ICQ is fragmented based on origin, illicit activity Some private rooms have flashes of discussions, but most rooms should be understood as streams of publicity. This means that social profiling, and identification of participants is unlikely, if relying only on public messages on chat rooms. Yes, malicious actors may share whom they have hacked they will not post tips about how they managed to do it, unfortunately. With the majority of communications being about the products and services, there is little room on ICQ for personal discussions, or even discussions of tactics and methods. This can help build a risk profile for institutions to understand if they, or their industry, is under sustained attack. It is possible to find mentions of CVE, institutions that have been hacked and to predict who is currently most targeted. This is very valuable information to draw statistics on whom is targeted by malicious actors, and how that evolves through time. They do not provide any information about who the malicious actor is, but leaves little doubt about who their target is. These messages are short, direct, to the point. Most messages on chat rooms are for products and services for sale, or products and services that are needed.
Chat rooms therefore provide more specific information that is not found anywhere else. This means that they rarely post actionable intelligence. On the dark web, malicious actors are able to build credible profiles, and to share links to their reputation score and past activity. This can be a screenshot that often contains the name of the victim, its account number and institution. They must provide proof, evidence of their crime. ICQ makes it decidedly difficult to find past messages of a user.Īs a result, malicious actors cannot simply claim to “have hacked into the backend of a company” to find business partners willing to purchase the data they stole. Malicious actors are unable to create profiles on ICQ, and to establish their credibility through a history of messages. Perhaps one of their most valuable roles is their ability to source actionable intelligence on victims. ICQ is a provider of actionable intelligence
Bots that are not configured to join new chat rooms automatically will be left behind, and unable to collect messages from the ongoing conversations. Actors will announce that they are moving to a new channel, often adding v2, v3, v4… to the name of their channels. Joining these rooms requires infiltration, and the creation of fake, credible online profiles.įinally, malicious actors tend to move from one channel to another regularly. Instead, users must find links to chat rooms, and click on them to join the rooms.Īnother challenge is that many chat rooms are private, meaning moderators must accept new join requests.
Finding these chat rooms is difficult because ICQ does not offer a universal search engine. Some are extremely large, while others only have a few dozen members. There are thousands of chat rooms involved in various criminal activities. Chat rooms can be public or private, and share text as well as images, videos, files and audio recordings.Ĭhannel hopping makes it difficult to keep track of the criminal underground ICQ also has chat rooms where up to thousands of participants converge. ICQ provides the ability to search for participants by name, and to exchange private messages. ICQ participants operate therefore with a certain sense of anonymity, and impunity. Being hosted in Russia, Western law enforcement receive little to no cooperation from its operators when sending mutual legal assistance treaty (MLAT) letters, and warrants. The network went underground for a number of years, and was resuscitated by a Russian company. I used ICQ back in the 1990s during my high school years to keep in touch with my friends. For the benefit of our demonstration, we will use the ICQ network. The aim of this blog post is to help you get a better grasp as to how chat rooms are used, and why your company should pay attention to them.
There is still much uncertainty around what these chat rooms are, and are not. These communities have however been the target of several police operations and, coupled with the technical challenges of using the dark web, there have been growing signs that the most dynamic communities are now hosted on chat rooms on Discord, Telegram and ICQ. The dark web is host to many dynamic malicious actor communities. Our years of monitoring the dark web have helped better understand what it is, and most importantly, is not. Over the past decade, the dark web has attracted much of the attention in the security field as the premier source of threats for companies.
0 kommentar(er)
