, several bug fixes, and improved pop-up messages related to Transform quotas.

If you are a Mac user, you will be glad to know that you should now be able to double-click on a graph file to open it automatically (if not, try installing v4.4.1 again. Your settings will be preserved).

Your browser does not support the video tag.

But Wait, There’s More

I am excited to show you more about the elements of our roadmap in the coming weeks. We’ve got UI improvements, protocol enhancements, updates to the Entity model, and even entirely new interfaces coming.

There are a few additional ways to learn more about our plans. If you are an Enterprise customer, reach out to your Customer Success Manager. If you are a data partner, reach out to your Partnership Manager in our Data Hub team.

You can catch myself and our team at upcoming events such as Black Hat USA. You can also follow Maltego on Twitter, LinkedIn, Mastodon, or sign up to our email newsletter.

Be careful out there!

About the Author

Ben April

The Pivot Podcast: Exploring the World of Geopolitics and OSINT with Kevin Limonier

Sat, 15 Jul 2023 08:00:00 +0000

In this episode for The Pivot podcast, we welcome Kevin Limonier!

Kevin Limonier is an expert in geopolitics. He holds the position of an associate professor in Geography and Slavic Studies at the French Institute of Geopolitics (Paris 8 University), serves as the deputy director of GEODE, and is a founding partner of Cassini, a company specializing in cartography and territorial intelligence. Previously, he worked as a lecturer at the Russian State University of Humanities (RGGU, Moscow) for several years.

As a specialist in the Russian-speaking internet and territorial innovation policies in the USSR and contemporary Russia, Kevin’s geopolitical research focuses on developing new methods of mapping cyberspace, particularly in the post-Soviet context. He is also interested in the methodology and epistemology of geopolitics.

In this episode, we delve into a variety of topics ranging from the meaning of OSINT within the field of geopolitics, the current limitations of OSINT, and some emerging challenges as the world and the internet rapidly evolve. We also discuss how authoritarian states, such as Russia, control their internet and its evolution over the years.

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

The Pivot: Your New OSINT and Infosec Podcast

Where to Listen to The Pivot? 

Tell us about your work, how OSINT got into your way, and how you use it in your work!

Kevin: I’m a geography specialist working on Russia. At the very beginning, I was writing my Ph.D. dissertation in Geography. The topic was about the 10 closed former Soviet cities that were opened after the collapse of the Soviet Union, and I studied how these cities reopened and survived the shock therapy, the conversion, the capitalist system, and so forth.

I lived in some of these cities for about a year. When I was there, I discovered very interesting things about the Russian internet and the fact that, for example, there were two digital networks in some of these cities. The first one was the global internet, and the second one was a kind of local network at the size of the city. I was very astonished by this discovery because this doesn’t exist in Western Europe and France. I met a lot of Russian people, including programmers and hackers, and learned the unique structure of the Russian internet.

Around 2011 and 2012, I decided to focus my research on the Russian digital network architecture, its impact on geopolitical consequences, and the way different actors investigate the network. That was the first time I used digital footprints, trying to cross and analyze them back in the time when nobody would call it OSINT. OSINT was non-existent at that time, but a lot of people like me did it without knowing we were doing OSINT since everything changed during the past 10 years.

Later, we realized that digital investigation was not only a hobby for geek people but also a way of understanding and collecting information that was not supposed to be public. It is a very important topic regarding investigative journalism and geopolitics when you have people like Navalny being able to identify the guys who poisoned him just by doing some basic OSINT.

How is OSINT used in geopolitics?

Kevin: It’s a vital tool for geopolitics nowadays. As a geographer, I’m interested in understanding and mapping the physical world, and for me, OSINT is a set of tools that can be used and mobilized in order to find out how power shapes sub-territories, and we perfectly see that in Ukraine today. We have a lot of OSINT communities trying to identify some war criminals, which Russian regiment did what, or which Wagner Group soldier killed somebody.

All these investigations are very useful in order to learn about geopolitical conflicts as we are in a deeply digitalized society where almost nothing happens without the intermediation of a smartphone, a computer, or a digital thing. Nearly every of these intermediation actions generates digital footprints, and some of these digital footprints are open source while others are not. However, harvesting and trying to understand them can help you to have a better view of a geopolitical situation since there is no geopolitical situation in 2022 that does not generate digital footprints.

Do you think sometimes OSINT can be used for political leverage? How would the states employ and insert it in a global geopolitical context?

Kevin: Let’s first talk about what geopolitics is. Geopolitics is a scientific methodology used to understand how some groups, such as states, non-state actors, terrorists, you name it, establish territorial control on a given surface of the earth. Establishing territorial control is, most of the time, a matter of controlling networks, which is not something new. For thousands of years, when you want to take over a territory, you firstly occupy the networks that shape this territory, for example, the railroad system, the road system as well as the non-physical networks such as the political networks, the information networks, the power networks, and so on.

Basically, everything in geopolitics is about controlling the networks. What’s new today with the digital revolution is that most of these networks are at some point digitalized. I would say physical networks are also partially digitalized. There is no power grid working, for example, without computer science today in Europe at least. All these digitalized networks and its activities produce some information. This information and these digital footprints can be of use not only for comprehending what is happening on the ground like we see in Ukraine but also for highlighting how a given actor is either winning or losing ground. We see today that digital investigation is crucial to point out the crimes that are committed by the Russians in Ukraine. This is something of very vital political significance because now you are able to establish a regime of truth by showing and demonstrating who is guilty of what.

We can see today, for instance, on networks such as Telegram, you have a real war between collectives and people doing OSINT and supporting Ukraine on one hand. On the other hand, people are doing the same for the Russians. Everybody is pushing their narrative and their own interpretation of, sometimes, the same facts. This is a new way of telling who is right and who is wrong, and it’s something deeply political. Nevertheless, it could also be a danger to democratic processes seeing that OSINT interpretations can be very objective, and sometimes it is so technical with the technicality being pronounced that it is a problem for bringing it to a wider audience.

You wrote a paper about the entrepreneurs of influence from Russia with a focus on those in Africa. Could you elaborate on that?

Kevin: Our purpose was to analyze the new activity of Russian actors in French-speaking Africa, especially by investigating their digital footprints with OSINT. We wanted to know how some of the actors, like Yevgeny Prigozhin, make their way to gain popularity worldwide as well as how these people arrived in Africa, what they were doing, and so on. We couldn’t do physical investigations for obvious reasons. Instead, we looked into their activity in Africa for about two years. With all the OSINT investigations and analysis, we were able to identify some behavioral patterns of these people.

What we noticed is that most of these Russians who were beneficial for reestablishing Russian influence in Africa were doing it for business and they were indirectly linked to the Russian government. That’s why we forged this concept of entrepreneur of influence because we wanted to show how these people accompany the return to the geopolitical comeback of Russia in Africa by making money, political contacts, or what we call capital in sociology, for example, a political capital, symbolic capital, or an economical capital.

How does this whole system of entrepreneurs of influence function?

Kevin: When we investigated these people, they were independent and not officially associated with the Russian government. What we did notice is that the business model of such entrepreneurs in Africa was based on three pillars.

The first one was information influence and information operations. People like Prigozhin are experienced in information manipulation. They started it during the demonstrations organized via social networks back in 2011 and 2012, which was the very beginning of information manipulation sponsored by the Kremlin. In 2014, during the Maidan Revolution in Ukraine, the annexation of Crimea, and the beginning of the Civil War in Ukraine, these people were once again noticed. Later in 2016 marked the apotheosis of these people as they practiced some election meddling during the 2016 US election and were officially indicted by the FBI in the Robert Mueller report. After 2016, Prigozhin and all these people doing information manipulation were looking for a new place for making profits, knowing that the USA was no longer the place for them as a result of the considerably growing awareness of the FBI and the federal government. They arrived in Africa, particularly the French-speaking regions, with the offers of information manipulations, manipulation of elections via social networks, and so forth.

The second pillar is the security management and what we call private military companies (PMC) or mercenaries. Wagner, which is actually not a company, but a bunch of companies claiming to be Wagner, provide military protection to unstable African regimes that would otherwise have collapsed. The second pillar also consists of what we call praetorianism, selling some kind of patrol and guards to unstable presidents and governments in Africa.

The third pillar, the most important of all, is the exploitation of natural resources. Despite the political interests, organizing information manipulation and operations is not lucrative. Though PMC activity is lucrative, the real place for Wagner, Prigozhin, and all these entrepreneurs of influence to make money in Africa, is to exploit natural resources, such as diamonds in Central African Republic, gold in Sudan, and chromite in Madagascar. This is how they support their enterprises and build a real empire in Russia.

What was the methodology you used to track them via OSINT?

Kevin: Here I must say that Maltego helped a lot. I was able to cross all the data and visualize the networks we were investigating thanks to Maltego. We identified some websites we knew were belong to Prigozhin and other entrepreneurs. Starting from these websites, we found some IP addresses, historical whois information with email addresses, phone numbers, Google ID, Google Analytics numbers, and the pages. With all this information, we uncovered new websites, new institutions, other affiliated companies, and more. We were also able to draw a map which is included in the paper with hundreds of Entities.

However, the most difficult yet important part was to make sense of all the collected data. We spent months ruminating and pondering what we had in front of our eyes. You have to go deeply into the websites and databases in order to have a firm grab on what you’re looking at. To me, that’s something of great significance for people doing OSINT. I’m not pretending to be an OSINT professional, but as an academic, I observe the practices of digital investigations. From what I see, once you have the information, footprints, and data you need, that’s when the most complicated part comes into play, in which you try to stick to the context and not lose the point. I think that everybody who does OSINT has encountered this problem at some point that when you have a dataset, it’s very easy to manipulate this dataset to say or tell whatever you want it to say from one small interpretation mistake to another. You might do it unconsciously, and that’s what we call bias of confirmation, which is something very powerful that we strive to fight against when conducting OSINT investigations.

To learn more about cognitive biases and corresponding prevention measures, check out our webinar here.

There’s More! Listen to Our Full Interview with Kevin!

If you have found those interview snippets interesting, don’t miss out on the complete version!

Listen to our full interview with Kevin to learn more about:

What Kevin thinks to be some of the current and future limitations of OSINT
How Russia gradually imposes more and more controls on its internet and filtrates the traffic from other countries
What are the differences between the internet handled by the state of Russia and by the Russian-speaking countries

And much more!

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, and the Maltego YouTube channel, and follow us for future episodes!

Check out Kevin’s work on Twitter!

Don’t forget to follow us on Twitter, LinkedIn, and YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.

Happy investigating!

Analyzing Attack Patterns and TTPs

Thu, 13 Jul 2023 14:12:48 +0000

When a threat actor successfully accomplishes their malicious attempt, chances are they will repeat the process and apply the same methods the next time an opportunity arises to target an unsuspecting organization.

While this may seem daunting, it can also prove to be a double-edged weapon and give us insights into established patterns, opening the door to better analysis of their behaviors.

In this article, we will guide you through methodologies for comprehending attackers’ behaviors and equip you with practical knowledge that your team can incorporate into everyday cybersecurity practices.

Follow Trails of Threat Actors with TTPs

In threat analysis, we need to look at attack patterns or the methods attackers use to achieve their goals. This knowledge will help us recognize and defend against known types of attacks.

We also want to understand the specific steps involved at each stage of an attack. This requires understanding of how attackers operate, in other words, spotting their tactics, techniques, and procedures (TTPs).

What You Should Know about TTPs

TTPs provide us with a practical perspective, allowing us to connect operational data within the same campaign or dots in the tricky and vast cyber puzzle.

The term was borrowed from military and adopted by the cybersecurity industry to describe:

Tactics – High-level objectives of the attack

Techniques – Methods used to achieve those goals

Procedures – Steps taken to deliver a specific technique

If we have a broad enough view and connect the dots correctly, we can attribute TTPs to the same threat actor, understand the threat they pose, and finally, secure our organizational defenses.

TTP analysis is fundamental for proactive and reactive cybersecurity because it provides an understanding of the mindset and capabilities of your adversaries. The TTPs of our attackers do not change often and therefore can be analyzed.

What Methodologies You Can Apply in Your TTP Analysis

One of the most used methodologies is threat modeling, also known as threat profiling. It involves constructing a threat landscape that identifies potential threats that might be relevant to our organization and then dissecting and categorizing them based on their TTPs.

This greatly aids in cyber threat situational awareness and the understanding of the attack vectors that threat actors might employ.

On the other hand, we have other methodologies closely related to incident response and forensic analysis disciplines. These methodologies take the different indicators of compromise (IOCs) discovered during a cyberattack and map them to specific TTPs.

When employing these methodologies, analysts combine snippets of data from many disparate data sources including network data, endpoints, and centralized events, collected in platforms such as Splunk, to investigate and analyze them.

This enhances the effectiveness of containment and eradication of threats during an incident and provides crucial insights during post-incident analysis to comprehend the different stages of the attack and the impact or extent of the breach.

How TTP Analysis Can Benefit Your Team

Based on what we have covered, there is clear value in analyzing the TTPs of a threat actor for at least four reasons:

Risk assessment: Understanding the threat landscape to prioritize cybersecurity investments and develop strategies for managing that risk.
Intelligent Protection: Applying controls and mitigations for the most relevant attack vectors, considering the TTPs of our most probable adversaries.
Proactive Detection: Promptly identifying threat activity to not only contain it, but also gather additional intelligence.
Early Response: Streamlining processes to mitigate threats swiftly and minimize potential damage.

Technical or operational data, such as IOCs (domains, hashes, and others), are merely fingerprints that can easily change from one cyberattack or campaign to another, thus being timely.

On the other hand, TTPs provide tactical information that shapes the threat actor’s behavior which does not change frequently. By understanding the behavior and motivations of the attacker, we can better predict potential future actions or targets and develop a profile of the possible perpetrators behind these attacks.

Be Aware of the Common Attack Patterns and TTPs

Attack patterns or TTPs might vary from one organization to another. This only goes to show that the threat landscape, including the existing threat actors that evolve over time, depends also on who we are and where we operate.

While it may be challenging to compile a definitive list of the most common patterns, several techniques have been extensively used in recent years in global cyberattacks targeting organizations across various industries, irrespective of their specific sector.

These techniques include amongst others:

Phishing: e.g., deceiving recipients into providing login credentials by clicking on malicious links
Drive-by Downloads: e.g., exploiting vulnerabilities in the user’s web browser
Ransomware: e.g., demanding payment in exchange for a decryption key or to avoid leaking the victim’s data
Living-off-the-Land (LOTL): e.g., use of system binaries and tools instead of malware to avoid detection through masquerading
Remote Code Execution (RCE): e.g., abusing existing software vulnerabilities to force the execution of malicious payloads
Information Stealing: e.g., collecting credentials and other personally identifiable information (PII) that might be used to abuse or target other systems or platforms
Command and Control (C&C) Frameworks: e.g., use of commercial or open-source C&C software to flexibly operate compromised systems

There are also different security vendors, cybersecurity agencies, and other relevant stakeholders who make predictions based on the collected intelligence regarding trends within their customer base or service constituency. These predictions are then released in annual reports that provide current information about these trends. For example, top resources include:

While predicting future events is difficult to incorporate into cybersecurity workflows, identifying unseen gaps or potential next steps can be facilitated by using what you may already have at your fingerprints – historical attack data.

Use Historical Attack Data to Profile Future Attackers

One of the most common mistakes in cyber teams is overlooking the importance of keeping a record of the encountered cyberattacks.

There is a misguided notion that relevant agencies and intelligence providers are the only ones proficient enough and responsible for collecting and understanding the necessary intelligence data. And yet, there is no substitute for the intelligence gained from your own systems and data sources.

While individual attacks or attempts may not seem significant in isolation, studying them collectively as part of campaigns can make a difference.

Here’s where you can start:

Design cybersecurity functions that allow you to incorporate external intelligence for prevention, detection, and response to various threats.
Encourage your detection, response, and forensic analysis teams to gather additional indicators and thoroughly analyze them, as this will help generate internal intelligence.
Utilize the internal intelligence you gather to enhance your mitigation efforts, strengthen your detection mechanisms, and foster a culture of continuous learning within your team.
Take advantage of the information at your disposal to create accurate profiles that give you a better understanding of the motivations and potential targets of threat actors.

Historical data can serve as a baseline for comparison and help you make sense of ongoing activities. So, the more information you have, the better you will understand the attacker’s motivations and potential targets.

That being said, let us see what measures we can take to streamline our analysis.

Build a Toolkit for Your TTP Analysis

Today, we cannot discuss TTPs without mentioning the MITRE ATT&CK Framework. It serves as the industry standard and offers a knowledge base comprising common adversary tactics and techniques based on real-world observations of cyberattacks worldwide.

Both proactive and reactive cybersecurity tools have aligned their detections and references with this standard, facilitating the understanding and use of cyberattack information. One invaluable tool is the ATT&CK Navigator, which aids in annotating and exploring the framework matrices.

See how you can explore ATT&CK and MISP data with Maltego in this article.

When analyzing TTPs, you may also want to improve the process of consolidating various pieces of information with STIX. It is the most relevant industry standard being used as a universal language that assists in the definition and exchange of Cyber Threat Intelligence (CTI) information among team members, making your workflow more interoperable and efficient.

When it comes to blue teams, they often want to assess if they have good visibility or coverage of the TTPs used by threat actors. To score and compare data log source quality, they can use handy tools such as DeTTECT. Alternatively, some teams may opt for tools like Decider. It offers guidance questions to help analysts map adversary behaviors to the framework.

There is also a growing landscape of cyber threat intelligence tools, both open-source and made by vendors, that can effectively assist in visualizing, mapping, correlating, and dissecting TTPs to better understand and respond to cybersecurity threats.

There are different tools you can use to work with threat intelligence data. One of the most common and extended tools are Threat Intelligence Platforms (TIPs). If you want to get your hands dirty with them, you should have a try with MISP or OpenCTI. Both will provide you with a way to collect, manage, and disseminate intelligence across your organization and with other stakeholders.

Read more about using Open CTI for investigating TA413 threat actor group here.

Learn about Other Methods to Track Digital Traces of Your Adversary

In summary, analyzing TTPs gives you a deeper understanding of attackers’ moves and can help you spot anomalies and even forecast future attacks, leading to more effective daily operations.

At the same time, the sheer volume of information can feel overwhelming, and factors like limited time and resources can hinder the flow even if you are equipped with reliable methodologies and automation tools.

One idea to address these challenges is to use an all-in-one platform for data mapping and visualization to help you anticipate threats that may come your way.

For a comprehensive guide on analyzing attack patterns and TTPs and utilizing Maltego to streamline the lifecycle of threat intelligence, along with other common use cases, check out our handbook for Cyber Threat Intelligence below.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

If you found this article useful and would like to learn more about cyber threat intelligence investigations or other related topics, you can follow us on Twitter and LinkedIn, or subscribe to our newsletter.

Happy investigating!

About the Author

Carlos Fragoso

Investigator Toolkit June 2023: Cheat Sheets for Faster and Spot-on Workflows

Fri, 07 Jul 2023 11:23:53 +0000

Investigator Toolkit: Quick Starts to Using Maltego Hub Items in Real-life Investigations

Where to Find the Investigator Toolkit?

All Previous Investigator Toolkit Roundups

Investigator Toolkit June Roundup

In June, we featured the following four Hub items and their use cases in the Investigator Toolkit series:

Let’s dive straight into how to use these Hub items for genetic malware analysis, due diligence investigation, cryptocurrency transaction investigation, and phone number verification!

Intezer Analyze: Genetic Malware Analysis

The Intezer Analyze Transforms help investigators to reduce response time by quickly identifying, classifying, and finding solutions to any malware files based on code reuse.

OpenSanctions: Due Diligence Investigation

With its auditable open-source intelligence platform, OpenSanctions lets investigators immediately pinpoint sanctioned Entities and thoroughly map out their network connections.

Etherscan: Cryptocurrency Transaction Investigation

With the help of Etherscan, investigators can discover all Ether token-based currencies starting from an Ethereum address, transaction, or token contract.

LoginsoftOSINT: Phone Number Verification

The LoginsoftOSINT Transforms allow investigators to swiftly recognize disposable phone numbers and obtain meta-data such as apps registered with this phone number, last known activity time, and more.

Check out the Investigator Toolkit series now!

In the following months, we will continue digging into different Hub items available in Maltego and providing best practice tips for investigators.

Happy Investigating!

Advanced IOCs Collection with OSINT and Threat Intelligence Feeds

Wed, 05 Jul 2023 08:48:10 +0000

Moving from Vulnerability to Vigilance

Organizations constantly wage battles against malicious actors who seek to exploit vulnerabilities and infiltrate their digital defenses at any given time. As attacks grow in complexity, it’s imperative to keep your guard up against potential threats.

Fortunately, there are more and more methods for gathering information about attacks and attackers. By utilizing open source information (OSIF) and threat intelligence feeds, you can incorporate cyber threat intelligence into your defense strategies. This allows you to identify specific indicators of compromise (IOCs) within systems during incident response and comprehension of the targets.

In this article, we will cover the following topics:

The use of IOCs in open source intelligence (OSINT) investigations
Reliable sources for tracking IOCs
Tips on using regular expression (regex) to identify patterns indicating a threat actor
The role of threat intelligence feeds in keeping your teams informed about new threats

Understand the Scope and Impact of an Attack with IOCs

IOCs are Valuable for OSINT Investigations

Identify Traces of Threat Actors from Attack Associations and Shareable IOCs

Attribute IOCs to Threat Actors through Malware and Infrastructure

Use Public Sources to Keep Track of IOCs

Use Regex to Analyze Unstructured Data and Spot Patterns

Threat Intelligence Feeds Put IOCs into Context

Advancing Your Security Measures to a Proactive Level

Understand the Scope and Impact of an Attack with IOCs

IOCs are artifacts or clues left behind after a cyberattack that you can observe on your system to determine if your system has been compromised. IOCs come in different forms, such as IP addresses, file hashes, domain names, URLs, and more.

A typical application of Indicators of Compromise (IOCs) during incident response arises following a cyberattack. By parsing through logs and extracting IOCs, you can reconstruct the incident’s sequence of events, solving the puzzle of what happened.

IOCs help track threat actors because some can be linked to previous attacks or campaigns. Suppose a particular attack or campaign has already been attributed to a specific threat actor. In that case, it is possible that the same threat actor might be responsible for the IOCs you’re investigating.

IOCs are Valuable for OSINT Investigations

IOCs can be valuable for OSINT investigations as they provide specific clues related to malicious activities. They can lead us to more contextual information which helps us gain a deeper understanding of potential threats.

Incorporating IOCs into OSINT analysis can therefore enrich your data, improve threat detection, contextualize threats, and enable proactive defense.

If you have observed specific IOCs on your system and initiated the incident response process, you might want to delve deeper into a particular IOC to understand who is targeting you. This is essentially a part of Cyber Threat Intelligence (CTI).

Identify Traces of Threat Actors from Attack Associations and Shareable IOCs

When you’re trying to identify the culprits behind cyberattacks, one of the methods you can apply is searching for IOCs that have been connected to previous incidents. However, you also want to keep in mind how closely the IOCs are linked to past incidents as not all connections are equally strong or reliable.

Example:

IP addresses used during the same timeframe are a strong indicator that two attacks were carried out by the same threat actor—unless the IP address belongs to a Tor exit node or to a content delivery network (CDN). In those cases, it could be merely coincidental.

Likewise, if two different instances of malware download a payload from a widely accessible website like Dropbox or Discord, it’s highly unlikely that these attacks are associated.

IOCs are primarily reactive in nature: You first notice something suspicious, and then search for IOCs to understand what has happened to your system. However, they can also be employed proactively to generate cyber threat intelligence.

Example:

As we read through this report by Talos, we can take note of various IOCs to study them later to get actionable intelligence. One simple yet effective step to take is to block the IP addresses mentioned in this article.

Another important point to consider is that threat actors often deploy infrastructure that can be shared across various devices to carry out an attack. The identifiers of this infrastructure later become IOCs. In order to track threat actors, you need to look into these types of IOCs.

Example:

A less effective indicator to track threat actors is a hash, as it is used to identify one file. Any threat actor can easily generate multiple variations of the same malware with slight changes, resulting in entirely different hashes (especially when using hashing algorithms like MD5, SHA256, or SHA1).

On the other hand, indicators like a domain, a domain pattern, or an SSL configuration are much more valuable. They require more effort for threat actors to create, so they are more likely to be reused. By identifying and monitoring these indicators, you have a better chance of discovering new components, such as related malware or infrastructure, that are associated with the threat actors.

Attribute IOCs to Threat Actors through Malware and Infrastructure

It’s critical to keep in mind that attributing cyberattacks to specific threat actors is a difficult task and rarely achieves 100% accuracy.

There are various reasons for this, including the reuse of infrastructure or software by different actors, the potential for shared members among threat groups, and the deliberate use of false flags to mislead investigators. Altogether, they render the attribution process a very imprecise and flawed science.

However, looking beyond attribution, the study of IOCs left behind can still provide us with valuable insights into similar malware and the infrastructure employed by threat actors:

If we come across malware on our infrastructure, we can examine its communication patterns by analyzing data from well-known sandbox websites like JoeSandbox or VirusTotal.
If the malware is communicating with a specific IP address, we can gather information about the behavior of that IP address by consulting providers like GreyNoise, or we can refer back to VirusTotal or OTX AlienVault.
If the identified IP address has been used to download other malware, we can further investigate its presence and activity within our infrastructure.

Use Public Sources to Keep Track of IOCs

In addition to keeping a close eye on your system for IOCs, you can tap into open-source data sources to enhance your IOCs collection. These sources include public repositories, online forums, and social media platforms, among others.

Here are some of our recommendations:

GitHub repositories
- Example: C2IntelFeeds
Social media profiles
- Example: Cryptolaemus1
Threat intelligence websites
- Examples: VirusTotal and OTX AlienVault
Sandbox websites
- Example: Joe Sandbox

Another idea is checking specialized websites, such as Talos Intelligence. While these websites are not threat intelligence feeds, you can still obtain the analysis of a particular threat actor or malware from their research.

