CYBOK 07 Threat Analysis and Hunting

1. Strategic Introduction: Why the Adversary Matters

Cyber security is far more than a technical battle of code and encryption; it is a complex socio-technical conflict rooted in human motivations and organized structures. Before the internet revolution, malicious activity required physical proximity, which naturally limited the reach of offenders. Today, technology has removed these physical barriers, allowing attackers to reach victims globally. To build a robust defense, a practitioner must move beyond simply understanding the "how" of an attack and instead analyze the "who" and the "why" behind the operation. This document explores adversarial behaviours through the study of malicious operations, taxonomies of attackers, and the analytical frameworks used to model and disrupt their actions. By understanding the motives and capabilities of the adversary, we transition from reactive patching to strategic defense.

Before analyzing specific groups, it is essential to distinguish between the two fundamental ways technology facilitates modern crime.

2. The Fundamental Divide: Cyber-Enabled vs. Cyber-Dependent Crime

The internet acts as a catalyst for illicit activity, either by transforming traditional offenses through increased reach or by providing the infrastructure for entirely new categories of crime.

Category	Definition	Examples
Cyber-Enabled Crimes	Traditional crimes (fraud, harassment, drug dealing) that have existed historically but are now increased in scale or reach through ICT.	Advance fee fraud (419 scams), romance scams, stalking, and drug trafficking via darknet markets.
Cyber-Dependent Crimes	Crimes that can only be committed using computers, computer networks, or other forms of information communication technology (ICT).	Ransomware, DDoS attacks, financial malware (Zeus), and unauthorized cryptocurrency mining.

The "So What?" Layer: Lowering the Barrier to Entry

The migration of criminal activity to the digital realm is driven by five core incentives identified by Clough: Reach, Cost, Speed, Transnationality, and Anonymity. These factors do not just increase efficiency; they fundamentally lower the "barrier to entry" for criminals. For example, while physical mail fraud requires postage and physical logistics, sending millions of phishing emails is virtually free. This allows non-technical criminals to purchase email lists and "phishing kits" on underground markets, enabling high-scale operations without the need for advanced technical skills.

This technical divide provides the essential foundation for categorizing the specific actors you will face in the field.

3. Profiles of the Opposition: A Taxonomy of Adversaries

Understanding an adversary's motivation—whether financial, political, or state-driven—is critical for risk assessment and the strategic allocation of defensive resources.

Interpersonal and Small-Scale Offenders

These actors often engage in cyber-enabled crimes focusing on harassment. A key driver is the disinhibition effect, where anonymity and a lack of face-to-face contact cause individuals to act more maliciously than they would offline.

Cyberbullying and Doxing: This involves posting harmful material or publicly releasing a victim’s private information (e.g., home address) to facilitate "raids." The use of ephemeral platforms (e.g., 4chan) often emboldens these attackers by creating a sense of lack of consequence.
Sextortion and Predation: Criminals lure victims into performing sexual acts on camera to later extort them. The National Crime Agency (NCA) notes this as a rising threat requiring high public awareness.

Organized Criminal Enterprises

The landscape has shifted from "lone hackers" to a professionalized, commoditized ecosystem.

Financial Malware: Operations like Zeus and Torpig illustrate the scale of organized theft. Torpig, utilizing a "botnet-as-a-service" model, was once observed stealing 8,310 unique bank account credentials in a single ten-day period.
Ransomware and Cryptojacking: Ransomware is currently the "gold standard" for profit because it forces a high incentive to pay. Research has traced over 16 million USD** in payments on the Bitcoin blockchain to ransomware campaigns. Conversely, cryptojacking (unauthorized mining) can be incredibly lucrative; one study showed criminals mining Monero earned **18 million USD over a two-year period.

Hacktivists vs. State Actors

Hacktivists: Groups like Anonymous use tools like the Low Orbit Ion Cannon (LOIC) for politically motivated DDoS attacks or data leaks (e.g., Wikileaks) to achieve ideological goals.
State Actors: These are sophisticated adversaries focused on sabotage, espionage, or disinformation. They use "zero-day" attacks—vulnerabilities unknown to the vendor—to ensure success. The Stuxnet worm remains the premier example, where a state-sponsored actor used multiple zero-days to physically sabotage centrifuges in a nuclear facility.

Regardless of motivation, these actors rely on a shared set of operational building blocks.

4. The Business of Malice: Elements of a Malicious Operation

Modern cybercrime functions as a professional industry with a specialized supply chain. An attack is rarely the work of one person; it is a flow of services between specialized providers.

