The Top 3 Ways to Build a Threat Actor Profile

For drug traffickers, hackers, and other cybercriminals active on the deep and dark web, the most important thing is to remain anonymous. But when you are a popular vendor on the dark web, that can be easier said than done – especially with dark web monitoring methods that build threat actor profiles. 

Cybercriminals selling illicit goods and services such as drugs, databases, hacking, or carding services need to communicate with buyers and accept the currency for the goods. As a result, they often provide contact details such as emails, phones, wallet IDs, or handles in social networks for potential buyers to contact them.

Armed with this type of information of a specific cybercriminal, we can start to perform threat actor profiling. Threat actor profiling is a method of linking the identity of specific anonymous actors on the dark web through identifiers such as wallet ID, phone numbers, or an email address that are connected to the actor. Using this method, we can track the posts of these actors in different forums, marketplaces, or chats and gain a deeper picture of his overall activity, services, or products he offers, and more. We also deanonymize the actor identity, especially if some of the details reveal his social identity using 3rd party databases. 

In this post, we’ll show you the top three ways we use Webz’s Cyber API with its available filters and supported entities to build a profile of an anonymous actor.

Build a Threat Actor Profile Based on Contact Details

The first actor, who we’ll call Hades, offers different kinds of drugs and substances for sale on different forums both in the TOR network and outside of it. Since he is quite active on a number of channels and networks, we were able to build a threat actor profile for him. 

How? We searched extensively through millions of posts from hundreds of domains, servers, and channels and were able to link his handle name to different posts in several forums. We were then able to map all the domains where the actor advertises himself to reveal his illicit drug sales.

Here are the identifiers we found:

• Emails: [email protected], [email protected] 

• Phone numbers: +1(409) 242-0120

• Handles in forums: Hades1, Hades911, Hades, Hcook

• Handles in Telegram/Wickr: drHades

• Domains:  http://quickdocuments.online/ and http://worldglobalpharmacy.com/ are mentioned in a lot of his posts as a shop where his products are being sold.

We were able to then generate a list of the illicit substances and services Hades sells: 

• Heroin

• Cocaine

• Xanax

• Alprazolam

• Fentanyl

• Crystal Meth

• Morphine

• Oxycontin

• Weed, Cannabis, etc

• Ecstasy

• Ketamine

• Hacking services

• Hitman services

• Fake passports, IDs, drivers’ license

• And many more…