There are also communities where IOCs are shared, such as MISP or OTX AlienVault. While these communities may not strictly fall under the umbrella of open source intelligence (OSINT), they can still provide valuable IOCs for your collection.

Online forums can also be a potential source of IOCs, although to a lesser extent. It is rare for a threat actor to post a VirusTotal link to their malware, which would include the hash of the malware in the link. This is considered a bad practice among threat actors and is therefore not commonly seen.

Use Regex to Analyze Unstructured Data and Spot Patterns

Regular expressions (regex) may require more hands-on work, but it proves to be particularly useful in the context of IOCs and OSINT.

A regex is a string of characters that enables you to define a specific pattern. This allows you to search for and/or replace occurrences of this pattern within a given text. For example, with a simple regex, you can extract a list of IP addresses mentioned in a random log file, regardless of its length.

Regexes have the following advantages:

Efficiency: If you were to run a simple regex on the entire Bible, which comprises approximately 31,000 lines (considered relatively small compared to some log files), the results would be instantaneous.
Wide adoption: Regex has been around since the 1950s. There is extensive documentation, a variety of development tools, and a supportive community to help answer any questions. Also, many tools and platforms support the use of regex, enabling you to apply your knowledge in various contexts.
Easy to learn, hard to master: Basic regex searches, such as looking for any IP address within a given netblock, can be learned in about an hour. You can go much further and do some very complex and specific searches depending on your needs. This, however, requires more time and patience.
IOCs validation: Regex searches are like detectives who check whether the right pieces fit together. IOCs have specific formats and patterns, just like fingerprints. You can use regex searches to validate IOCs and see if they match the expected patterns. This can help maintain the accuracy of collected indicators, reduce errors in threat detection, and ensure you don’t miss potential threats or raise false alarms.

Key Considerations for Using Regex

Regexes can be quite complex, so it’s wise to test them before running them on large files. Websites like regex101 can help you test your regex with sample text to ensure it works as expected.

When conducting a regex search, it’s best to start with a broader search pattern and then refine it gradually to not miss any important information.

Example:

Before May 3rd, 2023, the string “malware.zip” was most likely considered a filename because, at that time, “.zip” was not a valid top-level domain (TLD). However, the issue arises when “malware.zip” can technically be a correct domain if your regex does not account for valid TLDs. This means that a generic regex for domains would mistakenly identify “malware.zip” as a domain, even though it was a filename, resulting in a false positive.

To avoid this, a skilled analyst would design a regex that considers only valid TLDs when detecting domains. This is because, as of May 3rd, 2023, Google started selling domain names using the “.zip” TLD, which means that any domains using this TLD would be missing from our results if our regex was not updated accordingly.

This example illustrates just one of the many situations where you have to choose between using:

A more generic regex, which identifies more results but may include false positives.
A more restrictive regex that minimizes the number of false positives. However, in doing so, it may miss some valid results.

It is generally easier to identify something in your results that shouldn’t be there, rather than noticing something that should be there but is missing.

There are two things that could be particularly interesting to look for when searching through log files:

Login attempts into databases or other critical tools on the machine (e.g., “mysql -u”)
Tools that could potentially be used for file download or upload purposes (e.g., wget or curl).

If you would like to experiment with some regex patterns, take a look at our regex cheat sheet for automatically extracting data from reports:

CVEs

CVE-\d{4}-\d*

Common hashes (MD5, SHA1 and SHA256)

[A-Fa-f0-9]{64}|[a-fA-F0-9]{40}|[a-fA-F0-9]{32}

URL even when defanged (ex: hxxps://google[.]com)

(?:h..ps?|f.p)://(?:www(?:.|[.])|(?!www))[a-zA-Z0-9]+a-zA-Z0-9[^\s]{2,}|www(?:.|[.])[a-zA-Z0-9]+a-zA-Z0-9[^\s]{2,}|https?://(?:www(?:.|[.])|(?!www))[a-zA-Z0-9]+(?:.|[.])[^\s]{2,}|www(?:.|[.])[a-zA-Z0-9]+(?:.|[.])[^\s]{2,}

IPv4 even when defanged (ex: 8[.]8[.]8[.]8)

\b[\d]{1,3}[?.]?[\d]{1,3}[?.]?[\d]{1,3}[?.]?[\d]{1,3}(:\d+)?\b

IPv6

[0-9a-fA-F]{1,4}(?::[0-9a-fA-F]{1,4}){7}|(?:(?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4}){0,5})?)::(?:(?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4}){0,5})?)

BTC address

(?:[13]|bc1)[a-zA-HJ-NP-Z0-9]{26,62}

Threat Intelligence Feeds Put IOCs into Context

Regex searches have a limitation in that they do not consider the surrounding context and focus solely on predefined patterns and structures. However, this limitation does not apply to threat intelligence feeds.

Intelligence does not equal to a collection of unorganized IOCs. These IOCs should have associated context and answer questions like:

When were they observed?
Who is the threat actor they are linked to?
What malware are they associated with?

This doesn’t mean that all the information is always available, but threat intelligence feeds provide as much contextual information about IOCs as possibly available.

We can think of it as a large encyclopedia that analysts can turn to when they’re trying to make sense of unusual discoveries in their systems.

Therefore, threat intelligence feeds are invaluable for threat analysts.

Here are a few examples of threat intelligence feeds with diverse sets of data sources commonly used in the industry:

One thing worth mentioning is that although they are useful for detecting and responding to security incidents, threat intelligence feeds are a tool that makes the analyst’s work easier, but they do not aim to serve as an automated solution such as Endpoint Detection and Response (EDR) platforms.

In any case, the data provided by threat intelligence feeds are structured and designed to be easily queried, meaning that the information obtained is already organized and tailored for ingestion.

Advancing Your Security Measures to a Proactive Level

To sum up, there are reliable methods for collecting and comprehending IOCs, such as:

Open source intelligence (OSINT)
Threat intelligence feeds
Regular expressions (regex)

When used consistently and properly, these resources will help you stay ahead of adversaries and maintain a proactive security stance.

For a comprehensive guide on collecting threat intelligence and utilizing Maltego to streamline the lifecycle of threat intelligence, along with other common use cases, check out our handbook for Cyber Threat Intelligence below.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

Stay connected with us on Twitter and LinkedIn, and don’t forget to subscribe to our newsletter for regular updates.

Happy investigating!

About the Author

Mathieu Gaucheler Mathieu Gaucheler is a subject matter expert at Maltego. His responsibilities include research-driven content development for blog posts, webinars, and talks. He started working in cybersecurity in Barcelona, focusing on malware analysis and sandbox development. He has previously presented his research at BotConf and RSA APJ.

How to Integrate Data Sources into One Interface

Fri, 30 Jun 2023 07:46:30 +0000

One of the main challenges Security Operations Center (SOC) teams face is the lack of integration between security tools. The burden on SOC teams is further amplified by the overwhelming volume of alerts and data that each device generates daily and the seemingly endless flow of false positives.

Source: Optiv

This article will discuss the leading causes and consequences of the lack of integration between tools and explore potential solutions.

Lack of Integration between Security Tools

Consequences of the Lack of Integration

The Need for a Unified Interface

Real-Life Example

Solutions to the Lack of Integration between Security Tools

Conclusion

Lack of Integration between Security Tools

The lack of integration between tools increases the time that security analysts spend manually correlating events between tools. This, in turn, increases the time required to confirm whether an alert is a security incident or just another false positive and could even cause the analyst to miss critical security events.

Among the main reasons for the lack of integration is the use of tools that are not designed to work together. Vendors generally use different formats for their data, making it hard to integrate, combine and correlate data from multiple sources.

Consequences of the Lack of Integration

Let’s take some time to discuss the main challenges caused by the lack of integration between security tools.

Tool Fatigue: occurs when SOC teams have to use and manage multiple disparate tools. Constantly switching between different interfaces, each with its own user experience, data representations, styles, and even query languages, slows down the analysis workflow and makes incident detection and response less efficient.
Alert Fatigue: caused by exposing security analysts to large numbers of security alerts (many of which may be false positives) and usually results in the analysts becoming desensitized to the alerts due to the overwhelming number of alerts they receive on a single day.
Data Silos: appear when important security information is confined to one tool and unavailable to others. When security tools are not well-integrated, they cannot effectively share information with one another.
Time to Confirm a False Positive: We already talked about increased incident response times, but another task requiring fast results for security analysts is in confirming whether an alert is a false positive or not. Switching between multiple tools to verify if an IOC (indicator of compromise) is a false positive wastes time that the analyst could use to focus on actual threats.
Vendor Lock-in: Organizations may feel stuck with certain vendors when tools don’t integrate well with others, even if their needs evolve or better solutions become available.

The Need for a Unified Interface

The lack of integration between security tools has challenged security teams for many years. This led to the development of Security Information and Event Management (SIEM) platforms, such as Splunk.

Source: Splunk

SIEMs aim to provide a more integrated and holistic view of security by collecting, correlating, and analyzing data from various sources. But, even though they are very powerful and have become a must in SOCs of all sizes, these platforms come with their challenges.

A study by Panther Labs from 2021 highlights some of the main challenges identified by a group of 400 IT security professionals who actively use a SIEM as part of their job.

Below are some of the key findings highlighted by the study.

Query Speed: Slow queries were mentioned by nearly half of the survey participants as their main problem when it comes to SIEMs.
Lack of Visibility: Given the high cost associated with traditional SIEMs, security teams are often forced to choose which data sources are most crucial to collect to reduce costs. Leaving SOC teams with limited visibility into their organization’s security stance.
Complexity: Managing a SIEM solution is challenging and requires individuals with special skills to maintain and fine-tune the platforms.
Too Many Alerts: Usually, the result of the previous point can cause alert fatigue or apathy from the security analysts in charge of investigating them.

In my time as a security analyst and threat hunter, I got to experience all of these challenges firsthand on many occasions. Let me share a short story with you.

Real-Life Example

I remember a case where we received an alert from a user about a suspicious email they had received. After a quick check with the network team, we were informed that the email security gateway (ESG) had also flagged the email as suspicious. It turned out that the rule that was supposed to trigger in our SIEM was broken, so an alert for this event was never received.

I started running queries in our SIEM, searching for all the users who received the email and trying to confirm if anyone had clicked on the link mentioned in the email. The process was sluggish, the platform was overwhelmed with data, and the queries took considerable time.

While I was working on that, a peer looked into sources like VirusTotal, AlienVault OTX, and AbuseIPDB for any additional insights into the sender’s IP address, the URL mentioned in the email, the sender, and other relevant information. This back-and-forth between multiple platforms took time and effort.

When the SIEM was done processing, the results revealed that several employees had not only received the email but also clicked on the malicious link. This discovery required another round of investigations using even more tools.

The investigation lasted several hours, a laborious process filled with tool-switching, manual data correlation, slow response times, and the involvement of multiple teams. This incident highlighted the glaring need for a more streamlined and integrated approach.

Solutions to the Lack of Integration between Security Tools

Organizations must adopt an integrated approach to their security infrastructure to overcome the challenges of the lack of integration between tools. This involves ensuring interoperability among tools and adopting solutions that can effectively manage and interpret the data generated by these tools.

SIEMs

SIEMs were the first approach and the go-to by many organizations trying to solve the lack of integration. As we already discussed, there are many strengths and weaknesses associated with these platforms. To help improve SIEMs, these are usually paired with other solutions such as Security Orchestration, Automation, and Response (SOAR) systems.

SOARs

SOARs are very effective at streamlining security procedures by coordinating and automating security tasks between tools and teams, thus reducing some of the repetitive tasks assigned to security teams. However, these platforms require significant time and resources to implement and maintain, representing a major challenge for most organizations.

Maltego

Maltego presents itself as a possible solution for most challenges presented by the lack of integration between tools.

Although Maltego does not intend to replace solutions like a SIEM, its data integrations can significantly reduce the burden on SOC teams in at least three areas:

Cybersecurity Operations
Threat Intelligence
Threat Hunting

Another strength of Maltego is its use of Transforms. These allow analysts to interrogate data without requiring them to learn a new query language and even guide them by providing specific outputs that each piece of information can provide.

For example, while looking for information on an IP address, an analyst may check AbuseIPDB on Maltego and see the following Transforms:

By simply clicking on one or more Transforms, the analyst could confirm whether the IP is malicious or not, obtain geolocation information, find hosts associated with the IP, which could be C2 (Command and Control) servers, and even get insights into the type of infrastructure related to the IP address (CDN, Hosting, Shared, Dedicated).

These are just a few ways Maltego can help SOC teams with the challenges created by the lack of integration. If you want to learn more, we recommend reading about Maltego Machines, which help you automate workflows by running Transforms in pre-defined orders, and the collaboration feature, which allows you to share and collaborate via live graphs between team members.

Conclusion

The lack of integration between security tools represents a significant challenge for security teams. Tool fatigue, slow responses, missed threats, and alert fatigue are just a few of the problems caused by the lack of integration.

The journey to streamlined cybersecurity operations may be complex, but it is necessary for today’s ever-evolving threat landscape. By leveraging tools like Maltego, SOC teams can simplify and improve their processes, combine disparate data sources into a single interface, and effectively combat the consequences of tool disintegration.

If you found this article useful and would like to see more updates on intelligence gathering or other related topics, you can follow us on Twitter and LinkedIn or subscribe to our newsletter.

Mario Rojas

Improving your Intelligence Analysis with Structured Analytic Techniques

Thu, 22 Jun 2023 13:35:32 +0000

KEY POINTS:

Structured Analytic Techniques (SATs), such as the Key Assumptions Check (KAC) and Red Team Analysis (RTA), assist analysts in critically examining information and mitigating biases amid the growing challenges posed by threat actors.
The effectiveness of the KAC lies in its ability to yield immediate and valuable results. By allowing analysts to scrutinize assumptions, identify flaws, and promote transparency and logical reasoning, it enhances the analytic process.
RTA enables analysts to break free from established mental frameworks, but its execution requires careful planning, challenging institutionalized beliefs, and assessing plans from different perspectives.

Introduction

As threat actors continue to adapt and excel in complex environments, countering them has become increasingly challenging, often leaving those who seek to hunt them lagging behind. This puts pressure on analysts to work more effectively and efficiently to produce valuable intelligence results.

Generating intelligence in the face of this adaptability becomes an arduous task characterized by a rigorous selection, evaluation, interpretation, and expression process. On top of that, intelligence analysis is susceptible to human fallacies that can impair judgment and undermine conclusions.

To elevate the structure of the analytic process and keep pace with changing circumstances, analysts can employ Structured Analytic Techniques (SATs) which we will evaluate in this article.

What are Structured Analytic Techniques?

What are Key Assumptions Checks?

What is Red Team Analysis?

How Can SATs Help Shape Better Intelligence Analysis?

What are Structured Analytic Techniques?

While the concept of using SATs to meet analytic needs is not a new one, it was not until the attacks of September 2001 that the cost of intelligence failures in the modern world was brought into the public sphere.

This revelation made it evident that intelligence analysis itself has significant limitations, which could have critical implications.

Ultimately, a set of Structured Analytic Techniques was established to help alleviate common analysis failures by:

Accelerating analysis with a formalized framework for information processing
Implementing quality gates and checks to ensure objectivity
Laying the foundation for critical analysis, leading to self-reflection and processual improvements

By utilizing SATs, we can enhance the way in which we analyze information, ensuring our conclusions are well-structured and based on logical reasoning. SATs also help to overcome cognitive biases, foster creativity in our thinking, and identify early warning signs of change, which are crucial in uncertain and high-stakes situations.

Numerous SATs have been identified over the past decades, but we will narrow our focus to two specific examples in this article: the Key Assumptions Checks (KAC) and Red Team Analysis (RTA).

What are Key Assumptions Checks?

The Key Assumptions Checks aim to enhance the transparency of analytic arguments and assumptions regarding intelligence gaps.

It is about dedicating time, either individually or as a group/team, to identify, elaborate upon, and review the key assumptions that have been made.

The KAC methodology follows a four-step process:

Reviewing the current analytic line on the issue and documenting it for all to see
Articulating all the premises, both stated and unstated, that are accepted as true for the validity of the analytic line
Questioning each assumption by examining why it “must” be true and whether it remains valid under all conditions
Refining the list of key assumptions to contain only those that are necessary to support the analytic line, and considering the conditions or information that could challenge these assumptions

In brief, KAC will enable us to critically examine and gain a deeper understanding of crucial aspects within an investigation. This includes analyzing individual data points and the connections between them.

The KAC technique requires minimal setup, is straightforward to use, and can yield immediate and valuable results.

It is particularly valuable when applied at the outset of an analytic project, although it can also be implemented at various stages throughout the analysis process prior to reaching a conclusion.

Key Assumptions Checks in Practice

To demonstrate the practical application of this SAT, let’s examine the 2002 DC Sniper Case. During this period, a series of shootings took place, claiming the lives of 17 individuals and injuring 10 others over 10 months.

When law enforcement initially analyzed the incident, they made several critical assumptions:

The sniper was male.
The sniper was acting alone.
The sniper was white.
The sniper had military training.
The sniper was driving a white van.

A critical analysis of these assumptions would reveal the following points of contention:

While most similar incidents in the US involve white, male, solo actors, excluding non-white and female suspects would greatly limit the suspect pool.
Military training, while plausible, is not a certainty as private citizens also have access to firing ranges.
Relying solely on one witness report of a white van speeding away prematurely narrows down the potential suspects.

Ultimately, the “DC sniper” case resulted in the detention of two men of Jamaican heritage who were charged with the crimes. One of them did have military training, but they used a blue Chevrolet for the attacks instead of the assumed white vehicle.

Out of the five initial assumptions, only two proved to be correct. If these assumptions had been properly scrutinized, the investigation could have proceeded in a more comprehensive manner, and although more suspects would have been considered, this ‘wider net’ could have included the perpetrators thus bringing the case to a close much sooner.

The KAC technique could have been employed with minimal effort and yielded significant results. In similar cases, other SATs can also be applicable. For example, Red Team Analysis.

What is Red Team Analysis?

Red Team Analysis can be likened to a pattern of imaginative thinking, aimed at generating fresh insights, alternative perspectives, and different outcomes.

By adopting RTA, analysts can break free from their established mental environment and transition from being mere observers of an adversary to assuming the role of the adversary themselves. This involves considering the cultural norms, personal values, and rationality of the adversary they seek to emulate.

On the whole, RTA does not have clear and concise steps but rather seeks to establish an environment in which the technique can be leveraged. The ultimate goal is to assess the operation’s vulnerabilities and weaknesses from an opposing perspective, as well as helping to identify blind spots and potential flaws in a given plan.

An example of effective Red Teaming is Operation Desert Storm, where RTA was utilized to simulate and assess potential Iraqi strategies and tactics, which in turn led to improved operational planning and decision-making.

In its nature, the role of RTA is to:

Challenge institutionalized beliefs
Help avoid cognitive biases
Aid in plan assessment
Establish a common understanding
Formulate insights and intuition
Detect flaws in assumptions

Red Team Analysis in Practice

RTA is a complex and context-dependent technique to plan and execute. In the book Enhancing and Developing a Red Teaming Community in MORS, Kardos and Dexter identified seven different types of Red Teaming activities, including:

Field/Deployment Exercises
Wargaming
Cyber
Computational
Functional/CPX
Discussion/Tabletop Exercises
Critical Analysis

In terms of technical considerations, there are a few requirements to consider:

The perspective and approach for each of these activity types need to be defined and planned to create the framework and boundaries for the exercise.
Participant selection is critical to achieving ideological neutrality to maintain objectivity because a biased team may suppress dissent rather than engage in substantive debate.
Given the nature of RTA and its requirement to understand the adversary’s mindset, intimate knowledge of adversarial tactics, technology, political climate, forces, systems, and values is necessary.

It is important to note that the expertise needed for RTA may surpass the capabilities of regular intelligence analysts and require experienced subject matter experts, such as university professors.

How Can SATs Help Shape Better Intelligence Analysis?

Both the Key Assumptions Check (KAC) and Red Team Analysis (RTA) provide valuable techniques for intelligence investigations, but their effectiveness relies on systematic, rigorous, and regular application.

Instead of simply mandating their teaching to analysts, it is advisable to invest time and resources in evaluating their usefulness to prevent SATs from complicating the analytic process rather than providing clarity.

In the longer term, prioritizing the understanding of SATs before implementation will support the professional growth of intelligence analysts and equip analysts with critically analyzed and effective techniques.

To read the complete essay about evaluating SATs, download Aaron’s original paper here:

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

If you found this article useful and would like to see more updates on intelligence gathering or other related topics, you can follow us on Twitter and LinkedIn, or subscribe to our newsletter.

Happy investigating!

About the Author

Aaron Dixon

Sources

Greenberg, A. (1981). An Outline of Wargaming. Naval War College Review, 34(5), 93–97.
Coulthart, S. J. (2017). An Evidence-Based Evaluation of 12 Core Structured Analytic Techniques. International Journal of Intelligence and Counterintelligence, 30(2), 368–391.
Kardos, M., Dexter, P., & Bowden, F. D. J. (2016). Enhancing and Developing a Red Teaming Community in MORS. Phalanx, 49(4), 20–22.
Marrin, S. (2009). Training and Educating U.S. Intelligence Analysts. International Journal of Intelligence and Counterintelligence, 22(1), 131–146.
Moore, D. T. (2007). Critical Thinking and Intelligence Analysis. National Defense Intelligence College Occasional Paper 2007(1). Washington, D.C.: National Defense Intelligence College.
Moran, J. P. (2021). Red Team or Red Herring? Lessons Learned from the Policy Counter Terrorism Evaluation Group. The International Journal of Intelligence, Security, and Public Affairs, 23(3), 400–424.
Pherson, R. H., & Heuer, R. J. Jr. (2014). Structured Analytic Techniques: A New Approach to Analysis. In R. Z. George & J. B. Bruce (Eds.), Analyzing Intelligence: National Security Practitioners’ Perspectives (2nd ed., pp. 444–477). Washington, DC: Georgetown University Press.
Reinhold, D., Russo, C., & Eisenfeld, B. (2020). Analytical Standards in the Intelligence Community: Are Standards Professionalized Enough? Journal of Strategic Security, 14(1), 106–121.
United States Government. (2009). A Tradecraft Primer: Structured Intelligence Techniques for Improving Intelligence Analysis. Washington, DC.

How to Conduct Person of Interest Investigations Using OSINT and Maltego

Wed, 21 Jun 2023 14:06:13 +0000

As paper trails turned digital, person of interest investigations have become a complex game of cat-and-mouse. It is becoming easier and easier for criminals and malicious actors to hide behind fake online identities. Navigating such a digital landscape can become challenging for law enforcement agencies and criminal investigators alike.

On the other hand, as many aspects of our lives depend on or exist only on the internet, we might be sharing information and details of our personal identities and private life without knowing. These digital footprints might seem and can often be harmless. In certain cases, however, they can also be points of vulnerability.

It is important for investigators to have effective methods and tools for mapping digital footprints—either for a criminal case or to protect a person of interest from external threats.

With Maltego, investigators can quickly and easily link seemingly disparate leads and build a comprehensive map of a target person’s digital footprint. Integrated with a variety of OSINT, social intelligence, and identity data sources, Maltego is the perfect tool to quickly obtain and analyze the digital presence of a person of interest.

In this tutorial, we will demonstrate how to conduct a person of interest investigation using OSINT in Maltego. We will start with the names of two public individuals and pivot into more personal identifiers, including social media accounts, private phone numbers, a company name, personal email addresses, and the network infrastructure of websites connected to them.

Watch the video now, or follow along to read the documented tutorial and download your cheat sheet below.

Conducting a Personal Recon Investigation

For this tutorial article, we’ll explore the digital footprint of two individuals, Aina and Marc Clotet, by using Maltego Data and by following the six steps below:

First, we’ll look for official information about the targets, such as their location and personal websites. Next, we will trace the digital trail left by our targets and then delve into their official and private social media profiles, gathering profile images and insights into their closed networks.

After that, we’ll explore a company with which both targets appear to be affiliated. Next, we’ll map the infrastructure of their websites in search of more detailed information, such as their personal email addresses. Finally, in the last step, we will utilize our findings to search for phone numbers associated with the targets.

If you would like to reproduce the steps in your Maltego or get an extensive overview of the investigation, download the workflow cheat sheet now!

DOWNLOAD CHEAT SHEET

Step 1: Discovery

Our targets are actors who also happen to be siblings: Aina and Marc Clotet. We will begin our investigation by identifying some basic information and connections.

First, we open a new graph in Maltego, paste the names of the actors as Phrase Entities, and run the To Search Page Titles [Wikipedia EN] to discover the official Wikipedia pages for both actors.

From there, we can run the To Links [found on web page] Transform to get a list of websites found on their respective Wikipedia pages. We will also get an overview of which websites are mentioned on both of their Wikipedia pages.

Two results are particularly relevant as they lead to the official websites of Aina and Marc Clotet: “www.ainaclotet[.]com” and “www.marcclotet[.]com.” They will serve as starting points in the later stages of this investigation.

Apart from searching for websites, we can also extract other relevant information mentioned on the official Wikipedia pages, such as locations and names.

To do that, we will run the To Entities [IBM Watson] Transform.

In doing so, we retrieved a list of names potentially linked to our targets and a location shared by both actors (Barcelona, Spain).

Step 2: Online Footprint

We will start our next step by dragging a Phrase Entity into a new graph and adding the actors’ names in inverted commas to limit the search results down to exact matching. This is a common search dorking technique to increase the relevance of a web search.

Our goal is to find websites associated with our targets using the Maltego Standard Transforms.

We do this by first running the To Website [using Search Engine], then the To URLs [show Search Engine results], and finally the To Links [Found on web page] Transforms.

These Transforms return a list of websites where the names “Aina Clotet” or “Marc Clotet” are mentioned. They include documenting websites such as Wikipedia, as well as a personal website we also saw in the first step, namely “ainaclotet[.]com.”

We will now try to extract contact information that is usually embedded in the website footer. It can serve as a starting point to investigate professional contacts of our target, aiding in profiling and potentially uncovering connections to their secondary or hidden profiles.

