The Art of Concealment: How Cybercriminals are Becoming and Remaining Anonymous

The attribution of cybercrime remains one of the greatest challenges for investigators, largely due to the extensive concealment measures employed by threat actors. While much research focuses on tactics, techniques, and procedures (TTPs) used in the execution of cyberattacks, little attention has been given to the methods criminals use to hide their identities and activities. This session introduces CLOAK (Concealment Layers for Online Anonymity and Knowledge). Developed through the qualitative analysis of countless operational security guides from the clear and dark web, CLOAK catalogues more than 1,300 unique concealment TTPs spanning technical, behavioural, and physical domains. Attendees will gain new insights into the most common concealment practices, understand the limitations of current frameworks such as MITRE ATT&CK, and learn practical applications of CLOAK for intelligence, cybersecurity, and law enforcement.