CYBOK 07 Threat Analysis and Hunting

1. Strategic Introduction: Why the Adversary Matters

Cyber security is far more than a technical battle of code and encryption; it is a complex socio-technical conflict rooted in human motivations and organized structures. Before the internet revolution, malicious activity required physical proximity, which naturally limited the reach of offenders. Today, technology has removed these physical barriers, allowing attackers to reach victims globally. To build a robust defense, a practitioner must move beyond simply understanding the "how" of an attack and instead analyze the "who" and the "why" behind the operation. This document explores adversarial behaviours through the study of malicious operations, taxonomies of attackers, and the analytical frameworks used to model and disrupt their actions. By understanding the motives and capabilities of the adversary, we transition from reactive patching to strategic defense.

Before analyzing specific groups, it is essential to distinguish between the two fundamental ways technology facilitates modern crime.

2. The Fundamental Divide: Cyber-Enabled vs. Cyber-Dependent Crime

The internet acts as a catalyst for illicit activity, either by transforming traditional offenses through increased reach or by providing the infrastructure for entirely new categories of crime.

Category	Definition	Examples
Cyber-Enabled Crimes	Traditional crimes (fraud, harassment, drug dealing) that have existed historically but are now increased in scale or reach through ICT.	Advance fee fraud (419 scams), romance scams, stalking, and drug trafficking via darknet markets.
Cyber-Dependent Crimes	Crimes that can only be committed using computers, computer networks, or other forms of information communication technology (ICT).	Ransomware, DDoS attacks, financial malware (Zeus), and unauthorized cryptocurrency mining.

The "So What?" Layer: Lowering the Barrier to Entry

The migration of criminal activity to the digital realm is driven by five core incentives identified by Clough: Reach, Cost, Speed, Transnationality, and Anonymity. These factors do not just increase efficiency; they fundamentally lower the "barrier to entry" for criminals. For example, while physical mail fraud requires postage and physical logistics, sending millions of phishing emails is virtually free. This allows non-technical criminals to purchase email lists and "phishing kits" on underground markets, enabling high-scale operations without the need for advanced technical skills.

This technical divide provides the essential foundation for categorizing the specific actors you will face in the field.

3. Profiles of the Opposition: A Taxonomy of Adversaries

Understanding an adversary's motivation, whether financial, political, or state-driven is critical for risk assessment and the strategic allocation of defensive resources.

Interpersonal and Small-Scale Offenders

These actors often engage in cyber-enabled crimes focusing on harassment. A key driver is the disinhibition effect, where anonymity and a lack of face-to-face contact cause individuals to act more maliciously than they would offline.

Cyberbullying and Doxing: This involves posting harmful material or publicly releasing a victim’s private information (e.g., home address) to facilitate "raids." The use of ephemeral platforms (e.g., 4chan) often emboldens these attackers by creating a sense of lack of consequence.
Cyberstalking: The use of digital means to monitor or pursue a victim : either mining their social media for real-world whereabouts, or harassing them purely online. Legislation such as the UK's Protection of Freedoms Act (2012) exists specifically to address it.
Sextortion and Predation: Criminals lure victims into performing sexual acts on camera to later extort them. The National Crime Agency (NCA) notes this as a rising threat requiring high public awareness.

Organized Criminal Enterprises

The landscape has shifted from "lone hackers" to a professionalized, commoditized ecosystem.

Financial Malware: Operations like Zeus and Torpig illustrate the scale of organized theft. Torpig, utilizing a "botnet-as-a-service" model, was once observed stealing 8,310 unique bank account credentials in a single ten-day period.
Ransomware and Cryptojacking: Ransomware is currently the "gold standard" for profit because it forces a high incentive to pay. Research has traced over 16 million USD in payments on the Bitcoin blockchain to ransomware campaigns. Conversely, unauthorized mining can be incredibly lucrative: one study showed criminals mining Monero via botnets earned 18 million USD over a two-year period, while browser-based "cryptojacking" scripts injected into compromised websites have earned campaigns tens of thousands of pounds in a single week.

Hacktivists vs. State Actors

Hacktivists: Groups like Anonymous use tools like the Low Orbit Ion Cannon (LOIC) for politically motivated DDoS attacks or data leaks (e.g., Wikileaks) to achieve ideological goals.
State Actors: These are sophisticated adversaries focused on sabotage, espionage, or disinformation. They use "zero-day" attacks—vulnerabilities unknown to the vendor—to ensure success. The Stuxnet worm remains the premier example, where a state-sponsored actor used multiple zero-days to physically sabotage centrifuges in a nuclear facility.

Regardless of motivation, these actors rely on a shared set of operational building blocks.

4. The Business of Malice: Elements of a Malicious Operation

Modern cybercrime functions as a professional industry with a specialized supply chain. An attack is rarely the work of one person; it is a flow of services between specialized providers.

The Interaction of the Supply Chain

A typical operation follows a structured flow:

Preparation: An affiliate joins a criminal Affiliate Programme, which provides the branding, payment processing, and "customer support" for the illicit goods.
Content & Delivery: The affiliate recruits Content Generation services to create convincing phishing emails and uses Black Hat SEO (search engine optimization) to push malicious pages to the top of search results. A common automated alternative needs no victim interaction at all: a drive-by download, where visiting a compromised page silently triggers an Exploit Kit that fingerprints the browser and delivers whichever malware matches a vulnerability it finds.
Infection: To scale the attack, the affiliate uses a Pay-Per-Install (PPI) service. The PPI operator maintains a botnet and charges a fee to install the affiliate’s malware on thousands of machines, with pricing that varies by the victim's country.
Infrastructure: The malware communicates with a Command and Control (C\&C) server hosted on Bulletproof Hosting, which ignores law enforcement takedown requests.
Monetization: Stolen funds are moved via Money Mules, who receive traceable wire transfers and convert them into untraceable formats like Western Union for the final criminal actor. Storefronts also accept credit cards (at inflated 10–20% fees to cover fraud risk) and, increasingly, cryptocurrencies — though blockchain payments remain traceable on-chain until cashed out.

