Intelonyx

Very much looking forward to presenting again at the @MachinaRecord annual #CyberIntelligence Summit in #Tokyo. I’ll discuss my DIME model for building #intelligence operations with a focus on infostealer logs, and why this source of signal rich data is critical to mitigate risk.

‼️As the prevalence of #pigbutchering scams increases, it's crucial to remember that anyone can be a target, regardless of their awareness or expertise. 👉🏽Recently, I encountered a concerning pattern: within a single day, I received five friend requests on one of my private social media accounts. These requests came from accounts with similar characteristics, all portraying individuals who appear to be avid travelers, sharing images of luxurious destinations and events. What caught my attention was that these accounts all featured images of the same person, suggesting a coordinated effort to deceive. 🚩Here are some red flags I noticed: 1️⃣All accounts were created within a 24 hour period in November 2023. 2️⃣The account names follow similar themes related to travel and exploration. 3️⃣Each account claims to reside in the same metropolis where I lived in the past. 4️⃣Friend requests were sent within a 24-hour period. 5️⃣Bios consist of generic one-liners about living life. 6️⃣Similar posting frequencies across all accounts. 7️⃣Comparable numbers of followers and accounts being followed across all accounts. 8️⃣All accounts have images of the same person in various “luxury” environments: sandy beaches, hotels, big cities. This appears to be an orchestrated approach and it signals a potential pig-butchering scam 👇🏼🧵 - In this case, the individual would try to engage me in a conversation about a topic of interest, likely the city where I live or lived, global travel and fancy destinations, about my work and other topics. - The individual would then try to get closer with moving the conversation to a more private and encrypted medium, such as #WhatsApp, #Signal or #Telegram. - They would then try to get even closer with intimate conversations about family and loved ones. - They would potentially share explicit images of themselves or ones that show their interest in me beyond friendship. - They would try to manipulate me by sharing their feelings about me, how much they like me and even longing to meet me in person. - They would share stories about the suffering they endured or the grief of losing someone, in order to establish the hook of emotional #manipulation. - Several weeks or even months later, they would discuss their amazing work in #crypto investments and share screenshots of their earnings. - They would tell me about this incredible opportunity where I would need to invest just a bit for big earnings. - Once they have that hook established, they would have me transfer money to what appears to be a legitimate #crypto investment interface and I would be psyched about my earnings. - Once they fattened me enough, it would be time to disengage and drain the money I’d invested because in reality I would have been transferring money not to a crypto exchange but to their #cryptowallets. #Beware, folks. Read the @intelonyx blogpost on #pigbutchering to learn more intelonyx.com/blog/f/digital…

Of course, this designation is unique in that it targets a pro ISIS cyber advisory group. But it is also expected given the group’s crypto fundraising and money remittance support — placing the individuals behind it in the crosshairs of countering terrorism financing (CTF) efforts.

For the longest time, Horizons regularly posted advisory on everything from using encrypted communications platforms (Telegram, Threema and others) to warning about using smart phones to using Signal instead of WhatsApp, to using VOIP and “virtual phone numbers” to create social media accounts.

Back in 2017, I wrote an article for @thecipherbrief titled “How Cyber Jihadists Protect their Identities and their Posts,” and I underscored Horizons’ role in this capacity: “[it] has published dozens of manuals on encryption, the dark web, mobile security applications, and other relevant topics in which most jihadists’ lack expertise. Although they cover a wide range of topics, all Horizons manuals serve the same purpose: promoting infosec tools and practices in an effort to protect jihadists.” thecipherbrief.com/column_ar…

US Treasury designates #ISIS cyber facilitators, including the founder and leader of Horizons Foundation, Mu’min Salim (and his partner - both Egyptian nationals). Horizons has for years provided cyber tutorials and advisory to ISIS and supporters on ways of avoiding detection and obfuscation, enhancing security posture and establishing crypto fundraising wallets. home.treasury.gov/news/press…

Sim-Swapping continues to be a major risk. darkreading.com/remote-workf…

🧵 Under US leadership and with coordination between more than a dozen law enforcement agencies, 311 child victims of sexual exploitation in cold cases were identified in a three-week operation known as “Operations Renewed Hope,” which started on July 17.

Informative report by @Europol on criminal networks in migrant smuggling and how it’s related to human trafficking and exploitation (such as sexual slavery). The report details the work and logistics that go into operating these criminal networks, the role of high and low ranking criminals in the network, and the tools they use. europol.europa.eu/publicatio…

#DOJ: first-ever criminal case involving an attack on a smart contract operated by a decentralized cryptocurrency exchange. This is quite notable.

Cooperation Between United States and Mexican Law Enforcement Leads to Significant Actions Against Transnational Drug Trafficking Organization “The operation resulted in the arrest of five people and the seizure of 120,000 fentanyl pills, 15 pounds of methamphetamine, 17 pounds of heroin, 15 pounds of cocaine, three assault rifles, one 9mm handgun, and a vehicle.” “In addition, seven U.S.-based coordinators and operators with alleged ties to the same drug-trafficking organization have been arrested and indicted in the United States.” justice.gov/opa/pr/cooperati…

With my comments for @AP on #Mali’s alarming demand that @UN_MINUSMA leave the country after a decade. @sammednick @Baba_A_ apnews.com/article/mali-un-p…

It was a great pleasure to deliver a keynote at the @MachinaRecord #CyberIntelligence Summit in #Tokyo. My talk was on my DIME model for building #intelligence operations, attended by public sector thought leaders and practitioners. Thank you again for the opportunity.

Thanks for the feature, @NewSchool_IA. Proud @NewSchoolAlumni blogs.newschool.edu/internat…

Ransomware Charges Unsealed Against Russian National “From as early as 2020, Matveev was an active member of Babuk, a global ransomware campaign which ranked among the most active and destructive cybercriminal threats in the world. Specifically, on April 26, 2021, the Babuk conspirators deployed Babuk ransomware against the Metropolitan Police Department in Washington, D.C. and then threatened to disclose sensitive information to the public unless a payment was made. “ justice.gov/usao-dc/pr/ranso…

The US gov disrupting “Snake” — one of the most notorious Russian malware that has targeted US and international companies and organizations too many times — is a huge tactical win. The Global malware network is 20 years old and has been used by Russian state hackers to collect information from hundreds of infected computers in dozens of countries. The FBI and other agencies worked for years to finally deal a heavy blow and disrupt this global network, with massive help from private sector intelligence companies and allied governments. This gives us some understanding of just how difficult it can be to disrupt state-actor’s cyber espionage campaigns. It also showcases the unwavering diligence of US agencies in tracking a disrupting malicious actors. It also reveals just how long some of these malware campaigns have been operational, but it might not tell us everything about the damage.

In an operation coordinated by @Europol and involving nine countries, law enforcement have seized the illegal dark web marketplace “Monopoly Market” and arrested 288 suspects involved in buying or selling drugs on the dark web. More than EUR 50.8 million (USD 53.4 million) in cash and virtual currencies, 850 kg of drugs, and 117 firearms were seized. The seized drugs include over 258 kg of amphetamines, 43 kg of cocaine, 43 kg of MDMA and over 10 kg of LSD and ecstasy pills. europol.europa.eu/media-pres…