As an example, we will use the identified Entity “ainaclotet[.]com/i/es/” and run the To Email Addresses [found on webpage], and To Phone Numbers [found on webpage] Transforms.

Maltego returned a collection of Entities pointing to email addresses (such as “esther@paperstreet[.]es”) and phone numbers that are likely linked to talent managers.

To verify the retrieved data, we can double-click on the Entity on which we ran the Transforms and view the page by clicking on “Open all URLs.”

NOTE: Within Maltego, you can open retrieved URLs in the browser. Analysts can use this feature to document other relevant information, such as date of birth, names of family members, or country of residence available on those websites. This data can be important in the later stages of your investigation.

As we open the website and scroll down to the bottom of the page, we can observe the contact details of Aina’s representatives, thereby confirming the results obtained through Maltego.

Retrieved phone numbers and email addresses may also prove important in later stages of the research, so keep that in mind when you launch your own investigations.

Now, we will try to map the social media profiles of our targets. Let us open a new graph and start with two Person Entities.

This time, instead of applying dorking techniques, we will use a variety of Maltego Transforms tapping into social media intelligence (SOCMINT).

We will begin with the To Social Media Profiles Transform from the Google Social Network Transforms.

After refining the graph to display only relevant Entities, we can see a couple of accounts registered on popular social media platforms with photos of our targets.

If you take a closer look at the profiles, you will discover that these accounts are usually public and have thousands of followers. We can also easily list some of the aliases used across the platforms, such as “marc_clotet,” “marcclotetoficial,” “ainaclotet,” or “AinaClotetOfficial.”

The official accounts are often marked by checkmarks to show that they are verified and recognized by the public person.

We do, however, seem to have identified a personal Instagram account named “ainaclotetfriends” with the accompanying biography, “Page just for friends;) official page @ainaclotet."

Since it has become quite common these days for public figures to use Instagram for both private activities and public promotion, we will now focus on mapping their Instagram activities and mutual connections.

We will first use the previously discovered usernames “ainaclotet” and “marc_clotet” to extract the Instagram Entities on a new graph using the Get Instagram User [Vetric] Transform. Then, we will map out the profiles they follow and those that follow them back by running the Find Mutual Following [Vetric] Transform.

The Transform returned a large number of relevant profiles, such as the Instagram account of what appears to be a company named “Funicular Films.”

We also stumbled upon following relationships to private accounts, indicating a potentially close relationship between the owners of those accounts and our targets, especially since these accounts also follow the targets back. This discovery could serve as a valid starting point for further investigations of a similar nature.

Step 4: Company Investigation

In a person of interest investigation, it is also important to consider the professional relationships and affiliations of our targets.

In the previous step, we found a link to the entity “Funicular Films,” which appears to be the name of a company. Let’s follow this lead and examine how it connects to our targets.

We will open a new graph and run the To Website [using Search Engine] Transform on the “Funicular Films” Phrase to find the official website of this Entity and the To URLs [show Search Engine results] Transform to find relevant pages.

There are two pages under the “funicularfilms[.]com” website that caught our attention: “Team – Funicular Films” and “Privacy Policy – Funicular Films.”

We want to explore the first one to find information on the company’s officers and the latter to obtain information about the company’s legal name. To do that, select both Entities and run the To Entities [IBM Watson] Transform.

We see that our targets are affiliated with the company they follow on social media, thereby confirming the accuracy of our investigation results.

Additionally, we have identified other officers linked to this company as well as its legal name – “FUNICULAR FILMS SL,” which seems to be based in Barcelona, Spain. This aligns with the location of the actors we discovered in Step 1.

If we wanted to delve deeper into the company or its officers, or if we wished to investigate another company in a similar manner, we could also make use of specific Transforms from OpenCorporates or Orbis – Bureau Van Dijk, which are designed specifically for conducting company investigations. However, for our current investigation, we want to primarily focus on exploring the online presence of our targets.

Step 5: Infrastructure Investigation

This part of our investigation will focus on a couple of domains discovered in Step 3. Our goal is to find associated email addresses and other domains that link to those email addresses.

In a new graph, we will paste the following website domains as Domain Entities onto the graph:

ainaclotet[.]com
marcclotet[.]com
marc-clotet[.]com
funicularfilms[.]com

We will now use the DomainTools data source, which contains domain registration records known as Whois information, to search for email addresses associated with those domains by running the dtDomain2HistoricEmail [DomainTools] Transform.

Next, we find other domains registered with the same email addresses with the dtEmail2HistoricDomains [DomainTools] Transform.

The reason why we use historic search is because it was a common practice in the past to set up websites using personal emails. Over time, the ownership of these domains may have changed, especially due to the increased popularity of our targets. While the current, up-to-date website registry information might not help our investigations, the historical data from DomainTools can still provide the insights we need.

Among the email addresses we find, two of them seem to be their personal Hotmail email addresses.

This information holds great value in person of interest investigations as it enables us to find out more about a person’s online footprint and uncover more specific identity intelligence.

Step 6: Personal Sphere

In the final step, we will take our recent finding, namely, the targets’ private email addresses, and pivot from them using the To Search Person [Pipl] Transform to find matching person profiles.

To narrow down our search and find an exact match, we can provide additional information in the wizard, such as the country code “ES” for Spain. Since we have already established a connection between the actors and Barcelona, Spain, including this data will help us refine our search.

Maltego retrieved the names of Marc and Aina, indicating that the email addresses likely belong to them. Interestingly, the search also yielded the most probable age for Marc, which is 43.

Let’s delve deeper into their profiles and discover more information by running the To Expand in Full [Pipl] Transform.

Our findings include Aina’s personal Gmail address, a collection of phone numbers, and locations associated with our targets.

In fact, we can also see the precise address of the location connected to Marc in the Detail View, which appears to be a private house when viewed on Google Maps.

We also managed to obtain a URL leading to a website that contains Aina’s profile, featuring additional personal information such as her photo, educational background, and the languages she speaks.

As the next step, we wanted to verify the retrieved phone numbers employing the To Look up phone number [OpenCNAM] Transform.

This led to discovering Entities associated with the numbers, revealing details such as the names of our targets, location indicators, and the name of their father.

What could also prove interesting are the Pipl Tag Entities (To Tags [Pipl] Transform). These Entities represent the hobbies, interests, and other notable information about the targets.

While these particular interests are harmless, little nuggets of information like these from a person’s past (or present) can help us to glean a complete picture of, and get closer to a person and his or her interests.

Enrich Your Person of Interest Investigations with More OSINT Data

You have reached the end of the example of a personal recon process that investigators can perform using Maltego.

To quickly recap, we started with two names to discover their personal websites, location, and family member names.

We further explored their online presence, uncovering associated websites and domains. Then, we identified their official and private social media accounts with profile pictures and delved into their network of social contacts.

Moving forward, we investigated a company affiliated with both targets and traced domains connected to our targets back to their personal email addresses. Finally, we used those email addresses to find more detailed personal information, including private phone numbers and a home address, which added another layer of understanding to our investigation.

Pivoting to Other OSINT Data

From the different Entities returned to our graph, we could of course investigate deeper and wider, such as pivoting into a reverse image search or conducting a network footprint using the targets’ email addresses. This would help us to map an even more extensive online and infrastructure network of the person of interest.

If we are conducting the person of interest investigation for fraud, we could also look at the target’s business relationships using the OpenCorporates and WhoisXML data integrations. We showed such a use case in our joint webinar with Pipl.

Download Your Cheat Sheet

If you would like to reproduce the steps in your Maltego or delve even further into your investigation, do not forget to download the workflow cheat sheet enriched with additional investigative points!

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

We hope you enjoyed this demonstration of a person of interest investigation. Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter to stay updated on the latest tutorials, use cases, and webinars!

Happy investigating!

About the Author

Carlos Fragoso

The Pivot Podcast: Senior Law Enforcement OSINT Trainer with Henri Beek from DataExpert

Thu, 15 Jun 2023 11:44:50 +0000

In this episode for The Pivot podcast, we welcome Henri Beek!

Henri Beek has more than 13 years of professional experience working in the Open Source Intelligence (OSINT) space. Within his career, he has used OSINT for different types of investigations, ranging from fraud and employment screening to family protection, red teaming, and cyber threat intelligence. Henri currently works at DataExpert, where he provides OSINT training and consultancy to law enforcement and related agencies throughout Europe.

In this episode, we peek into OSINT investigations from back in 2008, when it was still called “Desk Research” and conducted with plenty of paperwork. Henri also expands on the topic by bringing up the access problems, such as the takedown of Facebook Graph. He also points out that investigators should be more mindful of the information they are sharing online and be keen on examining the source and reliability of the contents.

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

The Pivot: Your New OSINT and Infosec Podcast

Where to Listen to The Pivot? 

What really got you into OSINT?

Henri: I was into gaming a lot back in the days when Battlefield 2, World of Minecraft, and things of that sort came out. You needed some more information on maps for Battlefield 2, for example, what the nice points to be a sniper were or what the good guides on Dungeons and rating in World of Minecraft were.

These things brought me to look for stuff on the internet, and I got the hang of searching for information. After that, I diverted my attention to social media platforms, and then that was picked up by a private investigation firm here in the Netherlands. That’s how I rolled from a hobby into the business doing OSINT stuff.

Where did you start doing OSINT work? Was it just browser-based, or were you using any applications at that time?

Henri: It was still called Desk Research when I first started in 2008 at a private investigation firm. To them, Desk Research was looking into the Chamber of Commerce, lens register files, and a bit of search engine work. They weren’t really interested in the whole social media and source code in the beginning. Here in the Netherlands, we had a lot of social media platforms like Superdudes and Hives (now closed). When I got there, it was really missing pivot points in which you could still conduct investigations.

One of the first things I did when starting in that job was to expand the sources and methods to get more information out of the sources. One of the walls [in my office] was covered with bookcases with phone books and zip code books. I was in the room where the printers were, which felt like a wrong room to be in. However, they were like: “No, this is your workspace. Here is your seat and your computer, and go ahead.” I was like, “Yeah, but why all the phone books in paper?” I mean, it was 2008. We were past the starting point of the internet. Why all these books? What they told me was, “Well, it’s nice we have the internet. Sometimes, phone records are taken off the white pages or the yellow pages online, and then we still have those paperback phone guides which we can use to search for a phone number of the person we’re interested in or maybe a neighbor.”

That really got me thinking that OSINT was more than that. We nowadays look at only the internet in the World Wide Web, but it’s also still about TV broadcasts, radio broadcasts, and podcasts, for example. There’s much more to it than just the internet.

What are the usual tools you rely on during investigations?

Henri: Maltego, of course, and I’m not saying that because this is the Maltego podcast. I’ve really been a Maltego user for a very long time in my career, even back in the days when it wasn’t that good yet. For websites, I use host.io, Censys, Shodan, and some commonly used search engines. As for commercial tools or software, I tend to stay away from them a bit, same with extensions.

I try to teach my students more about extensions. You need to know who it’s from and understand third-party risk. With every extension you install in your browser, you’re exposing your searches and making yourself stand out from the basic users.

With all the accounts I have, it’s not feasible to remember all the alias passwords. Therefore, the password manager is the extension I use the most now, along with the user agent switcher and maybe an instant data scraper.

What do we do now when something’s behind Cloudflare?

Henri: There are some points you can look at with Cloudflare. For instance, what I usually try to do is look at other domains owning or sharing the same name as the domain I’m looking into and see if some of the information is still out there.

Or use tools like Whoxy.com, one of the whois tools giving you some free whois history information. Sometimes people don’t use Cloudflare at the beginning. However, they start using it a couple of months later when they register the domain. You have the option to see who was the register before Cloudflare stepped into the whois records, and that gives you a slight advantage.

The other way is looking into the source codes, that is, the analytics codes. If it’s shared across websites, you can use it, and it also applies to certificates shared by websites. People tend to be lazy and use the same stuff everywhere, and I’m no exception.

Was there a hallmark investigation that made you think that was something we are doing now? How did that happen?

Henri: It was during my time in fraud investigations, which really highlighted the technical part of OSINT for me. There was this person with his one-man construction company offering renovations to cottages, and he messed up a project due to the use of the wrong materials, which resulted in damage that was worth thousands of euros. Consequently, the client wanted to sue him, but he was like, “I’m a one-man company. Business has been bad lately, so I have no money. You can sue me. It’s just nothing here.” We had some intel that he was actually working for a very large construction company which, of course, had a deep pocket and could afford the damage. Nonetheless, the Chamber of Commerce turned up nothing.

He had a website consisting of an HTML page with scrolling text and an awful blue background with yellow font on it. All of a sudden, I had an idea to look in the DNS records. In the DNS records, a mail server was mentioned that if I emailed this guy, it would not go to his Outlook or Gmail, instead, it would go to mail.large.company.com. I thought to myself, “If I send my email, I do not send it to a random mailbox, I will always send it to an email that I have control over.”

That was the smoking gun and the evidence we needed to prove that there was a link between the large company and his company. He had a mailbox on the mail server of that larger company. People often talk about social media and stuff like Telegram, still, there’s a lot of information in DNS records and other things that’s open for you to find. The DNS record is a nice point in this investigation, and because of that, every time I conduct a company investigation, I always look into the DNS records and see what’s there.

The book Red Teaming says that some people view red teaming as playing devil’s advocate. Is this the same with red exercises?

Henri: It’s basically the same as with OSINT. I think there’s still no clear definition of OSINT. If you ask someone from the US Defense Department, he or she will give you a different definition on OSINT than if I ask someone from the Dutch law enforcement, for example.

Red teaming is similar in that sense. It depends on your aim. The way we used it was to see if we, in the role of an adversary, could get into the network of a company and do all kinds of shenanigans to get the company’s data, exfiltrate data, or even combine them with a physical entry, dropping some rubber duckies or something like that. Also, we could examine if someone would put it in a computer and get access through the network in that way.

Technology changes fast nowadays, what’s your advice for people new to OSINT?

Henri: If you are new to OSINT, I think what’s really important is to pick a specialization. You can go into search engines and pulling operators, which is where everybody starts with the file types and the sites. If you wanted to commit to social media investigations, there are many platforms out there already, with more to come and go every week or month. That being said, if you want to stare into social media, you do not have time for geolocation or technical OSINT.

You can’t be a specialist in all of them, otherwise, you become a jack-of-all-trades. He’s a master of none. To be good in OSINT, pick a few things you are interested in, go for those specializations, and team up with other people that are good in different kinds of topics within OSINT.

OSINT is a team sport. The most fun investigations I’ve had are with colleagues and friends to capture the flags. When you do investigations with different kinds of people, you get different point of views and exchange knowledge. That’s the most exciting part for me.

How does one start off in one of the branches of OSINT investigations?

Henri: It starts with being curious. If you want to start in a branch of OSINT, you need to learn more about the branch. The only way to learn about the branch is reading, but also talking to people and going to events. You could start even a bit further down the road, like attending an IT conference or an IT security conference. If you talk about cyber threat intelligence, see what companies are out there in the industry, what kind of stuff they do, and what they find interesting, then go from there.

Nevertheless, what I see in a lot of young people or students now is, “Yeah, we’ll just read it on Twitter.” or “Yeah, we’ll just send an email instead of approaching people, picking up the phone, interviewing people and getting out there.” Getting to know each other, helping each other out, and learning by doing, I think are the better ways to reach out to people and get more people into OSINT.

There’s More! Listen to Our Full Interview with Henri!

If you have found those interview snippets interesting, don’t miss out on the complete version!

Listen to our full interview with Henri to learn more about:

Henri’s collaboration with our previous guest Micah Hoffman on Google Analytics
Why Henri thinks certain techniques should only be known to law enforcement to avoid any misuse
How Henri’s curiosity led him into programming and building his first HTML website

And much more!

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, and the Maltego YouTube channel and follow us for future episodes!

Check out Henri’s work on Twitter!

Don’t forget to follow us on Twitter, LinkedIn, and YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.

Happy investigating!

Automating Attack Surface Assessments with Maltego: A Practical Guide to Custom Machines

Tue, 13 Jun 2023 08:06:22 +0000

Our previous article in this series explored the process of using Maltego to perform attack surface assessments while using only free sources. In this one, we will look at technical reconnaissance to identify security risks associated with vulnerabilities, insecure open ports, outdated software, juicy instances, and more.

This edition will turn our focus into supercharging these assessments by automating our workflows using Maltego Machines.

Maltego for Attack Surface Assessments: A Blog Series

Exploring Your Attack Surface with Maltego
- What is an Attack Surface Assessment?
- Using Maltego for Attack Surface Assessments
How to Automate Your Attack Surface Assessment with Maltego (Reading Now)

The Starting Point: Footprint L1 Machine

You may remember that last time we started our assessment by running the Footprint L1 (FP-L1, for short) Machine. Then we used different Transforms to search for additional information that could lead us to find security risks like the ones we just discussed. So we should use the Footprint L1 Machine as a template and add those additional Transforms and checks into the workflow.

Before we dive into that, let’s first review the different phases or stages of the Footprint L1 Machine.

Now that we have a clear idea of how it works, we can draw up the blueprint for building our Custom Machine.

Creating the Blueprint for a Custom Machine

Let’s make a list of the additional steps we took after running the FP-L1 Machine.

What we did was:

Identify the Entities in scope for the assessment — in our case, it was a company Entity named after our target, whose associated infrastructure we moved to a new Graph.
Search for Juicy Instances with the To DNS Name (interesting) [SecurityTrails] Transform.
Confirm Live Instances by running the To IP Address [DNS] Transform.
Use Shodan to identify vulnerabilities in IP Addresses and Netblocks with the To Vulnerable IP Addresses [Shodan] and To Vulnerabilities [Shodan] Transforms.
Find open ports by running the To Ports [Shodan Internet DB] and To Ports [OTX] Transforms.
Use IP Addresses to search for running services with the help of the To Services [Censys] and To Services [Shodan] Transforms.

Having the blueprint in place, let’s now jump into Maltego to start building our Machine.

Creating our Machine in Maltego

The best way to get started is by cloning the Footprint L1 Machine and adding additional steps to the workflow.

Before anything else, please make sure you have installed all the required data sources:

To clone the Machine, select “Manage Machines” under the Machines tab in Maltego. This will open the Machine Manager Window.

The list of Machines depends on which Hub items you have installed, so it might look slightly different on your side, but the Footprint L1 Machine is a standard one so you should have it as well.

Select the Machine and click “Clone Machine” (the second button from the left).

A new Machine will automatically be created below the original one. Select the newly created Machine and click on “Edit Machine” (third button from the left).

The Machine Editor should be open now. I know it may look complicated at first glance but there is no need to worry. We will guide you through the next steps.

Let’s break this window into two parts and look at the code first. I have identified the phases of the Footprint L1 Machine in case you are curious about the code.

Let’s start by updating the information at the top first, using the following examples as a guide.

displayName:“Attack Surface Assessment”,
author:“Add Your Name”,
description:“This performs a basic attack surface assessment.”

Once we are done, we can add the additional steps to the code. Let’s follow the blueprint we created a few moments ago.

Identify Entities in Scope and Delete the Rest

As mentioned earlier, last time, we started our exploration by running the Footprint L1 Machine. After the Machine had run, we narrowed down the scope for our assessment using the Company Entities, and then we moved all the relevant Entities into a new graph. That’s something we cannot do with a Machine at the moment, since Maltego doesn’t have that feature yet. However, we can pull off some tricks to achieve a similar result. Here’s what you need to do now:

Place your cursor next to the run(“paterva.v2.ASNumberToCompany”) line towards the end of the code and hit Enter a couple of times.
Copy and paste the following code snippet into the Machine Editor. We will explain what each line does in a minute.

//Select the Entities in Scope and delete the rest
log("Defining Entities in Scope",showEntities:false)
status("Phase 5 - Defining the Scope")
type("maltego.Company", scope:"global")
userFilter(title:"Companies Outside the Scope",
        heading:"Company",
        scope:"global",
        description:"Companies to be Removed",
        proceedButtonText:"Next>",
        removePromptText:"remove selected entities")
        
//Delete Entities outside the scope
delete(parents:4)
degree(lessThan:1, scope:"global")
delete()
        
//Recreate missing Company
type("maltego.AS", scope:"global")
run("paterva.v2.ASNumberToCompany")

degree(equalTo:0, scope:"global")
delete()

Select the code snippet in the Machine Editor window and click the “Format” button (upper left corner). That should automatically rearrange the code in the correct format.

That was easy, right? Now, let’s take a moment to review the code we just added. Note that it is written using the Maltego Scripting Language (MSL).

We will use some of those filters, options, and functions throughout the rest of the Machine. If you need a quick refresher on what each of these is used for, you can refer back to the image above.

Search for Juicy Instances

The next step in our workflow is searching for additional “Juicy Instances” and then confirming the live ones by resolving their IP addresses. We need to add the To DNS Name (interesting) [SecurityTrails] Transform and then the To IP Address [DNS] Transform to confirm the new servers are live.

However, the To DNS Name (interesting) [SecurityTrails] Transform works only on Domain Entities, and the last output was a Company Entity. Fortunately, we just learned that we can use filters to select Entities anywhere on the graph, so let’s enter the following code after the snippet we added a few moments ago.

Here, we must use the other section of the Machine Editor to add new Transforms to our Machine. The easiest way to find the Transforms you seek is using the “Filter by input” menu.

Let’s search for Domain [maltego.Domain] and click on it. This will update the list of Transforms to show only those that accept a Domain Entity as the input.

Here, you need to click the plus sign associated with the data source containing your Transform and double-click the Transform you want to add to the Machine.

Let’s start with the To DNS Name (interesting) [SecurityTrails] Transform and then add the To IP Address [DNS] one.

You may have noticed that the Transform name looks different when added to the code. This is because the Machine requires the actual Transform Name, rather than the Interface Name displayed on the Menu. So, remember to use the “Format” button whenever your code looks out of place.

To be honest, I’m glad we don’t have to learn the actual names!

Ok, it’s time to learn about a different feature of the Machine Editor, the “Compile” button. This feature will test our code to ensure it works before we save the Machine, so you don’t have to save and run it each time you want to modify it. If everything goes right, you should receive a green “Success” note.

If something is wrong, Maltego will return an error with details to help you find the issue. The most common problems are associated with missing parenthesis, so keep an eye open for those!

Vulnerabilities, Services, and Open Ports

The last step required for the assessment is searching for vulnerabilities, services, and open ports. Since all the Transforms needed to fetch that information use the same type of input IP Address Entities, we can run the Transforms in parallel.

But what does that mean? Let’s take a step back to talk about how Maltego Machines decide the order in which Transforms run.

To find more information, read our Introduction to Machines.

Machines can run Transforms both in parallel and sequentially. Users can run multiple Transforms on the same data Entity, run a series of Transforms from one data output to another, or do both simultaneously.

So far, we have been adding Transforms in sequential order (one after another). To run Transforms in parallel, we need to use Paths in Maltego. In fact, we can already see an example of this at the beginning of our Machine.

As you may have already guessed, all we need to do to run Transforms in parallel is to place the Transforms inside a paths{ < Our Transforms > } function.

As before, we will begin by adding a couple of new lines, using comments, log, and status to document what the Machine is doing, and using the type filter to select all the IP addresses on our graph.

Below are the Transforms we will need to fetch the vulnerabilities, services, and open ports from the IP addresses (the italic string is the container’s name where you can find the Transform).

To Ports [OTX] (AlienVault OTX)
To Ports [Shodan Internet DB] (Shodan InternetDB Transforms)
To Services [Shodan] (Shodan)
To Services [Censys] (Censys)
To Vulnerabilities [Shodan] (Shodan)

Let’s Format, Compile, and then Save our Machine.

Wow, look at that! Our first custom Maltego Machine!

How about trying it out? To do that, open a new graph in Maltego, add a Domain Entity, and select our Machine from the Menu.

That’s it! Let’s pat ourselves on the back, shall we? We have successfully created and run our own attack surface assessments Machine.

To get even more interesting information, you can always tailor the Machine to your liking by adding additional Transforms. I’m sure you already know how to do this.

If you enjoyed this tutorial and would like to explore more helpful content, we invite you to stay up to date with our latest updates by following us on Twitter and LinkedIn, and subscribing to our newsletter.

Happy OSINTing!

About the Author

Mario Rojas

How The Maltego Academic and NGO Program Helped the OSINT Community in 2022

Wed, 07 Jun 2023 13:12:03 +0000

KEY POINTS

The Maltego Academic and NGO Program aims to provide organizations and individuals with technical and consultancy resources to enhance global investigations and foster innovation.
In 2022, the Program supported a wide range of projects, including anti-human trafficking, investigative journalism, disinformation analysis, and terrorism analysis, to name just a few.
Academic institutions and non-profit organizations can apply to the Program this year from June 1 to July 31, 2023.

Where Innovation and the OSINT Community Meet

In the ongoing fight against criminals, Open Source Intelligence (OSINT) emerges as a crucial ally. With its help, organizations and individual researchers can learn to navigate the complex digital landscape and launch global investigations, fostering a culture of constant technology innovation.

To popularize the modern investigative approach within the OSINT community, we at Maltego are excited to open another round of applications to the Academic and Non-Profit Research Program. With the Program, we strive to contribute to organizations and individuals who set out to make a change in the world through projects or research.

What You Need to Know About The Maltego Academic and NGO Program

The Maltego Academic and NGO Program is an annual program that offers technical and consultancy resources to selected participants for their academic and non-profit projects and research. Admissions to become our Program Partner open yearly. The Maltego team supports all Program Partners’ research projects and progress throughout the course of one year after admission.

To learn more about the Program and application requirements, please visit the Academic and NGO Program page.

We also feature some of our Program Partners’ work on our blog as well as in the 2021 Program highlight.

The Maltego Academic and NGO Program Spotlights 2022

In 2022, we supported 55 academic institutions and 20 non-profit organizations as well as independent researchers. Some of the initiatives included anti-human trafficking projects, investigative journalism, disinformation campaigns, and educational events.

We were especially honored to be involved in the following five projects:

Aida Kokanovic Dismantles a Human Trafficking Network

Determined to uncover the criminal masterminds behind a human trafficking movement in Europe, Aida Kokanovic used her journalistic expertise and support from Maltego to launch an investigation on a sex trafficking network.

