Research Center

Malicious actors may lurk inside online forums to learn and share tactics. Some may even publish the compromised data of their victims on cybercrime-tolerant forums.

Looking into these online platforms may help law enforcement agencies and the cybersecurity community investigate threat actor behaviors and trace their activities.

Possibly one of the first public Internet armies, the Syrian Electronic Army is notorious for stealing user credentials to deface websites. Among their suspected victims are U.S. government websites, media outlets, PayPal, and eBay. Two of its members were indicted in 2018.¹

Monetary gain is a primary goal for almost any cybercriminal. And one of the ways they go about earning money without investing a dime is by stealing credit card details.¹ In fact, peddling stolen credit card numbers with their corresponding CVVs in underground markets can earn operators millions.²

VeriSign dubbed the Russian Business Network (RBN) as “the baddest of the bad”¹ in a report. And the fact that it played host to sites owned by the most notorious spammers, malware operators, phishers, distributed denial-of-service (DDoS) attackers, and other cybercriminals proved that.²

The cybersecurity community and law enforcement agencies have been tracking the activities of Iran-based hackers for quite some time now.

The Darkode Forum, which started operating in 2007, was taken down through a global effort in 2015.¹ But the community came back online in 2019.²

The Maze Ransomware Group announced in 2020 that it would shut down its operations after stealing and exposing sensitive data of several high-profile targets. But have they really ceased their operations?

Guccifer 2.0¹ is the person or group behind the now infamous Democratic National Committee (DNC) hack back in 2016.²