Technical Precision: C\&C Resilience

To remain evasive, C\&C infrastructures employ two distinct techniques:

Fast Flux: The criminal rotates the IP addresses associated with a single domain name very quickly.
Domain Flux: The malware uses a Domain Generation Algorithm (DGA) to constantly rotate the domain names themselves, making it nearly impossible to block the "home" address of the malware.

The Economics of Scale

Defenders must realize that even "unsuccessful" attacks are profitable. In the Storm botnet case study, only 0.0004% of users reached by 469 million spam emails actually purchased the product. However, due to the near-zero cost of sending digital messages, the operation still generated millions in revenue.

5. Defensive Modeling: Thinking Like the Enemy

Practitioners use frameworks to identify "choke points" where an attack can be most cost-effectively disrupted.

Attack Trees

An Attack Tree provides a formal way to visualize system security.

Root Node: Represents the ultimate goal (e.g., "Steal Database").
Child Nodes: Represent sub-goals (e.g., "Exploit Web Vulnerability" or "Social Engineer Admin").
AND/OR Logic: "OR" nodes represent alternative paths to a goal; "AND" nodes represent steps that must all be completed for a specific sub-goal to succeed. By assigning "cost" or "likelihood" scores to these nodes, defenders can identify the easiest path for an attacker and secure it.

The Cyber Kill Chain

This models an attack in seven phases: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. To counter this, defenders apply the "5 Ds": Detect, Deny, Disrupt, Degrade, and Deceive.

The Flow of Capital Model

Thomas et al. model a cybercriminal operation as money circulating between two node types: Profit Centres, where victims inject new capital (e.g., buying counterfeit goods through a spam campaign), and Support Centres, the paid services - hosting, PPI, content generation - that consume it. Mapping this flow reveals that disrupting a single, widely-shared support centre (e.g., a bulletproof host) can starve multiple unrelated criminal operations at once.

Environmental Criminology

Routine Activity Theory: Crime occurs when a motivated offender, a suitable target, and a lack of a capable guardian converge. In security, an Intrusion Detection System (IDS) or a robust firewall acts as the "capable guardian" whose presence prevents the convergence.
Situational Crime Prevention: Focuses on making the crime harder (Firewalls), riskier (Vetting payment methods), and less rewarding (Blocking malicious search results).

The "So What?" Layer: The Arms Race

Security is a cycle of Adaptation and Displacement. If you block a specific IP, the attacker adapts using Fast Flux. If you secure one platform, the attacker displaces their activity to a less-regulated region. Defense is a continuous process of increasing the attacker's costs until the operation is no longer profitable.

6. Advanced Notes (For N3)

Attack Attribution is the most complex challenge in threat intelligence. It is rarely definitive because technical signals (IPs, code snippets) are easily faked.

The False Flag Problem: Sophisticated actors intentionally use "false flags" to mislead investigators. Notably, the Vault 7 leaks revealed that organizations like the CIA have collected exploits used by other nation-states specifically to make their own attacks appear as though they originated from a different country.
Rid’s Framework: To conduct professional attribution, you must analyze three layers:
Tactical: The "How" (specific code, exploits, and zero-days used).
Operational: The "What" (the high-level architecture and infrastructure patterns).
Strategic: The "Why" (the geopolitical motivation or ideological driver).

Beyond the Attack Tree: Attack trees only model a single target. Attack graphs extend the formalism to model multiple actors, vectors, and vulnerabilities at once, while attack nets provide a further formalism suited to large networked systems ; both are worth exploring once the basic tree logic is second nature.

Criminology's Other Lenses: Two further concepts refine the Environmental Criminology toolkit above. Rational choice theory treats an attacker's adaptation (e.g., picking a new bulletproof host after a takedown) as a rational cost-benefit decision, helping predict which displacement a criminal will choose next. Crime scripting : conceptually a cousin of the Kill Chain which decomposes an offence (e.g., a romance scam: fake profile > target selection > grooming > the ask) into its sequential steps to expose intervention points that a purely technical model might miss. Getting into the psychology of the offender.

7. Practitioner’s Toolkit: Starting Points & Quality Assurance

Starting Points for Exploration

CyBOK KA 07: Refer to the full Knowledge Area for the deep technical taxonomy.
MITRE ATT\&CK Framework: The industry standard for mapping adversarial tactics and techniques in real-time.
National Crime Agency (NCA): Excellent for case studies on contemporary cyber-enabled crimes like sextortion.

Points of Attention (Quality Check)

The following standards must be met when developing or evaluating any defensive strategy:

The plan must clearly distinguish between cyber-enabled (traditional) and cyber-dependent (technical) threats to ensure the correct law enforcement or technical resources are engaged.
The plan must identify the adversary’s primary motivation (Profit, Ideology, or State Interest) to accurately predict their persistence and likely next steps.
The plan must account for "Support Centres" (mules, hosting, and specialized services), focusing on disrupting the supply chain rather than just the infection vector.
The plan must utilize an Attack Tree or Kill Chain analysis to justify that the proposed intervention is at the most cost-effective and disruptive "choke point" possible.