By automating key investigative processes with relevant technology, she gained access to crucial information that was pivotal to her research.

She began by gathering OSINT information from sex recruiting ads and conducting a contact exploitation investigation to connect the dots. This involved performing link analysis, populating her Maltego graph with existing data connections to trace the origins of criminal networks.

For a complete workflow of her investigative techniques and to learn more about the instrumental role of Maltego in empowering her research, see the article here.

Brian Perlman Uses OSINT and GEOINT to Investigate Human Rights Violations

Brian Perlman, an open-source intelligence and geospatial intelligence analyst, relied heavily on technological innovation for his two investigations.

In the first one, he employed OSINT and GEOINT to assess damage in the Nagorno-Karabakh War of 2020. In the second case, his focus was on gathering evidence on the protest violence by Sudanese authorities in October 2021 and determining the location and course of events.

Given the financial constraints associated with utilizing advanced technology in investigations of similar magnitude, Brian partnered with Maltego to alleviate the burden and gain support to continue his research.

With Maltego at their disposal, his team could efficiently compare hundreds of social media images and imagery reports to pinpoint weapons and gather critical insights.

By leveraging various data sources within Maltego, he enhanced his investigative capabilities and progressed in his inquiries, which you can read more about here.

Kyrese Davis Explains What Terrorism Means in the Modern Age

As part of our Program, we also create new opportunities and offer technical support to early adopters of investigative tools, including university students.

One example is a group of students from the California University of Pennsylvania that utilized Maltego for an academic project. Their research focused on examining the roots of extremism and terrorism and exploring strategies to steer individuals away from these ideologies and pursue a better life.

Toward the end of our partnership, Kyrese Davis, a recent graduate and Maltego Program Partner, published an essay that sheds light on the reasons behind terrorism. It focuses on acts at international and domestic levels and discusses the counter-terrorism measures in place.

For deeper insights into this critical subject matter, we invite you to read the essay here.

Gisela Pérez de Acha and Stephanie Croft Uncover Actors Behind a US Disinformation Campaign

Researchers Gisela Pérez de Acha and Stephanie Croft from UC Berkeley Human Rights Center participated in the Academic Program with a group of university students. They wanted to undertake a study to unveil the individuals and organizations responsible for running disinformation campaigns in the US regarding hormonal birth control.

Their investigation began with collecting a series of TikTok videos used in the disinformation campaigns. Using Maltego and data integrations such as OpenCorporates and Orbis, they traced the roots of the campaigns back to the individuals and organizations tied to anti-abortion movements and, eventually, discovered how they were funded.

You can learn more about discovering the main players behind this network by watching the webinar or reading the article.

Lighthouse Reports Runs an Investigation into Europe’s Shadow Armies

Another Partner we supported was Lighthouse Reports, a Dutch non-profit organization. Maltego offered them technical resources to complete three OSINT investigations into the so-called Europe’s Shadow Armies: A group of masked men who allegedly carried out illicit, organized violence against refugees on land and at sea.

Through gathering witness testimonies and utilizing relevant tools, Lighthouse Reports achieved significant breakthroughs. They connected a group of masked men’s uniforms to the Croatian Intervention Police, identified perpetrators on ships from video evidence at Greek sea borders, and exposed the recruitment of migrants for illegal asylum-seeking interventions.

Their findings garnered attention from the general public, including European Parliament politicians. These initial steps have laid the foundation for future investigations into human rights violations, empowering the organization to continue its work.

For a detailed walk-through of the process and how Lighthouse Reports utilized Maltego’s resources, see the case study.

How to Join the Maltego Academic and NGO Program

The Maltego Academic & NGO Program seeks to make Maltego accessible to both experienced and aspiring investigators and help advance their research to the next level.

We invite you to submit an application for the 2023 admission from June 1 to July 31 via the application form here. The program is designed for academic institutions, public, private, and non-profit organizations, and individuals.

Every investigative journalist student should learn how to harness a tool like Maltego for powerful and innovative storytelling.

Gisela Perez de Acha. Professor, UC Berkeley.

By incorporating it into your university curricula or organization research, you will have a chance to establish a strong foundation for future investigations backed by advanced OSINT technologies.

Apply for the Maltego Academic & NGO Program now.

Stay informed about our latest updates by following us on Twitter and LinkedIn and signing up for our email newsletter.

Happy investigating!

Investigator Toolkit May 2023: Cheat Sheets for Faster and Spot-on Workflows

Thu, 25 May 2023 12:39:31 +0000

Investigator Toolkit: Quick Starts to Using Maltego Hub Items in Real-life Investigations

Where to Find the Investigator Toolkit?

All Previous Investigator Toolkit Roundups

Investigator Toolkit May Roundup

In May, we featured the following four Hub items and their use cases in the Investigator Toolkit series:

Let’s dive straight into how to use these Hub items for brand protection, URL scanning, image analysis, and threat intelligence!

OpenPhish: Brand Protection

To protect your organization from phishing attacks and brand impersonations, simply tap into OpenPhish to identify suspicious URLs or IP addresses for further investigation!

urlscan.io: URL Scanning

Through running the urlscan.io Transforms in Maltego, investigators can query information about a URL, such as site content, relationships with other sites, etc., without loading data on their local devices.

Image Analyzer: Image Analysis

The Image Analyzer Transforms derived from Google Vision API allow investigators to extract text, detect faces and sensitive content, and identify objects and landmarks from images.

alphaMounain: Threat Intelligence

Look into unknown domains, DNS names, or URLs and identify potential risks by querying alphaMountain for reputation scores and relevant content categories.

Check out the Investigator Toolkit series now!

In the following months, we will continue digging into different Hub items available in Maltego and providing best practice tips for investigators.

Happy Investigating!

The Pivot Podcast: Make the World a Safer Place With OSINT with Nico Dekens

Mon, 15 May 2023 12:11:15 +0000

In this episode for The Pivot podcast, we welcome Nico Dekens!

Nico Dekens, known as the Dutch_OsintGuy online, is an All Source Analyst specializing in open source intelligence (OSINT), online human intelligence (HUMINT), and online investigations. He has over 20 years of experience as an All Source Intelligence Analyst at Dutch Law Enforcement.

Nico eats, sleeps, and lives everything related to OSINT, online investigations, intelligence gathering, and analysis. As the co-founder of the OSINTCurio.us project and a SANS Institute instructor, he is very active within the OSINT community.

In this episode, Nico provides valuable insights into his investigations on the decentralized web, experiences of saving people from the ongoing war in Ukraine, as well as concerns for the polarized-bound world. He also touches a bit on Vicarious Trauma, taking himself as an example, and offers a few prevention tips in the end.

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

The Pivot: Your New OSINT and Infosec Podcast

Each episode features one or two of Maltego’s own Subject Matter Experts as the host and an external expert, researcher, or industry leader invited to share their projects, stories, experiences, and advice. 

Where to Listen to The Pivot?  

Tell us what you have been up to!

Nico: Currently, most of my time goes into refining the courses that I’ve written for SANS. I’m also doing a lot of investigations regarding Ukraine, but the majority of them are conducted privately. When I do investigations, I will never make them public, which is my golden rule. It might have something to do with my background in the Dutch government. Even though things are open source intelligence, they should not always be exposed to the app or the public.

Other than that, saving time is my biggest priority nowadays because I’ve got so much to do, and I’m always looking for new ways to perform open source intelligence more efficiently. For example, it could be building my own little Python script, looking at someone else’s script to see if I can grab pieces from it and work with it, or playing around with Maltego to see if I can build a Transform or automate the process.

What are some of the tools you used? Niche tools are also welcome if you can talk about it.

Nico: The biggest tool I use is my brain. Simply put: Critical thinking, doubting everything, assuming nothing, and checking everything. That’s my standard operating procedure and something I always preach. For me, the most important part is that I know what tools to use for certain tasks, and that I have a digital toolbox filled with tools, scripts, methodologies, and techniques based upon my case.

Besides my brain, my number one tool is Maltego. I run a Transform in Maltego, and it gives me simply more time to do the proper analysis. I’m the hoarder of all data and have my own database with breaches. Along with some friends, we collect all kinds of breaches. I run my own monitoring based upon RSS Hub, which is basically an open source GitHub project that allows you to monitor feeds from RSS, Facebook, and Twitter. I also use search or Searx to plug in my own data sources.

Sometimes these tools simply speed up my process. I recently had a case where there was a presumed school shooting, and someone asked me to investigate that. I could have done that manually, but it probably would have taken me at least five days to collect all the data and then another five days to sort through the data, giving it some meaning and finding answers. In this case, with a combination of Maltego and some manual searching, the investigation was done in two and a half hours, including a conclusion and a written report.

Have you seen people getting stuck using specific tools and thus held back by the hindrance of using those tools only?

Nico: In my opinion, it’s a good thing to have standard operating procedures and methodologies to do certain tasks that you have done previously. What I’ve seen investigators do is that they stare themselves blind on that one tool. However, every tool has limitations, and if you’re not capable of seeing those limitations and figuring out how to deal with them, your standard operating procedure is basically shutting down your own business or your own investigation. I hate to say that you are thinking out of the box, which is a popular term, but that’s something you should always be able to do within OSINT.

When I look at my background in the Dutch government, most governments would use flow charts, especially for the people who don’t do open source intelligence 24/7 and 365 days a year. They need to have manuals and playbooks, which are good for them as a starting point.

Nevertheless, don’t stare yourself blind on playbooks. If you only look at the playbook because that’s the only path you can take, you’re doing your investigation short. If you only stick to those rigid standards, such as flow charts or decision trees, you will overlook certain things. There’s never an option of “what if’ in decision trees, and this is why I don’t like them.

There are places going through some drastic changes. In terms of what you do and how these changes affect your work, what are your biggest concerns as an investigator?

Nico: Looking back at the past three years and witnessing the outbreak of the pandemic and the war in Ukraine, I think my biggest concern is that the world is becoming polarized. People who used to be friends are now enemies. People who once trusted their governments now have strong doubts about their governments because of fake information or disinformation.

Social media, in general, could rather be renamed and revamped to asocial media because there’s nothing social about it anymore. Most of these platforms are more about people showing off how good they are, putting other people down, or becoming victim platforms. We’re not even talking about TikTok as a platform itself being used for spying by a nation-state mostly, which has been proven now by numerous academic researchers.

People think or thought that the world should have become a safer place or heaven as it’s becoming more interconnected with the internet. Nonetheless, things are going sideways. I noticed an incident recently on the news where two young women were being harassed by a very large group of young guys, and there were at least two times more people standing by. But no one did anything, except putting it on Snapchat or Tiktoking it. That has become my biggest worry that people are so passive, scared, or so numb that they only film but don’t act anymore.

Nico: The impact for the younger generation is that every step they take outside, they are anticipating to be exposed online, and these materials could stick with them for the rest of their life. As the younger generation grow, they will one day apply for a job, and their employers could easily look up their accounts on TikTok and watch videos of them doing some crazy stuff when they were kids.

These past two years, we have seen more demonstrations and rallies thanin the last two decades, and I assume most people remember rallies and demonstrations from the Cold War period. Nowadays, people just rally and demonstrate on social media because it’s so easy to sit behind a keyboard, saying whatever you want without thinking of the consequences. People can get really hurt by words, and people forget about that.

On your blog, you’ve touched on vicarious trauma. Could you explain more about this concept?

Nico: Vicarious trauma is basically trauma that you get from looking at, listening to, or watching horrific things. This content could stick to you and traumatize you, later evolving into vicarious trauma. It’s indirect trauma, so you’re not directly there witnessing the incident. Still, the impact of looking at the footage could take its toll on you.

When I was in law enforcement, I spent almost 10 years doing counterterrorism work during the high rise of the Islamic State. While others were eating their lunch, I was eating my lunch and watching footage of people being decapitated, murdered, or set on fire, and that’s abnormal. We had mental health check-ups every few months. Even though you say, “Hey, I’m perfectly fine.” They still say, “You need to go and talk to the psychologist just to make sure.”

That’s something I would like to encourage people who are doing investigations to do, especially in the fields of war, riots, child abuse, or subject matters where you see horrific content. Make sure you check your mental health regularly or read about vicarious trauma on my blog or from other parties writing about it. Getting traumatized by doing online investigations is real, and you could burn out on that or even go as far as never being able to work again.

Therefore, I wrote about vicarious trauma on my blog to give out some tips on how to avoid getting the trauma. For instance, if you’re watching a footage, you can turn off the audio, which will help reduce the impact. As we all know, if you watch a horror movie without the audio, it’s actually quite funny.

Do symptoms of vicarious trauma also include being desensitized in front of horrific materials?

Nico: Absolutely. I had former colleagues point out to me saying, “Nico, hey, I’m walking behind your office, and you’re eating your lunch while watching these things. That’s not okay. That’s not normal human behavior.” Or, I got so paranoid that I was out with my family in Amsterdam, and an advertisement screen fell over, making a loud bang. I was like, “Okay, now it’s going down. Now there’s a terrorist attack.” I started to become a bit edgy or too paranoid owing to work, and for me, that was literally the sign to take a step away and ask my leadership, “Hey, I need some time to unwind.”

It’s hard to do it now as I’m a one-man show. Nevertheless, when I was in law enforcement, I had the luck to talk with other people and take care of each other. I would like to encourage people working in a team to keep talking to each other every now and then, grab a cup of coffee or tea, and ask, “Hey, how are you doing? Did you have any fun things in life?”

We all have biases and fallacies that we fall for. If we combine that with being traumatized, for example, looking into the entire anti-vaccine world, you could also be sucked in and become detached from reality. It could be part of the mental health issue you’re running into, and you’re probably not even aware of it yourself because no one tells you. This is why you should always keep talking.

There’s More! Listen to Our Full Interview with Nico!

If you have found those interview snippets interesting, don’t miss out on the complete version!  

Listen to our full interview with Nico to learn more about:  

Why Nico thinks investigators should do more of thorough and proper analysis breakdown
His reason for becoming an investigator
His contribution to saving lives and keeping people safe from the war in Ukraine
What Nico considers to be the most important principles for OSINT beginners

And much more!

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

Check out Nico’s work on Twitter!

Don’t forget to follow us on Twitter, LinkedIn, and YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.  

Happy investigating!

Exploring Your Attack Surface with Maltego: A Practical Guide

Tue, 02 May 2023 08:28:55 +0000

In today’s rapidly evolving threat landscape, it is essential for organizations to regularly assess their attack surface to identify potential vulnerabilities and weaknesses. This can help you better understand your organization’s security posture and take proactive measures to protect its critical assets.

In this article, we will explore how to use Maltego for attack surface assessments while relying solely on free data sources and provide a practical guide to help you get started.

Maltego for Attack Surface Assessments: A Blog Series

Exploring Your Attack Surface with Maltego (Reading Now)
Automating Your Attack Surface Assessment with Maltego

What is an Attack Surface Assessment?

An attack surface assessment involves identifying the various entry points an attacker could use to gain unauthorized access to an organization’s network or systems. These entry points can include everything from publicly available websites and social media profiles to network devices and cloud-based services.

An organization can proactively mitigate any vulnerabilities and prevent unauthorized access by identifying all potential entry points with the proper measures in place and an adequate tool stack.

Using Maltego for Attack Surface Assessments

Maltego is used extensively by security and threat intelligence teams worldwide for a wide range of cybersecurity tasks, including conducting attack surface assessments.

In this guide, we will demonstrate how to do that by using Maltego and following the steps below:

Let us delve into each of them.

Step 1: Define the Scope of the Assessment

The first step in any attack surface assessment is to define its scope. This includes identifying the target systems or network and determining the objectives. For example, our aim might be to identify all publicly accessible domains and IP addresses associated with your organization.

In this demo, we’ll explore the on-premises infrastructure of a large international organization. We will look to identify any potential security vulnerabilities, including insecure open ports, legacy systems, exposed security solutions, and critical vulnerabilities such as unpatched software.

DISCLAIMER: Please note that the information and techniques contained in this article are for educational purposes only and are intended to provide insights into the attack surface assessment process. Therefore, we will blur any identifying Entities to protect the target organization’s security.

Step 2: Identify Potential Data Sources

Once you have defined the scope of the assessment, the next step is to identify potential data sources that can be used to gather information about the target.

To configure Maltego for attack surface assessments, we will need to select the appropriate, relevant data sources using the Filters available on the Start Page of your Maltego Client.

In our demo assessment, we will use free data sources only:

Step 3: Reconnaissance

Once you have installed all relevant Transforms, you can start gathering information about your target systems or network. This can include domain names associated with your organization, IP addresses in use, open ports, software versions, and any other publicly available data that may help to identify potential vulnerabilities.

To begin our demo, let’s first take a look at one of the coolest features in Maltego, called Maltego Machines. They function as a sort of automated playbook for different types of investigations. In our case, we will use one of the default Machines to get us started with our assessment.

What we need to do is:

Add a Domain Entity for our target organization on a new Graph
Right-click the Entity to get the Transforms menu
Go to the bottom to open the Machines submenu
Click the Network Footprint L1 Machine

In just under a minute, we retrieve a comprehensive picture of the assets and records associated with the target domain, over 750 Entities, ranging from Websites, DNS records, IP addresses, AS numbers, Email addresses, and more.

Given the ever-growing adoption of cloud services, we are not surprised that the organization’s digital perimeter extended well beyond its on-premises natural boundaries by multiple service providers, including Microsoft, Google, and Salesforce. Since our scope is for on-premises assets only, we need to identify those in our Graph.

In this case, there is a Company Entity with the target’s name.

Let’s move only the associated Entities to a new graph. To do that, we can select the Company Entity and click the Add Parents button until the selection includes our initial domain. We can right-click anywhere on the Graph and select the Copy To New Graph button in the bottom left corner.

Having done that, we will now focus on mapping the attack surface of the target without including the infrastructure owned by the vendors used by the organization.

In the above image, there are some interesting subdomain names used by the target, including development (dev) and pre-production (preprod) instances. We will refer to these as Juicy instances.

Let’s find some additional Juicy instances by running the To DNS Name (interesting) [SecurityTrails] Transform on our initial Domain Entity.

The list of results shows some additional test and mail-related instances. We can resolve the IP addresses associated with the new Entities to confirm whether these are live.

To do that, we will select the new Entities and run the To IP Address [DNS] Transform. Any instance that returns a corresponding IP address can be considered potentially live.

Since we are on IP addresses, it is possible to use Shodan to find vulnerabilities associated with online hosts. Let’s find some by selecting all the IP addresses and running the To Vulnerabilities [Shodan] Transform.

Not only have we identified a critical 6-year-old vulnerability but also a number of interesting subdomains, a production security instance, as well as a possible Mobile Device Management (MDM) test server. We will come back to these in the Analyze the Information section.

We can also use Netblocks to find vulnerable assets with the help of Shodan. Since we are confident that the current Netblock Entities belong to the organization, let’s run the To Vulnerable IP Addresses [Shodan] Transform on these and re-run the previous Transform to extract the associated common vulnerabilities and exposures.

This expands the list of vulnerabilities to 93, including at least 12 critical. In other words, threat actors could exploit 93 unique attack vectors to breach this organization’s network.

We are not entirely done with IP addresses yet, as we can also use these to identify insecure open ports and outdated software versions.

Let’s start by finding open ports with the To Ports [Shodan Internet DB] and To Ports [OTX] Transforms. Maltego returned 257 unique Port Entities.

To make it easier to read, we have identified and bookmarked a few ports considered insecure by default and which should not be exposed to the internet.

Next, we will retrieve the services associated with the IP addresses. The information in the Service Entities can help us find outdated software versions, which could, in turn, be vulnerable or beyond their support lifecycles. We will again select the IP address Entities and run the To Services [Censys] and To Services [Shodan] Transforms.

Once the Transforms have finished running, we can use the Find option to search for specific software versions.

Let’s say we want to check if any servers are running Apache 2.4, released over ten years ago.

Bingo! As we can see in the above image, the service Entity contains information about the software versions, associated common vulnerabilities and exposures, and they even include a timestamp for when this was last seen.

So far, we have found multiple Juicy instances, exposed security solutions, insecure open ports, 12 critical vulnerabilities, and outdated software versions running on live instances. It’s time to move on to the next stage in our assessment.

Step 4: Analyze the Information

After gathering information using Maltego, we will analyze the data and identify potential vulnerabilities or weaknesses.

Let’s go through some of the security issues identified during the previous stage and discuss why these are considered a risk to the organization they belong to.

Critical Vulnerabilities

They increase the likelihood of exploitation, affect operations, may lead to non-compliance, and damage public perception. Companies should prioritize identifying and addressing critical vulnerabilities to minimize these risks and maintain a secure and reliable digital environment.

Insecure Open Ports

During the reconnaissance step, we found and highlighted ports such as:

Port 143: This port is used for Internet Messaging Access Protocol (IMAP) traffic, which is used for email retrieval.
Port 445: This port is commonly used for SMB (Server Message Block) traffic, which is used for file sharing and printer sharing between computers.
Port 389: This port is used for LDAP (Lightweight Directory Access Protocol) traffic, which is used for authentication and directory services.
Port 139: This port is also used for SMB traffic but uses an older version of the protocol that is more vulnerable to attacks.
Port 21: This port is used for FTP (File Transfer Protocol) unencrypted traffic, which is used for transferring files between computers.

Exposing these ports to the internet can allow attackers to access and compromise sensitive information or execute remote code on a system. Limiting external exposure to these ports is generally recommended to prevent security risks.

Outdated Software

It may contain known security vulnerabilities that attackers can exploit to gain unauthorized access, steal data, or cause other damage. Also, the vendor may no longer support the software, meaning no new security patches or bug fixes will be released to address current or future vulnerabilities.

Juicy Instances

These types of instances, which include testing (Test) and staging as well as the previously mentioned development (dev) and Pre-Production (pre-prod) servers, are usually short-lived instances created for testing security patches, software upgrades, or new versions of in-house applications before moving them into Production. These servers typically get a lower level of security than production ones, making them a juicier target for hackers.

Exposed Security Solutions

During our assessment, we also found exposed security solutions such as ArcSight and a Mobile Device Management test server. These types of systems usually contain sensitive security data about the organization they belong to and may be targeted by attackers seeking to exploit vulnerabilities in the system or steal data.

Step 5: Develop a Remediation Plan

Finally, the attack surface assessment results can be used to develop a remediation plan. This can include implementing security patches, closing unsecured ports, establishing a Request for Change (RFC) that defines how to decommission Test instances, and other measures to help you reduce the organization’s attack surface.

Accelerating Your Attack Surface Assessment

Maltego can help security teams identify potential vulnerabilities and weaknesses in an organization’s network and assets. Following the steps in this article, you can effectively leverage Maltego’s features and conduct comprehensive attack surface assessments in minutes while using only free data resources.

If you want to learn more about vulnerability and attack surface assessment, take a look at our detailed Cyber Threat Intelligence handbook, which also covers four other typical CTI investigations.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

This was part 1 of a 2-part series on how to use Maltego for Attack Surface Assessments. In the next release, we will learn how to automate most of the techniques detailed in this article by creating our own custom Machine.

In the meantime, follow us on Twitter and LinkedIn, and subscribe to our newsletter to stay up to date on new tutorials and guides and to make sure you don’t miss the next part of the series.

Happy OSINTing!

About the Author

Mario Rojas

Letter from Maltego's CEO

Tue, 18 Apr 2023 08:01:00 +0000

Dear Maltego community,

as professionals, we are acutely aware of the damage, costs, and pains that criminal and nation-state cyber-attacks, horrific acts and trade around drugs and child exploitation as well as incendiary and anti-democratic misinformation campaigns invoke. As parents and citizens, we feel directly affected.

At the core of protecting our societies and families are human investigators who dedicate their experience and passion to solving many of these existential cases. And for more than 15 years, Maltego has been their choice of analysis tool and data integration platform to mine, merge and map the oftentimes diverse and distributed data sources needed to connect the dots and find the truth. Empowering these heroes is at the center of everything we do at Maltego.

Today, I am delighted to announce that we are taking an important step towards scaling and expanding our efforts. Charlesbank Technology Opportunities, a Boston-based fund, has acquired Maltego from its previous owners and invests more than 100m USD in our development and growth. It is a strong vote of confidence and a sign of trust in the role that Maltego will play in the growing cyber security and data analytics industry.

The enthusiasm of the Charlesbank team about our plans for Maltego has struck me from our first conversation. Our leadership team is thrilled to work with Darren, Dhruva and Caleb towards our shared vision for Maltego, to build the ecosystem of tools, data and people to empower every investigator to discover the truth.

The investment enables us to accelerate our plans in product and platform development. In the upcoming months, we make complex data analysis attainable for even more investigators, significantly lowering the barriers of data access and adding new interfaces and collaboration features. We strive to empower investigators with the most effective means to make sense of complex data, be it with graphs, searches, or prompts. The deep satisfaction of having discovered previously hidden connections, having found the needle in the haystack, is the feeling that created Maltego’s incredible following which has always been the driving force of our growth.

With recent initiatives like the ISO 27001 certification, as well as growing our presence in the USA, we are focusing heavily on becoming and remaining an even more reliable, trusted and reachable partner to our users and customers. Next, we focus on technology and programs that make contributing to the Maltego platform more frictionless for the many partners that are so important to provide the best solution. We are strongly committed to growing together with our data and service partners as well as the many experts and educators contributing their experience to the community every day.

We are incredibly excited about this work and the path ahead, but Maltego would not be here without the vision and ingenuity of Maltego’s original inventors Chris, Sonja and Roelof. The trustful and entrepreneurial partnership with Moritz and Georg from our former owner Maxburg Capital Partners has been decisive in establishing us in Munich, Germany. Over the last five years, Maltego has become a fast and sustainably growing business and an organization of now more than 100 people.

The Maltego Team and its achievements, I am most proud of. In a time of rapid organizational growth, we have remained humble and focused on what matters most. We built a culture of putting the investigator first, caring passionately about their success - as well as for each other. You, this incredible group of talented people from more than 30 nationalities are the foundation of this milestone and the reason I have no doubts that we will achieve our ambitions and fulfill our responsibility of contributing to a safer world for all of us.

