Understanding modern warfare is not as easy as it used to be. The parameters of traditional espionage are no longer reliable either, having been integrated with cybercriminal activity within a complex spectrum found on the dark web. Isolated military networks are no longer the only means through which nation-state threat actors communicate.
As geopolitical tensions rise globally, those threat actors are increasingly finding a home on dark web sites that were once the exclusive domain of hackers and cybercriminals.
DarkOwl, a leading provider of threat actor profiling software, puts it this way: nation-state actors are now colonizing the dark web thanks to its anonymity and infrastructure resilience. They are taking advantage of the dark web’s ability to cover their tracks. Therefore, DarkOwl says that any government agencies or NGOs looking to protect themselves against high-level threats must come to terms with dark web geopolitics.
Colonizing the World of the Underground
It used to be that underground and state-sponsored groups – otherwise known as Advanced Persistent Threats (APTs) – existed on separate planes. The underground basically built and maintained the dark web while APTs preferred highly sophisticated tools and networks developed in-house. But the separation between the two groups has eroded significantly in recent years.
State actors have come to understand that they can benefit tremendously from dark web capabilities. For example, the dark web offers:
- Command and control stealth.
- More resilient communications.
- Plausible deniability.
- Commodity malware.
- Infrastructure outsourcing.
In essence, the dark web brings together the best for-profit hacking with state-sponsored espionage. It is a marriage that gives APTs an advantage in the cat-and-mouse game that is international espionage.
The Value of Threat Actor Profiles
To counter some of the advantages state-sponsored actors have by operating on the dark web, intelligence providers like DarkOwl move beyond simple indicators of compromise (IoCs). One of their newest and best tools is threat actor profiling data.
Threat actor profiling is a multi-dimensional discipline that gathers data from multiple sources and puts it together to create a comprehensive picture of a targeted individual or group. Threat actor profiles reveal a whole host of information, including:
- Preferred coding styles.
- Threat actor targeting logic.
- Operational time zones.
- Geographic locations.
- Preferred targets.
The information used to build threat actor profiles comes from darknet forums and chat rooms. It comes from leak sites and online marketplaces. By monitoring the dark web hangouts that attract state-sponsored actors, analysts can gather and analyze data that can help them predict where a nation-state might strike next.
Penetrating the Dark Web Shadows
Monitoring APT activity on the dark web is like penetrating shadows. It is not about nearly scanning for clues. It is about gathering information and interpreting it correctly. APTs are highly disciplined. They do not go out of their way to make a lot of noise. Therefore, investigators need to comb through mountains of data looking for small breadcrumbs:
- Supply chain data – Mentions of proprietary software or other tools used by government contractors are an indicator of something amiss.
- Recruiting efforts – Recruiting efforts aimed at technology specialists, linguists, etc. suggest a targeted individual or group is up to something.
- Cross-platform info – Linked information on multiple platforms, like a dark web forum and a publicly available Telegram channel, helps investigators better understand a target’s strategic intent.
The dark web is no longer the online location for stolen credit card data and malware developers. It has become a digital logistics hub for nation-states engaged in high-tech espionage and warfare. To pretend otherwise is to ignore the obvious. Threat actor profiling data proves as much.
