FOR589: Cybercrime Investigations

Overview

Section one provides the critical foundation for conducting secure, ethical, and effective cybercrime investigations. Students are introduced to the cybercrime intelligence cycle, where they learn to define Priority Intelligence Requirements (PIRs), build defensible collection plans, and assess risk before taking investigative action.

You'll explore what separates information from intelligence, how to turn raw data into finished intel (FINTEL), and how to apply frameworks to cybercrime campaign analysis. The section also covers how to evaluate vendor intelligence platforms, interpret breach data, and structure digital dossiers on adversaries.

A significant focus is placed on operational security (OPSEC). Students will model their own digital tradecraft to avoid becoming the investigated while investigating—covering VPN usage, browser fingerprinting, network obfuscation, persona design, and sock puppet creation. Real-world OPSEC failures, including case studies from AlphaBay and Fractal ID, are analyzed to reinforce lessons learned.

Hands-on labs walk students through configuring their investigative workstations, building online personas, performing password pivoting using breach data, and analyzing social and infrastructure links with Maltego. Students also create a cryptocurrency wallet to support future controlled buys or underground engagement, laying the groundwork for the capstone exercise in Section 5.

This section ensures students are not only collecting intelligence safely, but doing so with structure, legality, and purpose—ready to support their organization or agency in high-stakes environments.

Full Topic Details

• Intelligence Fundamentals & Structured Analysis
• Collection Planning & Cybercrime Requirements
• Cyberattack Profiling using Industry Frameworks
• Operational Security: Defense-in-Depth Modeling
• Persona Development & Sock Puppet Management
• Tools for Attribution: Password Pivots, Wallet Analysis, and Forums

Full Lab Details

• Configure your investigative VM and test OPSEC tooling
• Use breached data and password pivoting to track actors
• Safely create and maintain long-term sock puppet accounts
• Perform visual link analysis with Maltego and digital dossiers
• Create and secure a cryptocurrency wallet for underground use

Overview

Section two dives deep into the blockchain-backed financial systems cybercriminals rely on to move, launder, and obscure illicit gains. Students will learn to map and decode cryptocurrency transactions, identify laundering patterns, and attribute wallets to real-world threat actors through a combination of on-chain and off-chain analysis.

Beginning with blockchain fundamentals, students will understand both the UTXO-based model (Bitcoin) and account-based model (Ethereum), enabling precise transaction analysis. Using heuristics such as round numbers, input/output patterns, and known entity clustering, students will perform wallet clustering and change analysis to trace funds through complex laundering schemes. These techniques are especially critical in ransomware and infostealer investigations, where tracing payments may lead to actor attribution or even asset recovery.

The section also introduces students to mixers, CoinJoins, chain hopping, and peel chains, exploring how criminals attempt to obscure transactions—and how investigators can still track them. Case studies from the Bitfinex hack, DarkSide ransomware, and scam campaigns will help bring these concepts into practical focus.

Students will utilize tools like Chainalysis Reactor for advanced clustering and exposure analysis, while learning how to enrich on-chain data with KYC records, sanctions designations, and OSINT. A strong emphasis is placed on turning blockchain data into FININT—financial intelligence that can inform incident response, strategic decisions, and legal action.

Each lab offers hands-on, realistic practice in tracing cybercriminal transactions, profiling laundering behavior, and uncovering infrastructure linked to criminal organizations. By the end of this section, students will be equipped to follow illicit cryptocurrency flows with confidence, support attribution, and assist in dismantling financially-motivated cybercrime operations.

Full Topic Details

• Fundamentals of blockchain and cryptocurrency tracing
• UTXO and account-based models (Bitcoin, Ethereum)
• Wallet clustering, change analysis, and transaction heuristics
• Tracing obfuscation methods: mixers, CoinJoins, chain hopping, peel chains
• Attribution using OSINT, KYC, sanctions data, and wallet fingerprinting
• Analysis of laundering tactics in real-world ransomware and cybercrime campaigns
• Blockchain FININT: Turning transaction data into strategic and tactical intelligence

Full Lab Details

• Explore the Bitcoin Genesis Block and foundational transaction models (UTXO)
• Analyze high-profile Twitter crypto scams using heuristics and wallet fingerprinting
• Profile bulletproof hosting providers by tracing their cryptocurrency activity
• Follow laundering techniques from the Bitfinex hack using advanced blockchain analysis
• Track the Colonial Pipeline ransomware payment and investigate the DarkSide affiliate

Overview

Section three takes students deep into the operational environments where cybercriminals collaborate, transact, and conduct business. You’ll learn to safely explore and investigate forums, marketplaces, extortion sites, encrypted messaging apps, and infrastructure nodes used by actors to buy and sell access, malware, credentials, and illicit services.

This section teaches you how to profile underground communities, understand forum structures, identify moderators, and spot overlaps between actors and platforms. You'll explore how ransomware groups recruit affiliates, how initial access brokers monetize network access, and how infostealer logs and marketplace transactions expose both threat actors and victims.