Philip Mayrhofer, CEO

We are heavily investing in growing Maltego to the next level, and this is where I would want to invite you to join us in this growth.

Here are some of the ways to do so:

Join Maltego: We are looking to add more than 50 people in the next 12 months. While we have many open positions, we will continue to hire “people first”. So please have a look at our open positions here or reach out to us directly. We have an incredible team, mainly based in and around Munich, Germany, but with valuable contributors all over Europe and the world.
Learn Maltego: Special offer - for the next 30 days, we offer free access to our on-demand training. Please fill in the form here, and add the text “LEARN-WITH-MALTEGO” in the message field.
Come and meet us at events around the world or stop by at any of our in-office events in Munich.
Become a partner: We are always open to discuss partnership with data, reseller, or service providers.
We want to continue our support for impactful investigations, so consider joining our Academic and Non-Profit Program.

Maltego Secures $100M to Accelerate Growth of its Intelligence Platform to Combat Cybercrime and Misinformation

Tue, 18 Apr 2023 08:00:00 +0000

Boston-based Charlesbank Plans to Boost Product Development and Global Expansion for Munich-based Intelligence Platform

Munich, Boston – April 18, 2023

Maltego is a leading intelligence platform, used by institutions such as the FBI and INTERPOL, financial organizations and half of the DOW 30, for data integration and graphical link analysis of complex investigations. Today, the Company announced its acquisition by Charlesbank Technology Opportunities Funds, which are managed by Charlesbank Capital Partners, at an undisclosed price. The new Boston-based owner is investing over $100 million USD in the Company to further accelerate the growth and development of Maltego.

Maltego is relied upon by security experts, journalists, and researchers to mine, merge, and map investigative data. It has become a go-to platform for making sense of massive data sets while investigating a wide variety of complex cases including cybersecurity threat intelligence, law enforcement, national security, and trust & safety. Notably, the Company released publicly available resources to empower investigators to uncover the spread of misinformation against NATO, and has also aided investigative journalism efforts to combat human trafficking. Users value the ease of use and capabilities to access and generate meaningful merges from diverse and disparate data sources like Open-Source Intelligence (OSINT), third-party commercial APIs, and internal data.

“The Maltego platform is all about empowering investigators. Charlesbank shares our vision. They have made a significant investment in the company to accelerate product development and sales internationalization. This enables us to add more features and data sources and to improve usability for even more investigators,” says Philip Mayrhofer, CEO of Maltego, who, together with the team, will remain at the Company. “We are happy to report that we have just received the international standard for information security, the ISO 27001 Certification, and we have already begun building a presence in North America. We look forward to our future with Charlesbank and thank Maxburg for five years of partnership during which Maltego built an organization of over 100 employees and realized more than 4x profitable ARR growth.”

“The Maltego platform provides incredible value to investigators in helping them make sense of a large volume of different data sets to complete their investigations and identify threats,” said Darren Battistoni, Managing Director at Charlesbank. “We are excited to partner with the Maltego executive team and have reserved significant additional capital to pursue followon acquisitions across the fragmented landscape. We expect strong market growth in the cyber security sector especially, and believe we have all the ingredients to develop a marketleading platform for investigators globally.”

“I have known Maltego for over a decade and it has been a staple in every cyber operator’s toolbox,” said Caleb Barlow, who advised Charlesbank on the acquisition and will join the Maltego board as an industry expert. “In my time at IBM X-Force, we were able to accomplish some of the most impressive and meaningful research and investigations by leveraging the powerful data integration and visualization capabilities of Maltego.”

The investment was supported by Robert W. Baird, who served as exclusive M&A adviser to Maltego and its selling shareholders.

About Maltego

Maltego empowers investigators to speed up and increase the precision of their investigations through easy data integration in a single interface, aided by powerful visualization and collaborative capabilities to quickly zero in on relevant information. Since its development in 2008 Maltego has empowered millions of investigations worldwide. Maltego is used by a broad audience, from security professionals and pen testers to forensic investigators, investigative journalists, and market researchers. Headquartered in Munich, Maltego has grown to over 100 employees in Germany and works with customers including the including the Federal Bureau of Investigations, INTERPOL, and major tech and service companies including half of the DOW 30.

About Charlesbank

Based in Boston and New York, Charlesbank Capital Partners is a middle-market private investment firm with more than $15 billion of capital raised since inception. Charlesbank focuses on management-led buyouts and growth capital financings and also engages in opportunistic credit and technology investments. The firm seeks to build companies with sustainable competitive advantage and excellent prospects for growth.

About Maxburg Capital Partners

Maxburg Capital Partners is an investment management company focusing on Germany and the German-speaking markets advising multiple funds. The firm is actively seeking out long-term investments in stable and profitable small and medium-sized companies with a view towards lasting and sustainable value creation. Maxburg Capital Partners currently advises funds with c.€1b assets under management and supports companies with minority as well as majority positions with equity investments ranging from €10m to €100m.

For additional information, please contact: Martijn Burgman (press@maltego.com) or Maura Turner (mturner@charlesbank.com).

Additional Resources

The Pivot Podcast: Cybersecurity & Ethical Hacking Journalist with Hakan Tanriverdi from Bayerischer Rundfunk

Mon, 17 Apr 2023 10:08:05 +0000

In this episode for The Pivot podcast, we welcome Hakan Tanriverdi!

Hakan Tanriverdi is a reporter at the German public broadcaster, Bayerischer Rundfunk. He covers information and cybersecurity, mainly focusing on hacking groups and who they’re working for. The investigations tend to be more on the technical side and are assisted by scripts, scrapers, and databases. He is also the producer of the podcast series, Der Mann in Merkels Rechner - Jagd auf Putins Hacker (The Man In Merkel’s Computer – Hunting Down Putin’s Hackers), uncovering the German parliament hack, which went viral later.

In this episode, Hakan elaborates on how he unfolds the world of OSINT and hacking and his thoughts on how Snowden leaks and Panama Papers changed the way reporters investigate. He also touches on the production of Der Mann in Merkels Rechner – Jagd auf Putins Hacker podcast series, explaining how he came to record the podcast and the whole story of the hack.

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

The Pivot: Your New OSINT and Infosec Podcast

Where to Listen to The Pivot?  

Tell us a bit about yourself and what you do!

Hakan: I work at public broadcasting in Germany, similar to the BBC in the UK and the NPR in the US.

I write about cybersecurity and focus mainly on stories that, in my view, are not written about extensively. Our standard time for reporting a story is up along the lines from three to six months. In the timeframe, we try to find out as much information as we can and provide a complete picture, so that people consuming our investigation have a fairly good understanding of a specific hacker group or ransomware gang, such as how their work, how they operate, and how they talk to companies.

What got you into the world of cybersecurity?

Hakan: There are two phases. In the first phase, I went to journalism school in Munich. Afterward, I started working at a daily newspaper called Süddeutsche Zeitung, which later published the Panama Papers. I was always interested in how the digital economy works, so I started writing about platforms and later came to learn about hacking. The Snowden leaks happened two weeks after I joined Süddeutsche Zeitung, which showed me how intelligence agencies tried to work at the time.

From that point on, I tried to find out how to hack into a system and how hacking works. I have no background in Information Science or any relevant studies, but I attended a lot of conferences to speak and meet with hackers. Along the way, two things happened. First, the German parliament was hacked in 2015. Second, I quickly realized if I wanted to write about these stories, I at least needed to have a basic understanding of how hackers penetrate systems. I thought it would be also helpful for me to understand how to write scripts and programs by speaking to people doing incident response. I basically surrounded myself with code.

Then comes the second phase. You will always have questions when learning how to write code. If you have questions, you are going to look them up, find the answers on Stack Overflow, and then get into a mindset where you appreciate the people you’re interacting with because what they do in their jobs sometimes turns out to be the same problems you encounter.

When you go and ask questions, you will be able to ask better questions, so that the conversations get lengthier, a little bit more intense, and more into the weeds. That’s how I went from the desire to writing about digital platforms to writing about digital espionage.

What’s your take on the Snowden Leaks and Panama Papers?

Hakan: Let’s talk about it from my end as a journalist and the two things that both the Snowden Leaks and Panama Papers changed in journalism: The perception of how to reach your target audience and how they approach such stories.

Usually, a journalist would go speak with people, obtain information, and attribute the source to the people they contact. Sometimes, however, the people interviewed only allow journalists to use the information if they are not quoted. Therefore, journalists can’t always say, “Hey, this guy who works in German intelligence told me this sort of snooping is going on.”

However, ever since the Snowden leaks and Panama Papers happened, reporters have understood that it’s good for their stories to have some form of documentation. In my case, hypothetically speaking: If I am able to add a quote to prove that an APT group hacked the German federal foreign office, the story will always have a better standing because I am not dependent on external people as the main source.

I think that the Snowden leaks, the Panama Papers, and even further back the WikiLeaks established this form of reporting. A journalist always has to do the vetting.

You participated in the investigation of the German parliament hack, which went viral later. What was it like?

Hakan: In this case of the parliamentary hack, a colleague of mine, Florian Flade, published a story in May 2020, addressing the arrest warrant for Dmitriy Badin. Dmitriy Badin was alleged to be one of the hackers of the German parliament hack and was also accused of having been a Russian military intelligence officer by The Federal Bureau of Investigation. I added the crucial mistake Dmitriy Badin made to the report, so the story had a clear beginning and ending. I then suggested Florian that we should do a podcast about it. We weren’t sure about whether we would succeed. Still, we decided to give it a try.

Thinking that the story will one day be forgotten, we assumed it was easier for people to talk to us. Nonetheless, from the German side, at least from the government side, nobody was willing to speak into a microphone. Despite the hurdle, we were still able to tell a story about how hackers operate and how you can catch them. The podcast turned out to be really interesting to me and did become viral.

What inspires you to learn more and do more?

Hakan: I think learning how to write code was the biggest turning point for me. Now I’m not in a situation where I need somebody to handhold me. Instead, they could just describe a technique hackers use. Or I could read a report or an essay about a certain binary string. Then, I can go write a so-called Yara rule, which will search in a larger database whether a file containing that key was uploaded. If it was uploaded, I can have the binary and go look for the binary myself.

This is something that I couldn’t do years ago, and I now know how to write or read basic reports and look for information. If there’s a hash included, I will be able to get the malware. It used to be that VirusTotal tells me if there is a hash. There’s no way I could get my hands on that piece of data. Being able to code myself has had a significant impact on me, and that was the most important thing I felt has changed my reporting on certain topics.

What are the three pieces of advice you would give to anyone interested in getting into the field?

Hakan: I think the number one would definitely be reaching out to people. Try and ask them if they could describe how the hacker operates or tell you about something more in detail. Talk with the folks and reach out to them by email. Most of the time they are very nice and will reply. You can’t do it all by yourself anyways.

Secondly, for every question you have about programming, there’s already an answer on Stack Overflow. Go look for that answer. If you have coding problems, talk to people.

Also, reread reports. There are times when you read an interesting report but couldn’t make sense of it. As you do more reporting, you tend to understand some aspects better. It might take you a year or so, but then you can circle back to the report, reread it, and you will find out different things that will help you in your reporting. Try to find a critical piece of information in the reports you read.

There’s More! Listen to Our Full Interview with Hakan!

If you find the snippets of the interview interesting, don’t miss the full interview!  

Listen to our full interview with Hakan to learn more about:  

Hakan’s thoughts on the Snowden Leaks and his experience investigating it
What difficulties he encounters when gathering information
What changes the information security industry has made to shed more light on knowledge sharing

And much more!

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

Don’t forget to follow us on Twitter, LinkedIn, and YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.  

Happy investigating!

Effective Techniques for Intelligence Analysis

Mon, 20 Mar 2023 06:29:24 +0000

What is Intelligence? Intelligence can mean many different things depending on the context. If we perform a quick online search, the following definition will be one of the first results:

Let us focus on the second definition: “The collection of information of military or political value.” Many intelligence experts will agree that this statement is mistaken. Considering intelligence to be synonymous with information is a more common issue than one might imagine, and quite often, the error extends all the way back to intelligence collection. One can readily collect information; however, information can only be classified as intelligence after undergoing analysis.

There is consensus amongst Law Enforcement and Intelligence Agencies that intelligence is not what is collected, but rather the data that is produced after the collected information has been evaluated and analyzed: Information plus analysis equals intelligence.  It is utterly important to think of intelligence as a product—something that has been processed—rather than the raw material of information.

 A few years ago, I heard a catchphrase that has stayed with me and defines my understanding of what intelligence is. “Intelligence is information that has been raised to a high degree of certainty.” The discoveries we make serve as a basis for uncovering further information, which must then be shared since intelligence is only meaningful when communicated. However, it is essential for analysts to establish the validity of their findings in the eyes of the end-users and decision-makers. Building confidence in intelligence is a gradual process that requires time and effort.

By applying intelligence analysis techniques to the information you gather, you can increase the level of certainty in your predictions, turning them into actionable intelligence items. With that in mind, this piece will focus on sharing effective techniques for analyzing information and disseminating it in the most impactful way.

The Ultimate Purpose of Intelligence

Sir Francis Bacon’s quote “Knowledge is power” suggests that having knowledge empowers individuals to make informed decisions. In today’s fast-paced world, knowledge has become more critical than ever before. Whether it is in the field of technology, politics, or medicine, having knowledge can give an individual an advantage over others.

The ultimate purpose of intelligence is to provide relevant elements that allow an informed decision to be made. Two of the major objectives of intelligence are the imperative need to minimize the impact of surprise and reduce uncertainty in decision-making.

Analysis and decision-making share risks, but each also requires its own precautions. Take risk assessments for example. Risk assessments entail making decisions based on resources, and never losing sight of the fact that resources, in terms of security, are limited.

As mentioned earlier, intelligence is analyzed information. The intelligence we are generating builds upon strategic information from tactical-strategic knowledge gathered through:

Past lessons learned
Present for containment
Future anticipation

Three Types of Intelligence

Depending on its scope and intended use, intelligence can be divided into the following categories:

Strategic Intelligence

Helps to define objectives and establish general policies to achieve the goals set by the State (national objectives). Consolidates basic intelligence.

Tactical Intelligence

Assists in the planning and design of the necessary actions to achieve the objectives of an operation. Methodology of the search plan. 

Operational Intelligence

Assists in the execution of concrete actions to accomplish a mission. 

Producing and Presenting Intelligence

We now know what intelligence is and how we can categorize it according to its purpose. But how do we go about producing it, and in the best way possible?

Colin Powell had a rule for intelligence officers. As an intelligence officer, it is your responsibility to:

Say what you know (facts)
Say what you don’t know (information gaps)
And only then, you are allowed to say what you think (analysis)

These three so-called “steps” are a great guide on how we can organize and present an intelligence report or a situation briefing.

First, when we are structuring and analyzing the information we’ve collected, our first goal should be to develop a deep comprehension of the topic itself. When it comes to writing an intelligence report or brief, the title is a crucial element that can either attract or deter readers from reading the document. The title should be a concise and accurate reflection of the content of the document. However, coming up with the perfect title is not always an easy task, and it is something that is often worked out over time.

Next, if we go back to the Intelligence Cycle, these are the expected results from processing and analysis of the information we’ve gathered:

If we translate these goals into action verbs, we have a clearer picture of the path the intelligence analyst must follow to produce intelligence. Intelligence analysis is the process of collecting, evaluating, and interpreting information to create actionable intelligence. While it is a crucial component of national security and law enforcement, it can be a complex and challenging process. Some of the particular challenges of intelligence analysis include:

Lack of Data: Sometimes, there may not be enough data available to support an accurate analysis. This can be due to a lack of sources, unreliable sources, or limited access to sensitive information.
Complexity of Data: The data collected may be complex, technical, or difficult to understand. This can make it challenging to extract meaningful insights and create actionable intelligence.
Biases: Intelligence analysts may have biases based on their personal beliefs, experiences, or political affiliations. These biases can influence the interpretation of data and lead to flawed analysis.
Misinformation: The proliferation of false or misleading information can make it difficult to distinguish between accurate and inaccurate data. This can result in flawed analysis and poor decision-making.
Time Constraints: Intelligence analysis often operates under tight timelines, with a need to provide timely and accurate intelligence to decision-makers. This can lead to rushed analysis, incomplete data, and potential errors.
Security Concerns: Intelligence analysts often deal with sensitive or classified information, and the security concerns associated with handling this data can be challenging. This includes maintaining confidentiality, preventing leaks, and ensuring the security of data storage and transmission.

To minimize the loss of objectivity in our research and to facilitate working with our colleagues, we can use structured techniques for intelligence analysis.

Richards Heuer and Randolph Pherson are two leading scholars of structured analytic techniques. Both were strong advocates of group work, and the techniques they present move away from individual efforts and encourage teamwork.

Today, we will talk about two of these techniques and how their implementation can enhance our analysis. It is very likely that you already utilize them to some degree, however, it never hurts to review how we can structure and organize our thought process to develop an objective intelligence report, and one which reaches that level of certainty, which can fulfill the needs of the end user.

Structured Brainstorming

There’s nothing like a brainstorming session. Regardless of the structure of the organization, we can greatly improve these sessions by:

Avoiding higher hierarchy staff presence, so as to promote an open, judgement-free atmosphere and;
Inviting an external element that has little or no knowledge of the topic under discussion, to avoid groupthink and stimulate divergent thinking

However, brainstorming can get out of hand sometimes. It is advisable to appoint a moderator, and to define time limits for proposing ideas, discussion, and conclusions.

Multiple Hypothesis Generation

A hypothesis is a possible explanation that will be put to the test by gathering and examining the available data. It is a declarative argument that has not been shown to be true. Rather, it is an “informed guess” based on observations that can either be confirmed or disproved through further investigation or analysis.

According to Heuer, a good hypothesis should satisfy the following criteria represented by the mnemonic STOP:

Statement, not a question
Testable and falsifiable
Observation—and knowledge-based
Predicts anticipated results clearly

This technique helps the analysts and the investigators to think broadly and creatively. By developing a list of hypotheses that can be scrutinized and tested over time against existing information (what we already know to be true), we can avoid being surprised by our main assumption or conclusion that turns out to be wrong. It is especially useful when a high level of uncertainty exists around the outcome, or when there are many variables involved in the analysis.

The experts recommend brainstorming first, and then following the steps below:

Ask each group member to list up to three more explanations or theories on an index card.
Gather the cards, and then present the findings on a whiteboard. To avoid any duplicates, combine the list.
Use additional individual and group brainstorming strategies, such as cluster brainstorming, to uncover important forces and factors.
Categorize the hypotheses into clusters based on their similarities and assign a name to each group.
To generate new thoughts, rephrase the issue and consider a contrarian approach.
Update the list of alternative hypotheses. Try to maintain the concept of Mutual Exclusivity if these hypotheses will be used in Analysis of Competing Hypotheses (ACH), meaning that if one hypothesis is correct, all opposing hypotheses must be incorrect.
Ask the group to elaborate on each claim by posing the standard set of journalistic questions: Who, what, where, when, and how.
Select the most promising hypotheses to investigate further.

These are just two of the many techniques to improve our intelligence analysis and increase the degree of certainty of the hypothesis that we are going to present to the end user.

In the realm of intelligence, a single accurate judgment, prediction, or recommendation can potentially shape the course of history. However, the full impact of an intelligence report is often unknown, underscoring the critical importance of precision and reliability in the field. Sometimes it may affect only one department, sometimes a nation.

From Information to Actionable Intelligence

If you want to gain even more insight into how intelligence is created and discover how analysts utilize intelligence collection disciplines to ensure high-quality intelligence, we encourage you to watch our deep dive on breaking down intelligence. Simply fill out the form below to watch it now.

Download the resource

First Name*

Last Name*

Organization name*

Company Email*

Please keep me updated about Maltego product updates, news, events and offers.

If you found this article useful and would like to receive more updates on intelligence gathering or other related topics, you can follow us on Twitter, LinkedIn, and Mastodon, or sign up to our email newsletter,

Until the next one and happy investigating!

About the Author

Daphnée Aguilar

Maltego Views and How to Use Them: Part 3

Wed, 15 Mar 2023 11:22:11 +0000

Maltego graphs all start as a blank canvas. However, they often extend to include hundreds or even thousands of Entities. The larger the graph, the more challenging it is to analyze and understand its content. Of course, using Layouts or Search functions will allow you to grasp some information and better interpret your graph, but Views are the truly invaluable tool that will allow you to figure out what the data in your graph contains.

Layouts change how information is structured; Views change how Entities are displayed.

In Part 1 of this article series, we introduced what Maltego Views are and how to set up a basic View in Maltego.

In Part 2, we demonstrate how to use the advanced functions (such as Entity properties and links) to create Views that present data in a relevant way for you.

In this article, we will share some tips and tricks to help you level up your Bindings and Views even further.

Lets dive right in.

Maltego Views and How to Use Them

Part 1: Introduction to Views and the Basics of Setting Them Up
Part 2: Writing Bindings for Your Views
- Obtaining Entity Information for Bindings
- Writing Size Bindings
- Writing Color Bindings
- Testing Your Bindings
Part 3: Useful Tips for Leveling Up Your Bindings and Views
- Using a Catch-All Binding
- Dealing with Date Properties
- More Examples of Views

Using a Catch-All

Something that might have escaped the readers of this article is that it is possible to have more than one binding in your View. Maltego applies them in a descending order: The binding at the top of the list will be applied on every Entities in the graph, then the next binding of the same type (size or color) will be applied to the Entities that did not get a result from the first binding.

For example, let us consider this graph.

We have 8 Person Entities linked to IP addresses. We wish to check which persons are minors. We can do this with the following binding:

if (hasProperty('age')) {
    if (getPropertyValue('age')>=18) {
        "#FF0000"; // RED
    }
    else {
        "#0602f5"; // BLUE
    }
}

This will work, but the IP Entities will still draw some attention on our graph, as they will be unaffected by the View. This is not a big problem here, but on a graph with several thousand Entities, this can make our data difficult to analyze. This is why adding a second binding to act as a catch-all can be useful.

Here is the Binding Test window of the previous binding:

All of the Entities which result is null will be caught by the catch-all, as they do not have a value assigned yet. Here is what our catch-all look like:

"#808080"; // GREY

It is very important to make sure our second binding is below the first one, because bindings are executed in a descending order: The one on top of the pile is executed and the Entities to which it did not assign a value (size or color) are passed to the next binding for it to decide, and so on until there are no more Entities or bindings. This will reduce the visual impact of Entities that do not have an Age property by coloring them grey. To recapitulate, here are our two bindings, by order of execution:

if (hasProperty('age')) {
    if (getPropertyValue('age')>=18) {
        "#FF0000"; // RED
    }
    else {
        "#0602f5"; // BLUE
    }
}

"#808080"; // GREY

Since Views are about analyzing a graph at a glance, eliminating visual distractions is a must.

Dealing With Date Properties

One of the difficulties we run into when manipulating dates in Views is interpreting them as a date. Javascript Date objects allow for complex operations, including comparison. But by default, getPropertyValue() will load properties as a string of characters. Turning this value into a Date is up to you.

To do so, you first have to take into account that dates in Maltego can be stored in 3 different ways:

As a string following a specific date format, such as VirusTotal File Entities that have four properties following the format YYYY-MM-DDTHH:MM:SSZ (ex: 2021-07-30T13:08:48Z)
As a date property, which is the recommended property type to store dates, but not always used by Transform developers.
As a timestamp, a common way to represent time in computer. It is the number of seconds passed between Epoch time (00:00:00 UTC on 1 January 1970) and the date you want to represent. For example, a recent timestamp could be 1674645967.

Let us see how to turn each of these formats into a Date object in JavaScript. Then, we will see an example of a View using a Date object.

Date Property

This is the easiest of the three possibilities as getPropertyValue() will load it as a Date object directly! Here is an example with the default BTC transaction Entity.

// parsing is automatically done, it's already a date
date_trans = getPropertyValue('ciphertrace.datetime');

Timestamp

This becomes a bit more difficult as we might need to modify the timestamp before creating our date object: JavaScript expects a timestamp that is precise up to the millisecond, but most timestamps are only precise up to the second. If this is the case (you can usually recognize this by the fact that it has 10 digits), we need to multiply the timestamp by 1000. Here is an example that works for Echosec Post Entities:

var creation_date = new Date(getPropertyValue('timeCreated')*1000);

String

This is possibly the trickiest situation, depending on the format of the date. If the format used to represent the date is a the one expected by this function (ISO 8601: YYYY-MM-DDTHH:mm:ss.sssZ), you simply have to call the constructor for Date, like in this example focusing on a VirusTotal file Entity:

var submission_date = Date.parse(getPropertyValue("firstSubmissionDate"));

If the date format in the property does not follow this format, the results may be inexact. If this is the case, it will be up to you to parse the date yourself and call the Date construct with each argument isolated. You can refer to the Mozilla documentation for more information on the constructor.

Once we have these different types of properties properly coded as Date object, we can use them in our Views. Here is an example of a View isolating Echosec Post Entities based on creation dates during a specific span of time:

// Set a first day and a last day for the period we want to inspect
var date_inf = new Date("2022-01-01T00:00:00Z");
var date_sup = new Date("2022-03-31T00:00:00Z");


if (isType("echosec.EchosecSocialPost")) {
    // Create the Date object from a timestamp
    var creation_date = new Date(getPropertyValue('timeCreated')*1000);

    // If statement with 2 conditions: creation_date posterior to date_inf
    // and creation_date anterior to date_sup.
    if (date_inf <= creation_date && creation_date <= date_sup) {
        // If it is the case, we color the post in red
        "#FF0000";
    }
    else {
        // If it is not the case, we color it in blue
        "#0000FF";
    }
} else {
    // If the Entity is not an Echosec post, we color it in grey
    "#808080";
}

Example of Views

Using The Color Binding To Represent Entities Age

Using the color binding to represent the age of an Entity is logical, considering that the size binding is capped between 50 and 500 while the number of different colors available in Maltego is far bigger than this. Granted, you and I will probably not be able to differentiate #FF0000 from #FF0001.