The Interaction of the Supply Chain

A typical operation follows a structured flow:

Preparation: An affiliate joins a criminal Affiliate Programme, which provides the branding, payment processing, and "customer support" for the illicit goods.
Content & Delivery: The affiliate recruits Content Generation services to create convincing phishing emails and uses Black Hat SEO to push malicious pages to the top of search results.
Infection: To scale the attack, the affiliate uses a Pay-Per-Install (PPI) service. The PPI operator maintains a botnet and charges a fee to install the affiliate’s malware on thousands of machines.
Infrastructure: The malware communicates with a Command and Control (C\&C) server hosted on Bulletproof Hosting, which ignores law enforcement takedown requests.
Monetization: Stolen funds are moved via Money Mules, who receive traceable wire transfers and convert them into untraceable formats like Western Union for the final criminal actor.

Technical Precision: C\&C Resilience

To remain evasive, C\&C infrastructures employ two distinct techniques:

Fast Flux: The criminal rotates the IP addresses associated with a single domain name very quickly.
Domain Flux: The malware uses a Domain Generation Algorithm (DGA) to constantly rotate the domain names themselves, making it nearly impossible to block the "home" address of the malware.

The Economics of Scale

Defenders must realize that even "unsuccessful" attacks are profitable. In the Storm botnet case study, only 0.0004% of users reached by 469 million spam emails actually purchased the product. However, due to the near-zero cost of sending digital messages, the operation still generated millions in revenue.

5. Defensive Modeling: Thinking Like the Enemy

Practitioners use frameworks to identify "choke points" where an attack can be most cost-effectively disrupted.

Attack Trees

An Attack Tree provides a formal way to visualize system security.

Root Node: Represents the ultimate goal (e.g., "Steal Database").
Child Nodes: Represent sub-goals (e.g., "Exploit Web Vulnerability" or "Social Engineer Admin").
AND/OR Logic: "OR" nodes represent alternative paths to a goal; "AND" nodes represent steps that must all be completed for a specific sub-goal to succeed. By assigning "cost" or "likelihood" scores to these nodes, defenders can identify the easiest path for an attacker and secure it.

The Cyber Kill Chain

This models an attack in seven phases: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. To counter this, defenders apply the "5 Ds": Detect, Deny, Disrupt, Degrade, and Deceive.

Environmental Criminology

Routine Activity Theory: Crime occurs when a motivated offender, a suitable target, and a lack of a capable guardian converge. In security, an Intrusion Detection System (IDS) or a robust firewall acts as the "capable guardian" whose presence prevents the convergence.
Situational Crime Prevention: Focuses on making the crime harder (Firewalls), riskier (Vetting payment methods), and less rewarding (Blocking malicious search results).

The "So What?" Layer: The Arms Race

Security is a cycle of Adaptation and Displacement. If you block a specific IP, the attacker adapts using Fast Flux. If you secure one platform, the attacker displaces their activity to a less-regulated region. Defense is a continuous process of increasing the attacker's costs until the operation is no longer profitable.

6. Advanced Notes (For 3rd/4th Year Students)

Attack Attribution is the most complex challenge in threat intelligence. It is rarely definitive because technical signals (IPs, code snippets) are easily faked.

The False Flag Problem: Sophisticated actors intentionally use "false flags" to mislead investigators. Notably, the Vault 7 leaks revealed that organizations like the CIA have collected exploits used by other nation-states specifically to make their own attacks appear as though they originated from a different country.
Rid’s Framework: To conduct professional attribution, you must analyze three layers:
Tactical: The "How" (specific code, exploits, and zero-days used).
Operational: The "What" (the high-level architecture and infrastructure patterns).
Strategic: The "Why" (the geopolitical motivation or ideological driver).

7. Practitioner’s Toolkit: Starting Points & Quality Assurance

Starting Points for Exploration

CyBOK KA 07: Refer to the full Knowledge Area for the deep technical taxonomy.
MITRE ATT\&CK Framework: The industry standard for mapping adversarial tactics and techniques in real-time.
National Crime Agency (NCA): Excellent for case studies on contemporary cyber-enabled crimes like sextortion.

Points of Attention (Quality Check)

The following standards must be met when developing or evaluating any defensive strategy:

The plan must clearly distinguish between cyber-enabled (traditional) and cyber-dependent (technical) threats to ensure the correct law enforcement or technical resources are engaged.
The plan must identify the adversary’s primary motivation (Profit, Ideology, or State Interest) to accurately predict their persistence and likely next steps.
The plan must account for "Support Centres" (mules, hosting, and specialized services), focusing on disrupting the supply chain rather than just the infection vector.
The plan must utilize an Attack Tree or Kill Chain analysis to justify that the proposed intervention is at the most cost-effective and disruptive "choke point" possible.