Students will investigate how cybercriminals host infrastructure—using services like bulletproof VPS providers, registrars, and mixers—and trace their financial and technical footprints. You’ll use tools like Shodan, URLscan, and Maltego to pivot from domains and IPs, build attacker infrastructure profiles, and correlate IOCs with campaign data from public and commercial platforms.

By building digital dossiers on threat actors, students will learn how to identify usernames, cryptocurrency wallets, and behavioral patterns that form a unique signature across forums, markets, and leak sites. You’ll also study adversary social networks and identify trusted relationships, vouching behavior, and reputation systems used by underground actors.

Ransomware victimology is a key focus, with students tracing victim data across extortion blogs, infostealer logs, and credential markets. Frameworks like MITRE ATT&CK and the Diamond Model are used to help students categorize, assess, and predict adversary behavior and campaign evolution.

By the end of this section, students will be equipped to map the criminal economy, track adversaries over time, and analyze infrastructure and victim data with precision—skills critical for any cybercrime investigator or intelligence analyst.

Full Topic Details

• Profiling forums, marketplaces, ransomware leak sites, and messaging apps
• Understanding the roles of initial access brokers, ransomware affiliates, malware developers, and cybercrime forum members
• Investigating cybercrime infrastructure using profiling techniques
• Identifying victims across markets, extortion sites, and infostealer logs
• Mapping capabilities using frameworks like MITRE ATT&CK and the Diamond Model
• Uncovering identifiers (usernames, passwords, emails, wallets) and behavioral patterns
• Profiling malware, phishing, and exploit services offered in the underground
• Investigating and mapping ransomware victimology and campaign activity
• Understanding adversary tradecraft, criminal ecosystems, and infrastructure reuse

Full Lab Details

• Identify and enumerate cybercrime forums, marketplaces, and leak sites
• Investigate and pivot off adversary infrastructure using OSINT tools
• Profile an underground actor by building a digital dossier from forum activity
• Map capabilities and malware services using ATT&CK and open-source intelligence
• Investigate ransomware campaigns, victims, and exposure through real-world cases

Overview

Section four provides students with the skills to safely and strategically enter the cybercriminal underground, establish a trusted presence, and collect intelligence directly from adversaries. From building long-term sock puppets to deploying automated scrapers, this section blends human and technical collection tradecraft to deliver real investigative value.

Students will begin with operational planning and OPSEC, learning how to manage attribution risks and comply with legal boundaries. You’ll explore how cybercriminal forums and marketplaces operate—what it takes to gain access, how to engage safely, and how to identify gatekeeping mechanisms like invite-only referrals, entry fees, and application processes.

Once inside, students will learn to blend in, engage, and extract. HUMINT tradecraft is introduced with emphasis on elicitation tactics, engagement strategies, and persona development. Students will practice spotting and assessing sources, evaluating their placement, access, reliability, and behavioral cues using frameworks like the Admiralty Code and MITRE Engage.

In tandem with human collection, students will explore the use of web scrapers to automate dark web data collection, analyzing patterns in ransomware operations, access sales, and criminal services. Using Kibana, students will visualize cybercrime datasets, pivot on keywords and actor names, and generate actionable dashboards to support attribution or countermeasures.

The section culminates with mapping HUMINT collections to strategic outcomes—whether it's exposing infrastructure, enabling law enforcement takedowns, or preempting ransomware deployments. By bridging technical automation with human engagement, students gain a comprehensive toolkit for infiltrating, investigating, and influencing the underground.

Full Topic Details

• Persona creation and maintaining access in cybercriminal communities
• Navigating underground forums, marketplaces, and encrypted chats
• HUMINT collection: spotting, assessing, targeting, and profiling sources
• Social engineering and elicitation tradecraft in cybercrime investigations
• Automating dark web data collection using scrapers and evasion tactics
• Visualizing and analyzing cybercrime trends in Kibana
• Attribution and disruption strategies for threat actors and infrastructure

Full Lab Details

• Create and operationalize a sock puppet persona to access closed forums
• Map forum access requirements and identify influential threat actors
• Build and deploy a Tor-based scraper; analyze data in Kibana dashboards
• Profile cybercriminals using structured targeting frameworks
• Apply HUMINT tradecraft to elicit adversary insights and assess credibility

Overview

Students will be presented with a simulated investigation involving a fully interactive cybercrime forum. They will have to analyze posts and profiles from the forums, as well as leaked private chat logs and seized databases. There will also be a fictional blockchain ledger that students will use to trace transactions and track threat actors and various types of activities. Students will have to think about how to fulfil intelligence requirements of law enforcement and through a supporting CTI perspective, using the data sets provided that emulate real-world scenarios. Students will be placed in teams and will need to present their findings on what their investigation uncovered, including the steps taken, what they collected, processed, analyzed, and how it can be exploited.