In this View, you can find an example of how a shade of a color can be used to show the age of an Entity, not only if it belongs to a particular timeframe. The idea behind this View is that an RGB triplet such as #FF0000 is an aggregation of 3 different number, each indicating how much of a color is included in this particular shade.

The two first character indicate the quantity of red, the following two the quantity of green and the last two the quantity of blue, hence the name RGB. Because of how this works, if we set the last four characters to zero and increase the first two characters, we obtain progressively brighter shades of red.

This binding changes the color of VirusTotal File Entities:

Green if they have been submitted after the timeframe
Blue if they have been submitted before
Red if during

The more recently submitted the file, the brighter the shade of red.

This View could easily be adapted to other Entities by changing the strings highlighted in bold red and modifying the way the date is loaded depending on the format (as shown in the previous section).

// Isolate the type of Entity you want the view to highlight
if ( type == "maltego.virustotal.File"){

    // If no argument is given new Date will take the value of the current date
    // this can be a useful trick to have a moving timeframe, here is an example
    // to have a timeframe that will always cover the last 6 months
    var startdate = new Date()
    startdate.setMonth(startdate.getMonth() - 6);
    var enddate = new Date();

    // Choose the property you want to use as a reference.
    // Here we use the first time a VT sample was submitted
    // Date.parse gives us a timestamp matching the time in the property
    var submission_date = Date.parse(getPropertyValue("firstSubmissionDate"));

    // We get out the sample that do not fit the timeframe out of the way
    if (submission_date < startdate)
        {
        // Blue for the ones that are anterior to our timeframe
        var color = "#2200ff"; // BLUE
        }
        else if (submission_date > enddate)
        {
        // Green for the ones that are posterior to our timeframe
        var color = "#3cba44"; // GREEN
        }
        // This is where we elaborate the gradient
        else
        {
            // We need to divide our timeframe in 256 chunks
            // This substraction gives us the number of milliseconds that separates our 2 dates
            var difference = enddate - startdate;
            var quotient = Math.floor(difference/255);
            // We create an array with 256 entries
            var intervals = Array(256);
            // We fill it up with timestamps that represent the boundary for each chunk
            for (var i = 0; i < intervals.length-1; i++)
                {
                    intervals[i] = startdate + i*quotient
                }
            intervals[255] = enddate;

            // We iterate the array to see in which chunks the date of this Entity belongs
            var index_interval = -1;
            for (var i = 0; i < intervals.length-1; i++)
                {
                    if (submission_date < intervals[i])
                        {
                            index_interval = i;
                            break;
                        }
                }

                // Once we find the chunk, we take its index, convert it to hexadecimal and create the color. 
                // The higher the index, the brighter the shade of red. 
                color = "#" + index_interval.toString(16).toUpperCase() + "0000";
        }
        // We return the color that we previously stored in this variable
        color;
        }
else
    {
    // We color the other Entities in grey to avoid distracting us
    "#808080"; // GREY
    }

Highlighting Entities That Have A Specific Word In Their Properties

The following binding highlights Entities that have at least one of the specific keywords in any of their properties red. It can be easily repurposed by modifying the list of keywords in the first line of the code. If a string contains a double quote, you can enclose it in simple quote like so: ‘my “friend” Tyler’.

const keywords = ["ukraine", "war", "russia"];

var key_word_found = false;
for (let i = 0; i < keywords.length; i++) {
  if (propertiesContainCI(keywords[i])) {
    key_word_found = true;
    break;
  }
}

if (key_word_found) {
    "#FF0000";
} else {
    "#0000FF";
}

This is a crash course on how to create Views. While they are more time consuming and less practical than a simple text search, they are better suited for understanding a large dataset and are more versatile. Hopefully this is helpful in your future investigations!

Happy Investigating!

Maltego Views and How to Use Them: Part 2

Wed, 15 Mar 2023 11:21:14 +0000

Layouts change how information is structured; Views change how Entities are displayed.

In Part 1 of this article series, we introduced what Maltego Views are and how to set up a basic View in Maltego.

In Part 2, we will demonstrate how to use the advanced functions (such as Entity properties and links) to create Views that present data in a relevant way for you.

Lets dive right in.

Maltego Views and How to Use Them

Part 1: Introduction to Views and the Basics of Setting Them Up
Part 2: Writing Bindings for Your Views
- Obtaining Entity Information for Bindings
- Writing Size Bindings
- Writing Color Bindings
- Testing Your Bindings
Part 3: Useful Tips for Leveling Up Your Bindings and Views
- Using a Catch-All Binding
- Dealing with Date Properties
- More Examples of Views

Obtaining Information From The Entities In Your Graph

The main functions we will use to obtain information from the Entities on your graph are:

isType()
hasProperty()
getPropertyValue()

isType() will help us do a first selection of our Entities based on Entity type. Usually, one binding is dedicated to one Entity type in order to avoid having bindings containing large amounts of codes. Please note that this function takes into account the inheritance of Entity type. For instance, isType(“maltego.DNSName”) will return True for a maltego.DNSName Entity, but also for a maltego.Website Entity as this is a particular type of DNS name.

hasProperty() is what we will use right before getPropertyValue(). This is to test if an Entity has a particular property, it is particularly useful when working on dynamic properties Entities that may or may not be present in the Entities in our graph.

getPropertyValue() is our bread and butter: It will give us the value of an Entity’s property given we have the right key. Without getting too technical, the key of an Entity is simply its name. - not the name that is usually displayed on the Maltego Desktop Client, rather a name that is used internally by Maltego.

Here is how you would go about obtaining it:

This is the Property View of a VirusTotal Entity sample. We wish to write a View highlighting the date of first submission. To do so, we need to use getPropertyValue() and we need the key to this property.

To obtain the key, simply do a right click on the property and tick the Show Description Area box. This will add 2 lines at the bottom of the Property View window:

One contains the name of the Entity
The other one contains the key we need, also known as Property ID

This is the same name we would use to write a Transform or a Machine. To obtain the value of this property in a View, call getPropertyValue() with this string of character as argument.

getPropertyValue('firstSubmissionDate')

Ideally, we would want to test the presence of this property first. Which would be done by using the hasProperty() function.

if (hasProperty('firstSubmissionDate')) {
    getPropertyValue('firstSubmissionDate')
}

Moreover, we would need to verify that we only consider VirusTotal samples, not just any Entity that has a property named like this. Let’s test out the type with isType():

if (isType('maltego.virustotal.File'))  {
    if (hasProperty('firstSubmissionDate')) {
        getPropertyValue('firstSubmissionDate')
    }
}

The type of Entity can be obtained by selecting this Entity and reading its description in the Detail View window.

We now have properly extracted the value of a property. The last thing we need to do is to manipulate its value into an output that will be used by Maltego to set the Entity’s color or size. We will detail the specifics of both types of bindings in the next sections.

Size Binding

This binding expects a number to be output. As the description box reads, the size of an Entity is clamped between 50 and 500.

This is a first challenge for us.

getPropertyValue('final_balance')

Take the following View highlighting the number of BTC in an address as an example:

Because the return value is comprised between 50 and 500, any amount inferior to 50 will be automatically brought to 50 when interpreted by Maltego to represent the size of the Entity. With this approach, any address with a balance between 0 and 50 BTC will be the same size! This is a shame, considering that at the time of writing, 50 BTC were worth a bit more than a million dollars! Moreover, any address with 500 BTC or more will be represented by a ball the same size, whether it contains 500 or 50,000 BTC.

To avoid this problem, most size bindings in Maltego use the following function: The logarithm! This function will “flatten” the values for us. Let us use it on our binding:

(1 + 1.5 * Math.log(getPropertyValue('final_balance'))) * 50

In this example, we add 1 to the log and multiply by 50 to be able to reach our interval faster: Without this, we would reach 50 with a balance of 1050 BTC! With these modifications, 1 BTC will bring us to 50, 10 to 125, 100 to 200 and so on.

The idea is that most values, from the smallest to the largest, will have a different output when passed through this function. However, this is only a good approach if we expect a wide range of values in this property.

If we wanted to do the same thing with the age of a person, this approach would make our View useless, as most people’s age is comprised between 0 and 115, our ball sizes would never reach 200, leaving the 200 to 500 range unused. In this case, it would be better to drop the logarithm and multiply the age by 4 to occupy the entire range. We will also add 50, else the children from age 0 to 12 will be represented with the same ball size (as 0 x 4 = 0 < 50 and 12 x 4 = 48 < 50).

This would give us the following binding, which is much more adapted to a smaller range of possible values.

50 + 4 * getPropertyValue('age')

Color Binding

A RGB hex code is a # sign followed by 6 digits or letters that indicate a particular shade of color. For example, #808080 indicates grey while #FF0000 is bright red. To find the RGB triplet of a particular shade, simply google it or use a freely available online tool.

The main problem we face with this binding is that unlike the previous one, we cannot just pull a numerical value and slightly tweak it to match our range. Most often than not, color bindings are not best suited to underline a range of values, as they are only here to highlight a set of Entities based on specific criteria.

To build on the previous example, if this time we want to highlight individuals that are legally considered adults (with an age above 18), we would use the following View:

if (isType('maltego.Person'))  {
    if (hasProperty('age')) {
        if (getPropertyValue('age')>=18) {
            "#FF0000"; // RED
        }
        else {
            "#0602f5"; // BLUE
        }
    }
}
else {
    "#808080"; // GREY
}

After testing if the Entity is a maltego.Person Entity, the binding code checks if the Age property is present and then checks if the age is equal to or greater than 18. If the age is indeed greater than 18, the code returns #FF0000 (red), showing the relevant Entities in red. Otherwise, it returns #0602F5 (blue), showing the relevant Entities in blue. Entities that are not Person Entities will be colored in grey (#808080). Do not omit the semi colon “;” after the string you wish to output.

There is a fundamental difference with the binding in the previous example: While the previous example allowed to grasp the general age repartition of the population on your graph at a glance, the color binding will help quickly isolate the minors and the adults in your graph. But you will not be able to obtain the medium age of the population. Therefore, combining both bindings can be a good idea to gain a better understanding of your graph.

Please note that the Age property in this example is a dynamic (custom) property and is not present by default in the Entity.

Testing Your Bindings

Whichever bindings you choose to add to your View, you should test it extensively. To do so, click on the Test button below the list of functions in the Binding Editing window. This will display a window similar to the following:

You will be able to find a list of the Entities in your graph, the Entity types, and what this binding gives as an output when this Entity serves as an input. Sometimes, the Result column will contain an error message written in red. Click on the ellipsis to better visualize the message.

In Part 3 of this article series, we will share even more useful tips and tricks that you can use to take your Bindings and Views to the next level.

Happy Investigating!

Maltego Views and How to Use Them: Part 1

Wed, 15 Mar 2023 11:20:40 +0000

Layouts change how information is structured; Views change how Entities are displayed.

Take the graph containing a Bitcoin address linked with several hundreds of transactions for example.

In this example, we want to figure out what was the biggest transaction made on 04 June, 2021. Without the Views feature in Maltego (image left), we would have to copy all the transactions into a new graph, extract the date for each transaction, remove the ones that were not made on that day, and then extract the transaction amounts, followed by sorting the resultant amounts. Only at that stage would we be able to identify the largest transaction made on that particular day.

Instead, we can simply use a View to modify the size of transactions according to their amount, as well as their color according to the date the transaction took place (red for the 4th of June, black for any other day). This would give us the graph at the right.

It now becomes clear that the transaction we are looking for is the one highlighted to the right of our graph.

Let’s dive into the topic of Maltego Views: How they work, when to use them, and how to harness their power to boost your investigations.

Maltego Views and How to Use Them

Part 1: Introduction to Views and the Basics of Setting Them Up
Part 2: Writing Bindings for Your Views
- Obtaining Entity Information for Bindings
- Writing Size Bindings
- Writing Color Bindings
- Testing Your Bindings
Part 3: Useful Tips for Leveling Up Your Bindings and Views
- Using a Catch-All Binding
- Dealing with Date Properties
- More Examples of Views

When Should You Create A View in Maltego?

Views are very useful, but using Views requires more time and knowledge in comparison to running a simple search in your graph. Before creating a View, ask yourself: Could you simply use Ctrl+f and type a search query to satisfy your request?

For example, if you want to search for posts mentioning “Donald Trump” amongst your graph, the search bar is a quicker alternative to Views - especially one that will allow for selection of these posts as you search them. If you want to highlight posts that contain a keyword amongst a pre-existing list, a View could be considered rather than searching individual keywords.

Views are better used on datasets that are too large to have each Entity individually evaluated. For instance, if your graph has only 10 Entities, clicking every Entity would be faster than writing a View.

How Views Work

Views are nothing more than a collection of bindings executed one after the other on the Entities populating your graph. A binding is a JavaScript code snippet which will be executed using the eval function.

While having basic programming knowledge will make things easier, it is not required to write a binding. A lot of bindings can be adapted by modifying a few variables to fit your needs. This is the case with the default ones that you can find in every Maltego Desktop client, as well as the ones in this article.

Here is a simplified version of the binding controlling the size of the Entities in the previous example:

if (isType("maltego.CryptocurrencyTransaction")){
    if (hasProperty('total_input')) {
        getPropertyValue('total_input') * 50
    }
}

As you can see, it is very short:

We check the type of the Entity
We verify that it has the property total_input
We obtain the value of that property and multiply it by 50.

Let us now dive into the process of creating a View!

Creating Your Views

To create a View, click on the Manage View button in the View tab at the top of your screen.

This will open the Manage View window. This is where you can create, remove and organize your Views.

To add a new View, click on the New Viewlet button on the top left. After naming your new View, it will appear on the list of Viewlets. Select your Viewlet in the list and assign an icon to it by clicking on the Change Icon button on the top right. You will need to add an icon to your View to place it on the View taskbar.

After selecting an icon, you can tick the several boxes in the list to modify their place in the Maltego Desktop Client or activate them (see the previous image):

Ticking the Active column uses the selected View to display the graph.
The In Toolbar column allows you to display the Views on the left of your graph, below the layouts.
The In Menu column will place the Views in the drop-down menu displayed when clicking Manage View button.

Now that we know how to create a View and place it into our Desktop Client, let’s learn to create bindings to make our Views more useful.

Creating Your Bindings

Bindings contain the actual code run by Maltego to display your graph according to your criteria. They can modify the size or the color of the Entities on your graph.

To add a binding, simply select a View in the Manage View window and click the plus button next to the Bindings section. This will take you to the window shown below:

This is where you will add your code and choose what kind of binding you are writing.

Let’s take a look at this window:

The Bindings Menu contains options that determine the Entity colors or sizes on your graph through the outputing of your code snippet.
The Text Editor is where your code should be placed.
Underneath is a list of functions that do not belong to JavaScript but are provided by Maltego to interact with the Entities in your graph.

Writing a View means using these functions to obtain information from the Entities to tell Maltego how to represent them. This list of functions is relatively simple and are organized around two main themes:

The properties of an Entity: Properties, display information, notes, bookmark, type, etc.
The links of an Entity: Incoming and/or outgoing

To write efficient Views, we need to understand how to use these functions. Part 2 of this blog article series will teach you how to do this, and then it will be up to you to learn some basic JavaScript to manipulate the information at hand to design Views. However, if your intention is to be able to create simple Views without the in-depth programming aspect, this article contains templates that you can easily modify to fit your needs.

Happy Investigating!

The Pivot Podcast: Looking at Hacking from Another Angle with Zaid Sabih from zSecurity

Wed, 15 Mar 2023 10:26:10 +0000

In this episode for The Pivot podcast, we welcome Zaid Sabih!

Zaid Sabih is an ethical hacker, a computer scientist, and the founder and CEO of zSecurity. He has tremendous experience in the field of ethical hacking. In 2013, he started teaching his first network hacking course, which led him to publish a number of online ethical hacking courses. Now, Zaid has more than 800,000 students worldwide.

In this episode, Zaid sits down with Maltego to recall what led him into cybersecurity and infosec and later to establishing his own company, zSecurity. He also talks about his thoughts on “hacking” and CTFs, and provide 3 tips for becoming a successful bug bounty hunter in the end.

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

The Pivot: Your New OSINT and Infosec Podcast

Where to Listen to The Pivot?  

Tell us a bit about yourself and zSecurity!

Zaid: My name is Zaid, the the CEO of a cyber security company called zSecurity. We’re based in Dublin, Ireland, and we provide lots of cyber security services such as pentesting, consulting, training, code reviews, and more. We also have our own VPN company and have recently launched our own bug bounty program. Everything we do is related to cybersecurity, and we’re trying to always be keeping up with the updates and everything that’s coming up.

Another thing is spreading education. Getting people to be more educated about their cyber world or their lives, as everything now is online or on the cloud. Everybody uses computers and most of the time, people don’t ask questions. They don’t think about what they’re clicking and doing before realizing that somebody has access to all of their data, pictures, and everything. Thus, I think it is essential to educate yourself about that in the time that we live in right now, even for people that aren’t even interested in learning ethical hacking.

What got you into infosec, cybersecurity, or let’s say hacking?

Zaid: I think I was 11 or 12 years old. It was back in the Yahoo Messenger days, so you’d have a lot of friends in your Messenger. There were exploits where you could just get someone to sign out or get their Yahoo Messenger to crash. We had a challenge of hacking someone else’s Yahoo. I could get people out of their accounts, but they could log back in. What’s the next step? Hack into their accounts. The challenge that we had was to see who’s going to hack into the other accounts first.

At the time you feel like you’re bending the rules. Obviously, you’re not supposed to be able to access someone else’s account. I felt like I bent the rules and managed to do something that’s not supposed to do, or something that is really difficult to do, and I really liked the feeling of achievement. From there, I started learning more about ethical hacking and hacking. Later, I learned that there are actually jobs to work legally and make a living as a pentester or ethical hacker.

After that, I started contributing to ethical hacking communities and eventually met up with a few friends, becoming one of the early people within an Arabic hacking community. I also then began teaching live classes. At that time, I was in college and decided to study Computer Science because I knew that I wanted to work as an ethical hacker.

Back then, we didn’t have cybersecurity or ethical hacking courses like we do now. By the time I graduated, I turned down an offer and founded my own company, zSecurity, with the thought in mind that it would be harder to make the move later in my life. It was a tough decision, but fortunately, everything went well and I ‘m really happy with that.

What is it like to teach in full scale?

Zaid: I actually never thought of teaching ethical hacking and pentesting. I’ve always thought of working as a pentester and didn’t really think I would enjoy teaching it. But once I did it, I ended up loving it.

First of all, I get to do the pentesting anyway when I’m not teaching, and before I can teach something, I have to get really good at it or even better. Sometimes, I know how to do something, but I don’t fully understand why it works that way. To go ahead and teach it, I have to understand every single aspect of it and every single possibility of how it happens, which widened my knowledge in a topic that I love, and that’s a big perk.

Another thing is the feeling you have when receiving feedback from your students. It takes a bit of time to start getting these nice messages and all that. Nevertheless, every now and then, I get a message from someone saying they used to be in a very bad situation. Either my course put them on a path, got them to a level to obtain their dream jobs, or helped them fix personal issues. It genuinely feels good as you feel like you’re giving back and you’re doing something good. It’s just really nice energy you get back from them.

Tell me about the bug bounty platform from zSecurity!

Zaid: The goal is to have a bug bounty platform where companies can submit whatever platform they have–be it a website, an app, an API, or whatever they want ethical hackers to check. It gets put on our platform, and ethical hackers around the world can test it. If they discover any bugs, it comes to us first and we’ll verify it. If it is valid and meets all criteria, we contact the platform owner, informing them that somebody discovered a bug in their platform. The owner decides whether they want to give points, pay monetary reward, or bounty for the discovery. The idea is obviously not novel as bug bounties have existed for a while, but the cool thing about it is that it solves two problems.

The first solution, for the platform owner, is that you only pay when a bug or weakness is discovered. Even if you’ve done a pentest, the pentest will only cover you for a limited period of time. For example, if you get Maltego pentested today, I’m going to give you a report of all the bugs that I discover today, but you probably are going to release an update tomorrow, in a week, or in a month. Besides, libraries that Maltego uses might actually become vulnerable and release updates in the future. Updates introduce new code, and new code could introduce new bugs, which is the idea of a bug bounty. You can have your system always tested by a number of ethical hackers.

The other solution, for the ethical hackers or the bug hunters, is that it gives people a pledge to practice their skills legally without breaking any laws while making a difference. At the end of the day, they are discovering bugs and protecting other users who use the platform. Not only do they get to practice and earn rewards, but they also get to do something good.

Some people do it as full-time because it gets them a lot of money, some use it to practice, and others use it to make a name for themselves. Our platform solves two pieces of the equation, bringing the ethical hackers and the company owners together.

What are your thoughts on how people learn to do ethical hacking or bug bounty with CTF platform nowadays?

Zaid: I think they’re great for entertainment and some of them are actually really good to learn actual skills, while some of them focuses too much on gamification.

If you want to practice properly, bug bounty programs are better. People often ask me how to start with bug bounty. Just go ahead, sign up, and start testing. It’s not that hard to start with bug bounty. You’re testing against real websites, and there are numerous platforms out there.

What is your opinion on the alternative wordings for hacking, such as red teaming, blue teaming, and purple teaming?

Zaid: I don’t see anything wrong with using the word “hacking.” The word describes hacking very well, so I don’t see the need to come up with different words to describe the same thing.

It’s annoying that we have to come up with substitutes. If you’re a hacker, you should be able to say that you’re a hacker, knowing hacking does not make you a criminal. You’re a criminal if you commit a crime, and there are a lot of other crimes that you can commit other than hacking. So, the word “hacking” shouldn’t mean crime.

I see why alternative terms are used as a lot of bots like Google are scared of the word “hacking.” Upload a video on YouTube with the word “hack” in it. It’ll probably get flagged if not removed. I had that experience. The video was related to hacking, but once it got reviewed by a human, they were like, “Okay, the video is fine. It’s educational and it was allowed.” Still, I have to go through this process several times, and that becomes annoying.

If you go on our website, I still say ethical hacking and stuff related to hacking. I don’t say “blue team” or try to dance around saying “hacking.” Instead of trying to avoid the words and replacing them with other terms, I think we should use it and educate the people considering it to be a crime to know that it’s not a crime.

Zaid: I would say the first thing is don’t buy a dream. I know I sell courses, and that’s part of what I do, but I actually never sell a dream. I never say: “Take my courses and you become a millionaire.” You can earn a fortune from bug bounty and as a cybersecurity expert and get paid very well. Likewise, you can also get paid very well doing other jobs.

Do what you love. If you are passionate about bug hunting or being a pentester, it’s going to take a significant amount of practice, time, and patience. The guys whom you see making handsome money now, they spent hours and hours staring at code with their head over problems. One vulnerability can take them so long and once they submit it, they also have to wait for so long until it gets approved. You have to account for that.

Finally, spend a lot of time learning and don’t get frustrated. That goes back to the second point. If you’re doing what you love, then you’ll be able to stay patient and persisten. This principle applies to everything not really just for bug bounty only.

There’s More! Listen to Our Full Interview with Zaid!

If you find the snippets of the interview interesting, don’t miss the full interview!  

Listen to our full interview with Zaid to learn more about:  

How Zaid explains the word “hacking” to people with zero background in ethical hacking
What topics he is interested in exploring besides hacking
His whole journey in ethical hacking and bug bounty

And much more!

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

Don’t forget to follow us on Twitter, LinkedIn, and YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.  

Happy investigating!

Investigator Toolkit February 2023: Cheat Sheets for Faster and Spot-on Workflows

Fri, 03 Mar 2023 09:29:51 +0000

Investigator Toolkit: Quick Starts to Using Maltego Hub Items in Real-life Investigations

Where to Find the Investigator Toolkit?

All Previous Investigator Toolkit Roundups

Investigator Toolkit February Roundup

In February, we featured the following four Hub items and their use cases in the Investigator Toolkit series:

Let’s dive straight into how to use these Hub items for on-demand translation, criminal warrant monitoring, person of interest investigation, and SIEM investigation!

DeepL: On-demand Translation

With the integrated DeepL Transform, investigators can seamlessly translate the main value of any Entity in #Maltego into 20+ languages. See how we accelerate and enrich our investigations by leveraging the DeepL Transforms in Maltego to identify languages in use and obtain translated texts. Overcome the language barrier in just a few clicks!

FlightAware: Criminal Warrant Monitoring

FlightAware provides current and historical flight data, ranging from a flight’s origin, destination, and operator to ownership details. See how we use FlightAware to pull relevant flight data of our person of interest and identify the criminal organizations behind an unidentified aircraft using its tail number. Try it out now to track person of interest movements in your POI investigations!

Hunter: Person of Interest Investigation

Using an Alias Entity or a Domain Entity, investigators can query Hunter to find the professional email address of their person of interest, examining its confidence score. Follow the steps to gather more information!

IBM QRadar: SIEM Investigation

With the IBM QRadar Transforms for Maltego, investigators can quickly extract and gain insights into host assets, offense details, IOCs, event logs, and more from a given QRadar instance. Try out the cheat sheet now!

Check out the Investigator Toolkit series now!

In the following months, we will continue digging into different Hub items available in Maltego and providing best practice tips for investigators.

Happy Investigating!

The Pivot Podcast: OPSEC & How to Secure Your Own Privacy in OSINT Investigations with Palenath

Wed, 15 Feb 2023 12:47:27 +0000

In this episode for The Pivot podcast, we welcome our guest Palenath!

Palenath is an OSINT & hacking enthusiast and a speaker at Barbhack, UnlockYourBrain, Stack Overflow, Barbhack as well as Lehack. He coded several OSINT software and published them on GitHub. He also proactively participated in several OSINT CTFs, winning competitions held by Trace Labs, Maltego, and UnlockYourBrain.

In this episode of The Pivot, Palenath walks us through his journey on how he comes to program OSINT tools as well as his own experience of getting support from the OSINT community, recommending websites and communities for beginners. He also shares with us his opinions on operational security (OPSEC) and provides basic hygiene guidelines for researchers to protect their privacy while conducting investigations.

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

The Pivot: Your New OSINT and Infosec Podcast

Where to Listen to The Pivot? 

