Looking to Hunt Cyber Criminals? Read this Book!
By: Michael Atkins
Tags: Cybercrime, Cybersecurity, Osint, Technology, Hacking

I’m often asked if there are any books I recommend for learning OSINT (Open Source Intelligence) and digital investigations.

If you’re looking to delve into the mindset and methodologies of a top cyber investigator and pick up some useful tools and techniques along the way, I can think of no better book than Hunting Cyber Criminals by Vinny Troia. It’s a good read for anyone looking to get into the field or wanting to expand their current investigative skill set.

The author Vinny Troia is an expert when it comes to hacking and cyber investigations. He has been tracking threat actors across the Internet for several years now and was responsible for the unmasking of one of the primary members of The Dark Overlord — a cyber criminal group that’s been stealing organizations’ data and selling them on the black market since 2016. The group is also known for terrorizing its victims with all kinds of threats and extorting them for money.

Vinny spent two years following The Dark Overlord and through his diligent efforts, uncovered 36 shared aliases used by its three core members: Chris Meunier, Dennis Karvouniaris, and Nathan Wyatt. Nathan Wyatt has since been arrested and extradited to the United States for trial.

What’s great about this book is that it takes us through a maze of deception spanning social media, black hat platforms to underground cybercrime markets. Moreover, you learn a lot along the way about network discovery methods, psychology, people searching, geolocating, data mining, and OSINT automation techniques.

Unlike other books that just give you a laundry list of tools, in Hunting Cyber Criminals, the author generously shares his arsenal of methods and the processes he uses to track down targets. I find this extremely beneficial as you get to learn a lot about the mental workflow and the “how” of getting from point A to point B in an investigation. Vinny also scatters gems of wisdom from dozens of other experts like John Strand, Lesley Carhart, and Troy Hunt, who provide personalized commentaries about their own real-world experiences that you’ll be hard pressed to find in other places.

As you dive into Vinny’s investigative journey, you’ll start to gain a better understanding and appreciation of the hacker mindset. Vinny describes himself as a “puzzle junkie”, who is relentless when it comes to finding answers to complex problems, even if it means sleepless nights awake in the morning cranking away at something. From my own personal experience, I find this attitude is key for professionals in cyber, since a lot of the work we do is troubleshooting and solving problems, often which involves serious grokking of how a system works from its computer networks to its social networking components.

You see this all the time in both offensive and defensive cybersecurity. For instance, offensive cyber is about taking a system, understanding its rules, and then figuring out all the different ways to circumvent those rules. Defensive cyber is basically the same, except now you have the extra burden of having to understand the mindset of your potential adversaries coupled with all the possible ways to circumvent them.

Another part of the book I really appreciate is its pragmatic approach to explaining crypto currencies. Most books tend to focus their discussion on how a specific crypto currency’s value is going to the moon and all the technical wonders of distributed blockchain technology. What I like about Hunting Cyber Criminals, is that the book focuses on the investigative aspects of crypto currencies and how they’re being used in economic transactions for scams and cybercrime markets on the Darknet. As a cyber investigator, knowing how to trace crypto currency transactions to find out which entities own which wallets is vital to tracking people in the online underground.

As you read through the book, one thing you will pick up on quickly is that digital investigations can be remarkably similar to those in the offline world. Real investigations are often dirty since you’re constantly having to build a web of aliases and deep cover stories for each. To gain high fidelity threat Intel, you must actively work your way into your target cybercrime group as a trusted insider, so you can gather all the details you need for your case.

Through direct communications with your target, you gain valuable intelligence on their modus operandi and internal structures. But be aware, the people you will be collaborating with usually value money over moral or legal boundaries and they expect you to do the same. If you don’t play the game, you’ll be discovered immediately as an investigator and outed on the spot. Expect to be tested. Cybercrime groups are just like real world drug gangs that make everyone involved partake in the drugs to try and sniff out any feds in their midst.

One of the most valuable lessons this book shows us is that patience is the most important ingredient for any digital investigation. If you’re patient and resolved, your target will eventually slip up at some point and reveal some of their vulnerabilities.

A good investigator recognizes when this happens and immediately latches on. Cyber criminals often give away clues about their identities simply out of fear and self-preservation. This is exactly what ends up happening towards the end of Vinny’s own investigative marathon in Hunting Cyber Criminals.

The 3 Takeaways

There are three main takeaways Vinny reveals in his book when it comes to cyber investigations. The first takeaway is that vanity always trumps OPSEC (Operational Security). Cyber practitioners spend huge amounts of time learning and perfecting their craft. They work hard to earn respect among their community of peers, which is an undeniable part of the lifestyle.

What’s interesting is that this holds true whether you’re on the right side or wrong side of the law. It doesn’t matter if you’re a script kiddie or a seasoned professional. It’s hard not to like receiving attention and recognition for all the hard work you’ve been doing — for good or for bad. It’s particularly difficult for young aspiring hackers who have just begun engaging in cybercrime to avoid bragging about their exploits online. In general, this group tends to be more willing to vocalize their activities to journalists for the attention, fame, and notoriety they’re hoping to gain — although such attention doesn’t always work out in their favor.

The second takeaway in the book is that the foundation of any successful investigation is having access to a deep, rich pool of historical data. Let’s face it, the nature of the internet is that identifiers like domain names and IP addresses inevitably change over time. If you’re only researching current data, you’re guaranteed to miss clues. Especially if your cybercrime target is actively cleaning up their past and trying to hide their tracks with disinformation.

The good news is that most people do leave trails of activities often going back years. It’s highly unlikely you were practicing any form of operational security when you first started out on the Internet or when you first began learning about hacking. When you begin to piece this historical data together, you can contend with even the most skilled researchers out there.

However, you must bear in mind that access to historical data is not always free and sometimes you will need to pay for premium data sets if you want to get historical stuff like website registrations and their snapshots over time. When you do stumble across things like private pictures or messages, make sure to keep meticulous notes for future referencing, since the data might not be there later when you need it.

The third and final takeaway is to never rely on a single tool or technique to obtain answers to the questions you’re seeking. You never know when you might get lucky with outdated tools that have never produced good results in the past. Just because a specific technique didn’t yield any results in one investigation, doesn’t mean it won’t in another. Always be on the lookout for anything useful from recycled profile icons to usernames. They can be valuable pieces of the puzzle in an investigation. Exhaust everything at your disposal so you can draw out more Intel and get a more complete picture of your target.

One thing we can all probably agree on is that cybercrime pays very well and there is no shortage of threat actors engaging in cyber-criminal activity. Building a meaningful operation requires enlisting a team of people to work with you, and this requires trust. Trust is most vulnerable when stakes and emotions run high, regardless of which side of the fence you’re on. Jealousy, betrayal, and feuds happen even within black hat circles, often leading to their downfall. A good cyber investigator is ready to pounce when such scenarios presents themselves.

There was one aspect that didn’t make it into the book that I wish was included. It would have been nice if the author offered advice for younger kids trying to learn about the world of cyber. Oftentimes it’s the black hat communities who become their gateways into the field, which usually ends up leading them down the path of the dark side and getting them involved in serious criminal activities.

I believe mentorship, both formal and informal, is a must to help steer people in the right direction towards creative productivity rather than creative thievery and destruction.

Cyber criminals are constantly raising the bar and conducting ever more egregious cybercrimes. As cyber investigators, we must also raise the bar by adapting our tradecraft accordingly. Hunting Cyber Criminals reveals a lot of sources and methods that can help us do just that.

At the end of the day, it’s a cat and mouse game with no end in sight. It’s up to us to be ready when duty calls.

Good Hunting!