Hunting Cyber Criminals

CHAPTER 2Investigations and Threat Actors

This chapter will focus on what it means to be a cyber investigator. We will delve into different types of researcher and investigator roles, some moral challenges you may be faced with, and different paths you may have to take in order to complete your research. This chapter will also provide an overview and introduction to the different threat actors and groups that will be discussed throughout this book.

Before we start, I would like to apologize for the literal sea of usernames and aliases that I will be dumping on you throughout this book. Some threat actors use different aliases on each forum or website, while the more experienced actors will intentionally use aliases belonging to other known hackers in the community. Also Known as “Alias‐Hijacking.” This can be incredibly frustrating and confusing, which is compounded by the fact that threat actors may even swap aliases within their group just to throw off investigators or law enforcement.

The Path of an Investigator

To quote Drax from Guardians of the Galaxy 2, “there are two types of people in this world. Those who dance, and those who do not.”

I feel like that is a pretty accurate summation for a fundamental question in how you conduct your investigations: do you want to get involved with the people and organizations you are investigating, or do you want to go Stealth mode and quietly observe?

Depending on your job, there is a good chance this answer will be provided to ...