Tell us a bit about yourself and your work!

Palenath: I’m Palenath, and I participated in several CTFs, like TraceLab and all the Maltego CTFs, and do stuff on our internet for fun.

Apart from that, I sometimes create OSINT tools open-source to share with the community. I automate some manual tasks to save time for people. For example, Holehe, a tool that allows you to check if an email address has been registered on different websites. The objective of Holehe is just saving time as I always did it manually at the beginning.

The name of my GitHub is Megadose. People can check out the tools I developed there. It’s good and it’s free. I put all the tools on my GitHub because the big advantage of the open source is that the community can contribute to these tools, and you are really more powerful when more people contribute to a project. For me, the knowledge needs to be shared as the knowledge is the power.

Can you give an example of where the OSINT community helped you achieve a greater project?

Palenath: For example, when I started on Holehe, I had just 20 websites. The community gave some ideas to upgrade the tool. For me, it’s definitely more powerful when we are in a community since most people are going to use your tool and help you find some bugs.

That’s the power of the open source, but the problem with the open source is the same that everyone can use your tool. Two or three months ago, someone shared a method to find a Twitter account from an email address. Within two days, the Twitter loophole was fixed. Open source tools have limitations as well as pros and cons like everything else.

Isn’t it a problem that these tools are also available to malicious users who originally don’t have the capacity or ideas to target somebody with OSINT?

Palenath: It’s such an interesting point. However, these guys are going to find methods to do what they want no matter what. They are going to use OSINT methods, but not because of the principle of OSINT, rather the fact that it’s hidden and the target doesn’t know the existence of their activities. If Holehe does not exist, they are going to find some aggressive methods. They don’t care about the target anyways. On the other hand, we can’t control what people do with the tools.

When everything is openly available, good people can use it for free. For example, journalists, as they don’t have a lot of money to spend on commercial tools. That’s the big win over there. They can just use the tools and have no problem with the money.

What is the reason that you are so careful with operational security (OPSEC)?

Palenath: One of the most crucial points and what everyone needs to remember, it’s internet forgot nothing. If someday, I put a picture of my face on the internet, it’s done. It will be around for a long time. It’s impossible to delete the picture once I put it up there, and that’s why I’m really careful with what information I share on the internet.

As I’m still very young, I don’t want to make mistakes that could negatively affect the rest of my life. Moreover, privacy is important for people in OSINT. It will be really strange if you are giving away a lot of information about yourself when conducting an OSINT investigation. I know giving just a name and a face is not a lot for people, but for me it’s a lot, and I might regret sharing the information in the future.

Any OPSEC suggestions for people that are actively doing OSINT research?

Palenath: For me, when you do an OSINT investigation, you need to understand that you are going to make some mistakes, and the objective here is to reduce the impact of these mistakes.

Never use your personal account to conduct your investigations. Use every time a sock puppet, which is a fake account. Never use your real IP because it’s possible that you are going to click on links controlled by the people while researching. Remember to use VPN.

Use fake phone numbers and different email addresses. Please don’t use your personal email address to create a fake account because it’s easy to find you afterwards. That’s the minimum of OPSEC for me: Using sock puppets, fake accounts, VPN, fake phone numbers, and different email addresses.

Use a virtual machine (VM) as the maximal measure. I know it’s really painful to use a virtual machine, but as an alternative, just use another browser that’s not your personal’s to avoid some stupid mistakes, such as, “Oh no, I have been exposing my personals, my face, my personal Facebook account, and I have been liking the posts of the target so they know my existence.”

Palenath: That depends on who you are researching about. The most important thing in OPSEC is knowing from whom you want to hide. You are not going to use the same method or threat model to hide from the government as you would to hide from a random guy on the internet.

As mentioned before, use a virtual phone. It will probably be sufficient if you have a SIM card. If you don’t want to have a physical SIM card, you can use online websites to get a phone number. The best is to reduce the number of thirdparty providers. If you use an external service to get your SMS, then all the people would know how you are going to pay. Let’s say you pay with your PayPal account. They are going to know this phone number has been linked to your PayPal account.

If you have a physical SIM card, pay in cash, use it only once on the phone, and then later destroy the phone. If your targets are terrorists, it’s not an overkill to use a one-time phone and destroy it later.

Palenath: It’s not mine, but it’s during an investigation and it was really fun. What my target did was paying a lot of attention to which information they put on the internet. Like, they used different usernames and never the same profile picture. The objective of my investigation was to find their real names. I was searching and had literally nothing besides different profiles with different usernames. At some point, I got an email address. I thought to myself that it was just a random email address and I wasn’t going to find any information. However, I used epieos.com, a website that allows you to find information from an email address, just to give it a shot. I put in the email address and followed the link to an account with their real name. Apparently, they linked their personal account to this random email.

That’s why I said when you create a fake social account, don’t use your real email. It made no sense that they literally put their real names, a picture of them while working, and so on. They really spent time and money to stay private and maintained privacy well, but everyone makes mistakes.

There’s More! Listen to Our Full Interview with Palenath!

If you find the snippets of the interview interesting, don’t miss the full interview!

Listen to our full interview with Palenath to learn more about:

How Palenath kicked off his OSINT journey with various content formats
How he came to create OSINT tools
His opinion on tools that are basically AI black box

And much more!

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast and follow our podcast for future episodes!

Follow Palenath on Twitter and GitHub so that you never miss any updates or interviews like this.

Don’t forget to follow us on Twitter, LinkedIn, and YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.

Happy investigating!

Investigator Toolkit January 2023: Cheat Sheets for Faster and Spot-on Workflows

Wed, 01 Feb 2023 13:16:50 +0000

Investigator Toolkit: Quick Starts to Using Maltego Hub Items in Real-life Investigations

Where to Find the Investigator Toolkit?

All Previous Investigator Toolkit Roundups

Investigator Toolkit January Roundup

In January, we featured the following five Hub items and their use cases in the Investigator Toolkit series:

Let’s dive straight into how to use these Hub items for supply chain attack intelligence, SIEM Investigation, threat monitoring, disinformation investigation, or information gathering!

VirusTotal Public API: Supply Chain Attack Intelligence

With VirusTotal’s intelligence collections, investigators are able to identify and monitor attacks, to better understand what is being distributed by threat actors. Check out our joint webinar with VirusTotal to learn how we pull out dependencies of a certain data repository, examine known CVEs, and investigate supply chain attacks. Obtain attack insights with Maltego now!

Splunk: SIEM Investigation

To spot potential security threats and reduce the underlying risks, run the Splunk Transforms in Maltego to gather real-time cybersecurity operational data, identify potential threats, and pinpoint malicious activities! SIEM-plify your investigations with Splunk by gaining insights into potential threats and creating a security incident to start the remediation process now!

Silobreaker: Threat Monitoring

To efficiently monitor threats and respond rapidly, investigators can take advantage of the Silobreaker Transforms to gather real-time data on a wide range of topics. With Silobreaker, we are able to look into the baking trojans aiming at LATAM banks from a Phrase Entity and retrieve malware, company, region, and other relevant data in just a few clicks. Boost your risk management now!

Echosec: Disinformation Investigation

Nowadays disinformation campaigns spread rapidly and widely, Echosec Systems can easily pull data from various social networks, monitor events worldwide, and quickly pinpoint threat actors behind these campaigns. In September 2022, our Subject Matter Expert, Mathieu Gaucheler, along with the Echosec System crew demonstrated how to unmask malicious users behind certain disinformation campaigns using the geo-reference function.

RegEx Library: Information Gathering

With the newly added Regex Library Transforms, investigators can extract matching objects from webpages with pre-defined or customized regex patterns. Simply drag-and-drop a URL Entity and try it out now!

Check out the Investigator Toolkit series now!

In the following months, we will continue digging into different Hub items available in Maltego and providing best practice tips for investigators.

Happy Investigating!

The Pivot Podcast: Mapping Threat Intelligence Landscape Worldwide with Teresa Walsh from FS-ISAC

Sun, 15 Jan 2023 15:20:00 +0000

In this episode for The Pivot podcast, we welcome our guest Teresa Walsh!

Teresa leads the FS-ISAC’s Global Intelligence Office (GIO) to protect the financial sector against cyber threats by delivering actionable strategic, operational, and tactical intelligence products. Based in the United Kingdom, she oversees FS-ISAC’s global member sharing operations and a team of regional intelligence officers and analysts who monitor emerging threats. Teresa began her career as a civilian intelligence analyst with the US Naval Criminal Investigative Service (NCIS) and holds a master’s in political science with a focus on international relations from the University of Missouri-Columbia.

In this episode of The Pivot, Teresa provides insights into the intelligence world, the differences between traditional intelligence and cyber intelligence, the psychology behind the analysts, and more!

Listen to this podcast episode on Spotify, Apple Podcast, or Google Podcast!

The Pivot: Your New OSINT and Infosec Podcast

Where to Listen to The Pivot? 

Tell us a bit about yourself and your work!

Teresa: I head up the intelligence team for FS-ISAC. For people who don’t know who we are, we’re a membership association with thousands of financial institutions being part of our membership. We work with them throughout the world and have people in Brazil, Australia, New Zealand, India, Canada, and all sorts of places.

My team has to keep up with the members, so every day is actually always very interesting. I wake up with messages from my team in Singapore and Australia telling me what’s going on, and then by the end of the day, I’m hearing from the Latin America crew or the US crew talking about what’s happening there.

I think in our world and in our industry, there’s always something going on. It’s never necessarily a dull moment, and it has been a very rewarding job. I’ve been here almost six years to this date. It’ll be my anniversary next month.

What is it like waking up to different parts of the world giving you little bits of information and insights as to what’s happening in and around these areas?

Teresa: On a personal level, I love it because I started out in political science and international relations. I was fascinated about the world and what’s going on around me, which was probably a little bit ironic, considering I was from a really small town in the Midwest of America.

I just really love to understand what was taking place around the world. Being able to wake up and hear from maybe our regional director in Japan or from an analyst in Australia, or talk about the membership in Malaysia or Thailand is just really fascinating to me.

Now with the pandemic, we’re in a remote kind of flexible lifestyle, aren’t we? I’ve always been a bit like that. My mind has always wandered back and forth between work and home life, so it actually works well with me to be able to say: Oh, I need to get a few things done as soon as I wake up, and then focus on personal life, and later get back into the work scheme. The ebb and flow actually works very nice for me.

Talking about your world, what is it like being in the intelligence world?

Teresa: It probably sounds a little bit sexier than it actually is, and I think Hollywood is to be blamed for that. We’re not always in front of 20 screens, stopping attacks as they happen and things like that. It is in some ways very mundane and regular. Waking up, you’re looking at what’s going on, reading a lot of reports, interacting with people, finding out more information, and then analyzing as well as assessing what’s going on.

One of the challenges I always have in the intelligence profession is trying to make sure people understand that cyber intelligence is not just about IP addresses and URLs. It actually is going back to that old-fashioned way of thinking about intelligence analysis. You’re trying to drive decision making and help your decision makers make the best choice possible, whether it’s to invest in a new technology or tighten controls in a certain way. It all goes back, at the end of the day, to that primary purpose, not just for grabbing IOCs and shoving them through your sim.

What is the biggest challenge for getting the traditional SOC team to think differently about the intelligence and use it versus jamming millions of IPs into a tip?

Teresa: I think you need to sit down and decide what you actually want from threat intelligence. What I hear a lot from executives is they’ve read about threat intelligence, heard from a peer that they have a CTI team, things like that, and so they just assume we need one. Without understanding exactly what it is, they decided to just create one. To them, it is about the IOCs. The KPI of assessing the success of your intelligence program is how many IOCs you push through your tip or your sim.

That’s not the right way to think about intelligence. There’s nothing wrong with IOCs because they are the building blocks. I have kids, so I always use a Lego analogy. If you think of Legos, even the biggest Lego picture in the world starts with one little itty-bitty block. You have to have those types of tactical level blocks and should still look into IOCs. It’s just not the only thing about cyber intelligence that you need.

Intelligence should be a part of your business, such as how you make your business and how to make it more resilient? I think that’s where the gap is. The initial mindset at the very beginning when you say we need a cyber intelligence program is to sit down and actually understand what you need and what the base requirement is.

Your risk management program should drive your intelligence requirements, and then your intelligence analysis should go back into your risk management program to help you be more resilient and understand the risk better. However, I think that is probably a mindset gap that hasn’t really been addressed too much yet.

How much of this intelligence is derived or propagated from open source intelligence?

Teresa: I would say a lot of it. In the intelligence world, you often hear analysts talk about multiple sources—multi-source intelligence—and that’s how you stay away from a single source. If you’re just looking at one source, you’re not collecting pieces of intelligence. Instead, you’re listening to somebody else tell a story and believing whatever it is.

Having multiple sources is a way to cross reference and confirm or deny what might be going on. You want to use a variety of sources, whether they’re closed sources from somebody who just had an attack with a sample of the malware used or an open source where its companies might have blogs and podcasts, talking about different types of threats and understandings of those threats.

If you want to go more to the strategic route, you also need to be aware of everything else around you and understand your industry. Because how can you protect your industry if you don’t understand how it works? There is also a level of not just the cyber tools that you need to be aware of, but keeping up with your industry and understand what the bad guys are going to look at, what they are going to go after, and what they are reading about in terms of money movements and databases with attractive bits of information.

In the finance world, I have to learn now about digital currencies. Not just cryptocurrencies, but the legitimate stable coins. The central bank digital currencies that are starting to give rise today. We have to understand that as cyber professionals because we need to be able to protect it down the road.

Do you have any specific tools that you use to gather all this intel or do you have other people doing that for you?

Teresa: A little bit of everything. We do have our own sets of tools. We make use of open source tools, paid subscriptions, and things like that. For our side as a membership organization, we also have a plethora of tools that our own members use. Since we are talking about thousands of members, that’s a huge crowdsourcing potential if you will, looking at a particular type of malware, a particular attack vector, and a particular pattern in an approach of a network intrusion.

I didn’t start out in this type of role, and thus I had to learn all these technical approaches and techniques an analyst uses. I became highly reliant on learning from others and understanding what they were doing and what tools they were using—.trying to crowdsource that information for my benefit at my bank where I was working at. I’ve also carried that over to FS-ISAC.

Use the resources you have around you. Use your peers, use each other, and crowdsource that information. It’s not just you working on your own skillsets and your own knowledge but collaborating and being stronger for it.

For anyone getting into the intelligence world, what are the three most important things in terms of advice that you would give them?

Teresa: First of all, I would say you’re never too old. I think everybody always approaches that question from a young student’s perspective trying to look at a career field. Nevertheless, I was definitely somebody who got into cyber after university. You’re never too old to make a change, so don’t give up on that thought. I know a lot of people in their forties and fifties even have made that leap into cyber. Consequently, I would say just because you’re not a student in your twenties and with the whole world in front of you doesn’t mean that it’s not a possibility.

Second is to find somebody to talk to. Some of the things like these podcasts. I think they’re brilliant because you are teaching people at large how to get into the fields and how to really kind of pursue those types of careers as well. I would say use resources as much as possible, whether that’s on the internet or people. You can get the things that people will never tell you and learn from them as much as possible.

Be open to possibilities as well. Sometimes people get maybe too pigeonholed in one idea or another about what they want to do. I got into this role by accident if I think about it as I never would’ve thought I would be here doing this type of job. Sometimes happy accidents do lead us down great path, so you do have to be open and flexible. If you’re somebody who says, “Nope, I have a plan.” I’m going to check the box and get to that plan. That’s okay too. I would say be open to the possibility along that path, and you’re going to find something else that interests you. Maybe it is penetration testing, threat hunting, or going along the business route and saying you want to make business decisions with cybersecurity in mind. All those things are an open field to you, so make sure you’re looking.

There’s More! Listen to Our Full Interview with Teresa!

If you find the snippets of the interview interesting, don’t miss the full interview!

Listen to our full interview with Teresa to learn more about:

Which industry Teresa considers to be evolving faster against cyber risks than others
Her suggestions on how to approach an intelligence program with a risk management mindset
How she perceives the uncertainty in the intelligence world and the psychology behind an intel analyst

And much more!

Listen to this podcast episode on Spotify, Apple Podcast, or Google Podcast and follow our podcast for future episodes!

Don’t forget to follow us on Twitter, LinkedIn, and YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.

Happy investigating!

Investigator Toolkit December 2022: Cheat Sheets for Faster and Spot-on Workflows

Wed, 04 Jan 2023 12:57:48 +0000

Investigator Toolkit: Quick Starts to Using Maltego Hub Items in Real-life Investigations

Where to Find the Investigator Toolkit?

All Previous Investigator Toolkit Roundups

Investigator Toolkit October Roundup

In December, we featured the following four Hub items and their use cases in the Investigator Toolkit series:

Let’s dive straight into how to use these Hub items for threat intelligence investigation, threat actor group investigation, malware investigation, and threat hunting investigation!

Recorded Future: Threat Actor Profiling

To understand your adversaries and the current and upcoming risks, you can build a threat actor profile with Recorded Future by pasting a Phrase Entity containing country names. See how we profile a threat actor with SOCMINT by combining Recorded Future and Silobreaker.

Wayback Machine: Historical Information Gathering

To gather information on historical events, take advantage of the Wayback Machine Transforms in Maltego to fetch snapshots of deleted pages, hidden files, and changed content. See how we combine Wayback Machine and Maltego Standard Transforms to research dark web chatter of a shooting, a patent dispute, and an authoritarian news agency.

Shodan: Vulnerability Exploration

Shodan helps organizations reduce possible risks by exploring a network’s vulnerability and risk landscape. Looking from the angle of a CERT or Red Team analyst, we exemplify how to investigate unpatched servers and thus protect proprietary systems with Shodan in Maltego.

TinEye: Reverse Image Search

TinEye helps investigators monitor and identify the weaponized memetic content used to spread propaganda, misinformation, and disinformation. You can track the spread of a single image or uncover the connections between multiple images with TinEye. See how we conduct reverse image research in Maltego.

Check out the Investigator Toolkit series now!

In the following months, we will continue digging into different Hub items available in Maltego and providing best practice tips for investigators.

Happy Investigating!

A Look Back at 2022

Wed, 21 Dec 2022 09:36:31 +0000

As we celebrate one year’s success and another year’s coming, it is once again time to reflect, recharge, and restart. We at Maltego are grateful to have enjoyed tremendous growth and opportunities in 2022 despite the increasingly uncertain economic climate in the technology industry. Of course, this would not have been possible without the amazing people in our organization as well as our partners, collaborators, and customers worldwide who continue to support us.

Below are some of the highlights, wins, and important themes that have guided us through the year.

Putting Our Investigators First

Made by investigators and made for investigators, Maltego would not be the same without the beloved community formed and bonded over the past 10 years. In 2022, we aligned our visions and ensured that investigators are at the heart of the key – if not all – product, content, learning and service offerings, and initiatives. We have and will continue to strive to provide valuable solutions, information, and interactions where our investigators need and best find them.

Data At Your Fingertips: Ever-Growing Transform Hub Offerings

As more and more investigators add Maltego to their standard toolkit, it is one of our utmost priorities to provide a broad range of relevant data sources with more flexible, tailored data access options. With the 12 newly added data integrations in 2022 and a dozen other updated existing Hub items, we’re proud to have:

A total of 96 data integrations on the Transform Hub
50 Click-and-run Hub items for Maltego Enterprise, and 42 also for CE, and Pro
12 Hub items accessible via annual or monthly data subscriptions

Additional and Tailored Resources to Learn Maltego From 0 to 1

To help our users and customers get the most out of Maltego in the shortest time possible, our Training team has rolled out a series of learning resources and initiatives. Our Foundations 1, Foundations 2, and Advanced on-demand courses guide Maltego users all the way from onboarding to mastery. We also started a series of live customer upskilling webinars where users can learn directly from our experts, along with peers who share similar challenges and goals.

Our Subject Matter Experts have also released three Maltego handbooks which will guide our users to set up efficient playbooks with Maltego: The Maltego Handbook for Incident Response, Maltego Handbook for Cyber Threat Intelligence, and Maltego Handbook for Social Media Investigations.

Meeting Our Community Where They Are

As the world eases into a post-COVID-19 era, we at Maltego continue to treasure in-person interactions and opportunities with our community. We were excited to meet our supporters, customers, and users at conferences like BSides, RSA Conference, BotConf, Black Hat, and Underground Economy while having the pleasure to host some of our events in Munich as well as at our Headquarters. We also want to thank those who connected with us online through the 19 webinars hosted in 2022, our social media platforms, our new podcast, and emails.

OSINT for Good: Maltego Academic & Non-Profit Program

Empowering investigators worldwide to do good work is core to our values. In 2022, we have supported 55 academic institutions and 20 non-profit organizations as well as independent researchers with the Maltego Academic & Non-Profit Program. We are honored to be part of critical investigations and researches aimed at protecting the rights of asylum-seekers, analyzing terrorism, or getting behind disinformation campaigns. Working with partners like the National Child Protection Task Force, Anti-Human Trafficking Intelligence Initiative, Lighthouse Reports, UC Berkeley Human Rights Center, and ISD Global rewards motivates us every single day.

Applications to participate in the program open up every year in March. We absolutely look forward to more opportunities to be a valuable resource for your projects!

The Maltego Team Now Encircles The Globe

It goes without saying that the people behind Maltego are the drivers and reasons for our achievements and milestones. This year, we have grown to include 27 nationalities that come together from different corners of Europe, Asia, Africa, and North America. Not only is our diversity reflected in the 12 languages we speak, it also facilitates in-office as well as virtual cultural celebrations. Lunar New Years, Diwali, el Día de los Muertos, Halloween, Thanksgiving, Christmas – We enjoyed foods, music, and colors that took us around the globe.

Read more about the people and fun facts of Maltego and join our incredible team for a wilder adventure in 2023!

Looking Towards 2023 with A Strong Vision

We are absolutely excited about where our team takes us in 2023. With a very exciting roadmap ahead and a tech and product team led by Ben April, our Chief Technology Officer, we look forward to shipping features that bring more value to investigators around the globe. We want to thank all of you who have provided honest and helpful feedback and we cannot wait to march down the roadmap with your faith.

Thank You for Supporting Maltego in 2022!

That’s a wrap for 2022. We will continue to research and publish resources valuable for our investigator community and guide you through every step of the way to unleash the full power of Maltego.

Don’t miss any further developments by following us on Twitter and LinkedIn and signing up to our email newsletter!

That’s a wrap for 2022!

Investigative Journalism on Disinformation Campaigns: UC Berkeley Human Rights Center

Tue, 20 Dec 2022 15:21:16 +0000

On November 2nd, the Maltego Academic and Non-Profit Research Program had the great pleasure to host a webinar with guest speakers, Gisela Pérez de Acha and Stephanie Croft, from the Human Rights Center of UC Berkeley. They presented us with a very recent, interesting use case about how to identify and track misinformation and disinformation campaigns using Maltego.

The webinar discussed:

The definition and differences between misinformation and disinformation;
How to structure a story that starts with TikTok videos and manually plot it into Maltego
How to get the most information out of obscure tax registries and webpages

Unmasking Main Players Behind a Misinformation Network

The UC Berkeley Human Rights Center’s reporting focuses on tracking medical mis/disinformation regarding hormonal birth control. The investigation started after the overturning of Roe vs. Wade by the U.S. Supreme Court in June 2022. Misinformation and disinformation around birth control are not new, but, after the events in June, the topic gained mainstream traction among young TikTok, Instagram, and YouTube influencers.

What caught UC Berkeley’s attention was the very young age of the social media influencers participating in the spread of misinformation, and the fact that they are talking in a very knowledgeable, relatable manner about the misinformed topic – hormonal birth control. The misinformation campaign, fueled by the hypothesis that hormonal birth control causes abortions, moved eventually from an online context to offline public spaces.

The case study presented by Gisela and Stephanie is framed within the context of investigative report. The investigative team was very diverse, and the spectrum of experts consulted for the research included legal experts, scientists, computer scientists, and journalists, which provided a broad and enriching perspective for the report.

The researchers delved into how policymakers, health care systems, media, and key players come to face with this specific misinformation, and how these campaign messages lacked scientific basis. The goal of the research was also to identify how the misinformation campaigns were organized and funded.

Read the original research article published on MotherJones.

About UC Berkeley Human Rights Center

The Human Rights Center at the University of California, Berkeley, School of Law conducts research on war crimes and other serious violations of international humanitarian law and human rights. Using evidence-based methods and innovative technologies, they support efforts to hold perpetrators accountable and to protect vulnerable populations. They also train students and advocates to research, investigate, and document human rights violations and turn this information into effective action.

The Maltego Academic & Non-Profit Research Program

With the Maltego Academic and NGO program, Maltego aims to encourage continued innovation within the Maltego community. We empower highly motivated and talented individuals who can help create awareness of our tool and create user-based knowledge around Maltego in relevant and important topics.

Maltego supported UC Berkeley Human Rights Center as part of the Academic Program with the investigative resources required for this investigation.

A Quick Intro: Misinformation, Disinformation?

The American Psychological Association (APA) defines misinformation as “false or inaccurate information — getting the facts wrong” and disinformation as “false information that is deliberately intended to mislead — intentionally misstating the facts”. Misinformation can occur due to negligence and is deemed a natural occurrence.

On the other hand, disinformation is distinct in that it is intentional and fueled by a specific reason. The primary difference between the two is in the intent of the action. Disinformation is false information that is intended to mislead — by misstating, misleading, and attempting to propagandize.

To identify misinformation and disinformation, it is utterly important to:

Read beyond the headline. Most of the time the titles are catchy and impactful, but they don’t reflect the body of the news story, report, or research.
Check the sources and origin of the stories.
Dig deeper to gain a full understanding of the context.
Evaluate the evidence provided for statements of fact.
Investigate further with an information gathering tool like Maltego.

Scrolling Through A Disinformation Network on TikTok

UC Berkeley Human Rights Center’s investigation started with Tiktok videos to identify the organizations behind the disinformation campaign and to further research into where their funding came from.

Before we dive into the use case, let’s take a minute or two to learn more about influencers. What is an influencer?

Source: Merriam-Webster

Nowadays, taking into consideration the era in which we live, the dictionary definition of “influencer” is too vague. If you close your eyes and say “influencer” three times in a row, the visuals around your head will most likely include a tweeting bird, catchy choreography, or a lot of highly filtered photos. We associate influencers with social media platforms, unboxing videos, product placements, and giveaways.

So, what makes an influencer? Magnetic personality or good looks aside, influencers are characterized and categorized by these “following count” and “content” criteria:

Source: Types of Influencers

The research team identified a number of key TikTok and YouTube videos spreading such misinformation to start their analysis. Upon identifying influencers who seemed to be leading the campaign, they queried a social media intelligence data source and OpenCorporates in Maltego to gather information of the campaign actors behind the scenes. They also utilized public tax information to further dig into the target organizations’ structures and stakeholders, as well as academic articles as leads to broaden their research.

From the corporate research, the investigation pivoted to other social media accounts and organizations. By adding new pieces of information, Maltego started showing links between the actors they were looking at. At the end of their research, they discovered that the influencers spreading misinformation and a doctor mentioned in multiple academic articles were connected through an umbrella organization under the organizations behind the TikTok videos.

Watch the webinar now to see a step-by-step walkthrough of the investigation.

In Journalism, The Story Drives The Tools

Gisela and Stephanie shared that, as journalists, what they look for are stories. Stories like a social or policy problem, a story that can be explained or exemplified by a character, who represents one of many within the problem. What puts a story together is a mix between a research question and the methodology or approach a journalist employs to answer that question.

For Gisela and Stephanie, it is imperative that the story drives the tool, rather than the tool driving the story. However, the tool is crucial to achieving a goal in a timely and successful manner.

Gisela pointed out that being able to map information visually was extremely useful and important. They were a very large team that was working separately. But, when they merged of all the different pieces of information, the matches, links, and patterns were almost immediately visible.

Stephanie also highlighted that OpenCorporates and Maltego research techniques were useful for the classes she was teaching. These tools have proven to be helpful in the case of investigating pyramid schemes and a variety of other investigations.

What Journalists Look for in A Story

Gisela mentioned that there are many types of stories, but in disinformation stories, the editors want to see who the “ultimate creator” of the falsehood or conspiracy elements are, and who is financing these campaigns. The research team wanted to determine if the videos were a mere movement of teenagers on TikTok or if there was a bigger organization behind them, purposely making claims that cannot be validated by science. Their final Maltego graph plotted all the organizations, actors, and important details involved in this particular misinformation campaign. The investigation included DNS analysis of some of the web pages, but for privacy reasons, this information has been blurred. For the investigators, it was crucial to visualize how all the information from different research cells goes back to the source – a video on TikTok or YouTube.

How Much Of The Research Was OSINT

The investigation started in an online context as the misinformation campaign began among different social media platforms, and from there move to a different sphere. To locate the key actors behind the virtual content, the investigators had to dive into videos, posts, websites, and profiles to start the mapping of these campaigns, and find the connection between the virtual and the physical world. The investigators consider that 70-80% of the investigation was driven by OSINT and the rest was by contacting experts to triangulate sources as much as they could.

Methodology to Comb Through Mass Digital Evidence & Why They Use Maltego

After starting with an Alias entity and after a couple of clicks, the first graphic started to populate. As the research progressed, it began to pivot between corporate research, social media research and links with academia and other organizations. The advantage that the different cells of the research team found with Maltego was not only the speed with which they were able to locate the information, but by linking the multiple graphs they were working with, the patterns and connections between different areas became visible.

In this way, Maltego helped to structure how to get from point A to point Z, and it became easier and more obvious to identify valuable information for the research. In Gisela’s words, by mind-mapping your results you can go above and beyond the very basics of what you are seeing.

How They Fact-Check Conclusions

The research team had to make a lot of phone calls to double-check their sources. As they noted, the scientific context may be around the credibility of the journal, the process of how journals are peer-reviewed, who their panel members are, and what their processes are. The fact-check included how much the reviewers looked into the original data, how they ranked it and if there were citations from another articles. It is also really important to then go to the citations and then see whether that has been challenged.

It’s not just important to consider the possibility that this is scientific misinformation; you need also deliberately incorporate it into your reporting and research methods. This way, you won’t simply focus on one hot topic but will apply the same standards to all sources and viewpoints.

Ethical Approach in Journalism

This is a topic that has been discussed before in the previous Maltego Academic Webinar, “How Technology Changed Investigative Journalism.” The ethical standard in journalism is getting to the facts, checking your own biases, placing yourself constantly in the position of reporting against your own hypothesis, and asking the question “what if we’re wrong?”

We have to work under an ethical framework to maintain the integrity of what we do and that’s common across many fields of practice, and investigation practices and very interesting of course in the field of digital investigations.

Gisela Pérez de Acha

They recommended taking a look at the Berkeley Protocol on Digital Open Source Investigations, where there’s a chapter on ethics there that it’s worth checking out.

To learn more about investigative journalism, check out our other Academic Partner’s take on How Technology Changed Investigative Journalism.

In this episode of The Pivot podcast, Gisela also shared her personal experiences and challenges she encountered as a journalist. Check out the interview highlight here.

Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

Creating Sock Puppets for Your Investigations

Mon, 19 Dec 2022 12:07:02 +0000

Security within an Operation Starts with the Investigators

Sicherheit, securité, seguridad, ασφάλεια, sicurezza, veiligheids, safety. A word. A concept. It is a must in every aspect of our daily lives. It shouldn’t be different in the virtual realm.

The security of an operation starts with the investigator in charge. If the investigator does not have all their flanks covered with respect to their personal security, the other aspects (virtual, operational, strategic, and tactical) can be seriously compromised. One strategy to prevent this when we are performing OSINT investigations is by using a sock puppet.

Because prevention is the best protection, we at Maltego have made our Christmas list of must-have features for sock puppets when performing in-depth OSINT investigations. We want to share these with you and hope you can implement them to benefit your investigations in the near future.

Happy Holidays!

The 5 Levels and Types of Personal Data

The personal safety of the investigator involves, among many other things, shielding all data associated with his or her private life. To better visualize the kind of information that we should be protecting, we can talk about “spheres” or areas of our daily lives that may be breached.

What is personal data? It is any information that allows us to identify a natural person or make a person identifiable. Data can be of different types:

Personal Or Identifying Data: Name, surname, ID or NIE, social security number, address, telephone, date and place of birth, age, and marital status.
Social: Properties, hobbies and lifestyles, membership in forums, clubs or associations.
Family: Genealogical tree, names of parents, siblings, children, etc.
Economic-financial: Bank details, income, income, credits, loans, guarantees, pension plan, and retirement.
Medical or health: Medical history of the individual and health controls, among others.
Administrative: Administrative procedures, claims and appeals, sanctions, records, applications, and concessions.
Judicial: Judicial file or history, sanctions, and judicial procedures.
Social Services: Aid or subsidies, receipt of social assistance benefits, subsidies, and pensions.
Academic And Training: Academic record, training, and qualifications.
Professional And Employment: Experience in the professional world, the professional record of the worker, and positions they’ve occupied.

The list above is not exhaustive, but it provides a general overview of the types of data that make it possible to identify a person.

Why is it important to be aware of the types of data that can identify us? Because it is a two-way street, and we must take these into account to set up our sock puppet.

DIY – Your Own Sock Puppet

In Internet terms, sock puppets are online identities used for disguised activity by the operator. A sock puppet is defined as a person whose actions are controlled by another. It is a reference to the manipulation of a simple hand puppet made from a sock and is often used to refer to alternative online identities or user accounts created for the purpose of deception and operational security.

First And Foremost, We Must Cover Our Virtual Tracks

Before thinking about what our sock puppet’s favorite color would be, we need to make sure that all the data we attribute to our sock puppet can’t be tracked back to us. How?

Get A Burner Phone

The basic definition of a burner phone is that it is a device very limited in terms of features. It is only intended to make and receive calls anonymously, and it is disconnected from all networks.

For OSINT investigations, the phone must be connected to the Internet and be able to run apps, so we need a smartphone, basically. But how can we make burner smartphones safe?

It may sound obvious and sometimes excessive, but in the small details lies the success or failure of security strategies.

Purchase the phone in cash and in a physical store. Avoid any online shopping.
When you turn it on for the first time and during the time you are using it, do not carry personal devices. This is in case you are tracked, the disposable phone and your personal or work phone do not share the same location. You never know who is watching.
Do not enter email accounts related to your personal sphere.
Do not store any data related to your personal sphere (phones, emails, calendars, photos).
Use one gadget only per alias, preferably with an alternative operating system to the one you typically use.

Use a VPN

A VPN (Virtual Private Network) is the easiest and most effective way for people to protect their internet traffic and keep their online identities private. As you connect to a secure VPN server, your internet traffic goes through an encrypted tunnel that nobody can see into. Changing your IP address with a VPN helps shield your identity from websites, apps, and services that seek to track you. Good VPNs also prevent your internet provider, mobile carrier, and anyone else who may be listening from seeing your activity, thanks to a layer of strong encryption. Using a VPN changes your IP address (the unique number that identifies you and your location in the world). This new IP address will make you appear to be in the location you select when you connect: the UK, Germany, Canada, Japan, or virtually any country, provided the VPN service you choose hosts servers there.

Or… Use Tor

Short for the Onion Router, Tor is a powerful software browser that directs Internet traffic through thousands of relays to anonymize a user’s activity. It’s free to download and should be in conjunction with your alias.

Create New Emails

You’ll want a disposable email for each of your fake identities. Do you use Gmail or Proton? Choose the email provider based on the profile of the persona we are creating – whether it’s someone with extensive knowledge of online security or a simple commoner whose alias includes his birth year.

The Persona Background: Cover and Legend

Now that we have covered our online presence, we will delve into the intelligence jargon. We will have to apply two intelligence concepts that are essential in operational security when building an alternative identity for disguised activities: Cover and Legend.

The cover is the facade for the identity that our sock puppet will have attributed to it. Initially, it is composed of a name, an alias, a profile picture, and some of the data mentioned above.

The legend is all the background information that supports the cover. It is the heart of a cover and amounts to an entire artificial life history to “fool” even determined professionals. The legend describes who you are, why you are there, and what you are doing.

It is a very complex job to craft a good legend, but not impossible. Let’s look at how to build a legend that is suitably complex to outwit against even highly trained stalkers.

Drafting a Legend for Your Sock Puppet

You’ll need an alias – a false identity – to conceal a genuine one in the physical or digital worlds.

As prevention is the best protection, it is a matter of elaborating in detail the legend, the biography, and the new identity that the investigator assumes behind the sock puppet to protect it. That means spending a lot of time preparing the legend to support the cover.

Avoid loose ends
The whole story behind the identity we are creating must be coherent, and consistent, so as not to raise suspicions

Coverage includes having all these answers in mind.

Don’t use or reveal details about yourself. Even though it will be easier to remember by using our own data here and there, creating a sock puppet entails training our memory. Don’t ever use somebody else’s name. Instead, you can use a site like Fake Name Generator to get a new one according to your own settings.

The same goes for your profile picture. You might think, it will be very easy to use the photos from this person that I know a little bit about and we’re not friends at all. Don’t take that path. Instead, you can go to This Person Does Not Exist and refresh until an AI-created photo which aligns with your sock puppet profile pops up.

The personality of our new persona will depend on the type of investigation which you will be using the sock puppet for. After a thorough analysis of your needs, you will first fill in the blanks on the personal data listed in the first part of the blog (like we said, two-way street).

We must be consistent in the accounts we use on our burner phone. The objective is that our persona does not raise suspicions about its authenticity, as well as the aliases, accounts and associated profiles.

If you are going to take the research a step further and interact with other users, we must be aware that building the profiles will take more time. A credible profile should have followers, publications, and previous interactions. This type of profile requires consistent teamwork and the combination of other disposable accounts.

In any case, there are some aspects that you must keep in mind:

Don’t share your location
Don’t use these accounts to follow your personal accounts, nor the personal accounts of people from your private or professional sphere
Avoid posting photos of places you usually visit

Using your Sock Puppet

Your newly created profile is ready to use. Regardless of the type of OSINT we are going to perform (passive or active), it is extremely important that our puppet sock has some level of real activity in the virtual world. What kind of activity? How to manage multiple sock puppets at the same time? We will cover that in our next intel-delivery.

Attention to Detail is the Key to Safety

Some of the above points may seem exaggerated, or silly, but always remember that attention to detail is the key. Your safety is not only the safety of your colleagues and the operation, but includes protecting your family and friends.

We hope you find this article about creating sock puppets to ensure operational safety useful.

Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!

Until the next one and happy investigating!

About the Author

Daphnée Aguilar

The Pivot Podcast: Data Privacy Lawyer Turned Investigative Reporter with Gisela Pérez de Acha

Thu, 15 Dec 2022 08:34:51 +0000

In this episode for The Pivot podcast, we welcome our guest, Gisela Pérez de Acha!

Gisela is a human rights lawyer, an open source researcher at Berkeley Law’s Investigative Reporting Program and Human Rights Center, and a trainer at Amnesty International’s Digital Verification Corps, which is a global network of volunteers who fact-checks social media posts about war crimes and human rights violations. She reports on extremism and other topics for the Investigative Reporting Program with a focus on digital forensics and network analysis. She is also a cybersecurity expert and a digital safety trainer with PEN America.

In this episode of The Pivot, Gisela talks about the knowledge she gained from several OSINT investigations, which later led to her multi-career journey in journalism, investigative reporting, OSINT investigations, and more!

Listen to this podcast episode on Spotify, Apple Podcast, Google Podcast, or the Maltego YouTube channel!

The Pivot: Your New OSINT and Infosec Podcast

Where to Listen to The Pivot? 

Tell us a bit about yourself and what got you into this field?

Gisela: So my name is Gisela. I am 33 years old. I currently teach at UC Berkeley’s Graduate School of Journalism. I teach open source investigations and I work as an investigative reporter as well. I am currently a cybersecurity lawyer focusing on data privacy within law.

One of the things a lot of people ask me is – How did you get here? In essence, how a 33-year-old Mexican woman gets to change careers from law to journalism and investigative reporting, and then teach and manage large teams of students for investigative reporting.

One of the moments that really changed me was reading Donna Haraway’s book. For those who don’t know her, she is someone who wrote about cyborg Manifesto in the eighties. That book changed my life and my way of seeing the world, seeing myself, and seeing the internet. I truly believe that all of us are cyborgs. We are all data in the end, all our thoughts, our wants, our needs, our fears, our cravings, and our work.

How did you get into intelligence and open-source investigations?

Gisela: What made me get into open source investigations, in general, was the 2017 earthquake in Mexico City. It was September 19th, 2017. I will never forget that day. I was in my office on a Skype call.

At the time, it was like if all of a sudden the laws of gravity suspended and everything was shaking around me in a really scary way. I remember rushing outside because that’s what you do in Mexico. I have since learned that in other parts of the world, you don’t run outside. But Mexico City is actually built on top of a lake so the foundations are not very solid.

It was right after the 2016 elections. That was one of the first sort of natural catastrophes that came with a lot of misinformation. I remember my grandma sending me photos that were completely fake – of bridges collapsing or bridges that were broken –, and WhatsApp became such a vital tool for communicating because lines were down and electricity was down.

Me and a couple of friends got together and we actually started this crowdsourcing effort with over 500 volunteers to fact-check information. We did it so well that we became the primary source of acts in the middle of the emergency.

I realized the power of harnessing social media for fact-checking purposes and fact-gathering purposes. This then led to me quitting my career as a lawyer and then I applied to the graduate school of journalism at UC Berkeley and met the Human Rights Center.

I currently work with them and they have this amazing space – the Human Rights Center Investigations Lab with over a hundred students that speak 30 different languages. Mostly women, mostly people of color, which is incredible in the open space. In that moment I just knew that I had found my tribe and I knew that I had found my jam.

You’re doing training, journalism, research, OSINT investigations. What keeps you going?

Gisela: Firstly, I love what I do. I remember being very bored when I was a lawyer and the feeling of boredom slowly eats you alive.

Digital risk was something inherent in growing up in Mexico and that was something that I was always very interested in. I especially focus on topics surrounding women and young women and understanding technology better and leveraging technology better in a respectful and egalitarian way.

There are ways to be resilient and there are ways in which you can tackle these things and not burn out and be mindful about what you’re doing. But first, it is the love of the job.

Second is the mission of journalism, which is essentially tied to democracy. The third is I adore the people that I work with. I adore them all at the Human Rights Center and the Investigative Reporting Program. They are all incredible human beings and I learn something new every day.

Has there been anything crazy that you’ve gotten yourself into as a journalist?

Gisela: Definitely interviewing someone who’s accused of murdering two policemen because of an extremist ideology, and being manipulated by him.

For instance, in the interview, he was so flirty and he was so charming, and that was one of the craziest experiences I’ve ever had. In your head, there is this constant voice that is like, “Why is this man so nice if he’s accused to these horrible things?” But that’s when the journalistic practice comes in and you step back to seeit’s actually the context that matters.

Have you ever received backlash or threats due to your work?

Gisela: Yes definitely. Over the span of my career I have gotten rape and death threats because I’m a woman of color doing this work and especially, reporting in predominantly white supremacist spaces or denouncing Machismo in Mexico.

Online harassment is always a social sanction for breaking gender norms because what are we as women? What am I supposed to talk about on the internet? What am I allowed to talk about? Cooking, decoration, babies, fashion. As soon as you step out of those gender roles and discuss topics that have been predominantly discussed by men before, the backlash is simply an expected response.

But the really cool thing, and what I love about the work that I do with PEN America is that you learn strategies. There are like small little hacks that you can do. For example, I just tweet music when I’m getting horribly harassed or I start responding to my trolls with fluffy animals or puppies or cute GIFs or kittens.

I think the point is not retaliating with abuse because that will only get you further into the hole, but changing the tone and reaching out to the people that you love and to, my tribe, my community of investigative reporters or my community of feminist activists in Mexico or my Twitter followers.

Apart from just retaliating with fluffy animal pictures, how do you keep up your mental health while dealing with threats and trolls?

Gisela: First of all, therapy. Therapy is extremely crucial for anyone in this field of investigative reporting. Especially if you are a man listening. Go to therapy. I always tell my students: We’re not going to make it in this field unless we go to therapy. By therapy, I mean a space – a weekly space where I can just talk about how I feel and impact my emotions. I think that is essential for survival.

Even though I am a cyborg, I really try to connect with my body as much as possible, so eating well, drinking a lot of water, yoga, meditation. I work out every day. Every day I’m moving my body and taking – even if it’s just 30 minutes – conscious embodiment outside of the cyber space to just feel myself and be with myself and see how I feel.

Another little hack that I love for my mental health is that I sleep with my phone in the bathroom. The worst is to wake up and scroll first thing in the morning because it gets your nervous system into a place of urgency. I have an analog alarm clock and I wake up with that. I make coffee or tea, and then sit with myself, think about my dreams, my emotions, and then I turn my phone on.

What are your top 3 tools for investigations?

Gisela: I could have not been able to publish or fact check any of the story if it weren’t for Hunchly. Especially in the extremists space, a lot of these posts and webpages get taken down by extremists themselves or by social media companies. So we cannot live without Hunchly.

Then I use a lot of InVID. This is sort of like a reverse image search tool that lets you cut a video into screenshots for reverse image searching.

Thirdly, since we work across all types of languages – not only on extremism, but also on disinformation or the immigration story that we’re working on right now – the Google Translate browser plug-in is amazing because you just click one button and the Russian web page is all of a sudden in English. So, I think those would be my top three.

The director of the Human Rights Investigations Lab has this saying: Let the tools follow the story and not the story following the tools. Let the investigation lead you to the hat you’re going to wear.

It’s something we see happening quite often. A lot of investigators would throw their whole toolkit at a problem, hoping the solution would rise to the top.

Gisela: No, actually, I really couldn’t agree more with you because this is something that we see happening quite often. A lot of investigators will throw their whole toolkit at a problem, hoping to have a solution that kind of rises to the top.

But it doesn’t. Being specific about what you are, what you’re aiming for, a specific kind of result that you’re aiming for is probably more time-saving and less stressful than throwing the whole kitchen sink at a problem and expecting some sort of solution to suddenly show up out of the blue.

That’s where I really appreciate my editor, David Barstow. Recently, we were looking at all these flight tracking data. My colleague, Stephanie, and I were merging databases and throwing all our kitchens to get it. And the David was like, “Have you actually looked at the data with your own eyes?”

And I was like, “What do you mean?” He was like, “Yeah. Have you looked at the data to see if you can pick up patterns with your eyes?”

So I looked at the data with my eyes and it was so obvious. That was just a really good reminder – Use your brain. Just use your eyes and that’s usually the low-tech solution that ends up being the most efficient one.

What are some things you always tell someone in this field of work?

Gisela: Firstly, I always tell my students to read and devour anything you can about the topic that you’re investigating. A lot of the creative investigative processes come from simply borrowing all the books that you can on the topic. So I would definitely say reading is one of the three key things.

Second would be to do anything that makes you feel connected with your body whether that’s cooking or stretching or anything that is simply off-screen. It is especially important to relax and take care of yourself in this field of work.

Thirdly, build a community and be less isolated. It can be a very isolating job, even though there are strong online communities. We can’t burn out and we can’t quit. So in the end, that’s what will make you last longer and do your work better. And it’s where I get all my inspiration from. It’s a great mindset to have.

There’s More! Listen to Our Full Interview with Gisela!

If you find the snippets of the interview interesting, don’t miss the full interview!

Listen to our full interview with Gisela to learn more about:

How Gisela got into the world of OSINT and investigative reporting
Her experiences that she has gathered throughout the course of her career
How she works towards maintaining a balance between her work and her mental peace

And much more!

Listen to this podcast episode on Spotify, Apple Podcast, and Google Podcast and follow our podcast for future episodes!

Check out Gisela’s work on her Twitter!

Don’t forget to follow us on Twitter, LinkedIn, and YouTube, and subscribe to our email newsletter, so that you never miss an update, tutorial, or interview like this.

Happy investigating!

Maltego Blog RSS Feed

OSINT CTF Challenge Walkthroughs

From Open Sources to Answers

Name: Account Attribution – 1 | Category: SOMINT | 11 pts

Name: Account Attribution – 2 | Category: SOMINT | 5 pts

Name: Account Attribution – 3 | Category: SOMINT | 20 pts

Name: From the archives | Category: Cyber Threat Intel | 10 pts

Name: Whose Signature Is This? | Category: Cyber Threat Intel | 20 pts

Name: Domain Pivot | Category: Cyber Threat Intel | 15 pts

Name: Sail Away | Category: Geolocation | 15 pts

Name: Showboarting – 1 | Category: Maritime | 10 pts

Name: Showboarting – 2 | Category: Maritime | 10 pts

Name: Gone fishing – 1 | Category: Maritime | 20 pts

Name: Gone fishing – 2 | Category: Maritime | 18 pts

Name: Gone fishing – 3 | Category: Maritime | 15 pts

Name: Crude Oil – Port of Inspection | Category: Maritime | 20 pts

Name: Crude Oil – Managing Logistics | Category: Maritime | 22 pts

Name: Crude Oil – Inmarsat | Category: Maritime | 20 pts

Name: Crude Oil – EPIRB Hex ID | Category: Maritime | 20 pts

Name: Unknown Flight – 1 | Category: Aviation | 20 pts

Name: Unknown Flight – 2 | Category: Aviation | 10 pts

Name: Signal Decoding | Category: Aviation | 20 pts

Name: Lemon | Category: Vehicle | 10 pts

Name: A Bird’s Eye View – 1 | Category: GEOINT | 20 pts

Name: A Bird’s Eye View – 2 | Category: GEOINT | 15 pts

Name: Warning States | Category: GEOINT | 15 pts

Name: Bad Manners – 1 | Category: Vehicle | 30 pts

Name: Bad Manners – 2 | Category: Vehicle | 15 pts

Name: Major Tom | Category: Aviation | 25 pts

Conclusion

Tracing the Nexus Between Forced Scamming and Child Sextortion

Following the Digital Trail

Continuing the Investigation Using Maltego

Conclusion

Case Study: BASF Protects People, Brand, and Corporate Assets with Maltego

How Maltego Became Part of BASF’s Investigation Toolkit

Download the full case study to learn more about how BASF uses Maltego to:

Download the resource

How Maltego Shaped the Work of ItalianCyberTeam

Building a Methodology, Not Just Using a Tool

From Classroom to Operations: Real-World Intelligence Impact

References:

7 Practical OSINT Lessons from the Ukraine War

How Open-Source Intelligence Is Applied in Modern Warfare—and What Investigators Can Learn

Table of Contents

The First Digitally Transparent War

Lesson 1: Social Media Serves as the War’s Information Hub and Digital Battlefield

Download the Whitepaper

Download the resource

Cybersecurity as Strategic Security: How Investigative Platforms Must Evolve

Key Questions and Answers

Continuing Online Trade of Monitor Lizard Body Parts

An OSINT and Maltego Case Study from India

From Open Advertising to Concealed Networks

The Digital Thread: Pivoting Through Infrastructure

Geographic Spread: Not a Local Operation

The Human Layer Behind the Network

Maltego and Mercyhurst University’s CIRAT Collaborate on OSINT Challenge Development for Community CTF

February 4, 2026

The Future of OSINT

Analysts Are at an Inflection Point

Table of Contents

The Current State of OSINT

Why Predicting the Future is Difficult

Download the Whitepaper

Download the resource

17 Leadership Lessons from 17 Security Leaders

Introducing a New Investigation Platform: Maltego One

Born from Investigators’ Needs: The Story of How Maltego One Came to Be

Watch the Video Now!

Exposing Pig Butchering Operations with Maltego

Why Modern Person of Interest Investigations Struggle at Scale

Executive Summary

Table of Contents

Understanding Modern Person of Interest Investigations

The Complexity Slowing Down Today’s Cybercrime Units

The Systemic Hurdles Undermining Person of Interest Investigations

Why Addressing These Challenges Can’t Wait

Preparing for the Future of Person of Interest Investigations

Expert Insights by