23: Drawing value from cyber threat intelligence on Studio 471 with Kobe Shwartz, Signify

Many countries have retired checks as a financial instrument, but billions of checks are still written every year in the U.S. This has proved to be a boon to fraudsters. There is an entire underground industry dedicated to stealing and fabricating checks that is not slowing down and is tricky to combat. Often, images of stolen checks are posted on Telegram and offered for sale to other fraudsters. In this Studio 471, Eric Huber, who is Cybercrime Research Leader at TD Bank, discusses why check fraud is such a huge problem and how financial institutions can counter it. Huber is the curator of the Fraudster Glossary, which is an index of terms used on cybercrime forums. Participants: Eric Huber, Cybercrime Research Leader, TD Bank Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!

Cyber deception involves various techniques to manipulate adversaries, whether it’s baiting them with fake resources or trapping them in frustrating loops. Tim Pappa is a former FBI supervisory special agent who specializes in deception techniques. In this Studio 471, Tim discusses what kinds of threat intelligence can be gained from deception techniques, its limitations, the Bell-Whaley framework and how organizations can start their own scalable deception programs. Participants: Tim Pappa, Incident Response Engineer - Cyber Deception Strategy, Content Development and Marketing, Walmart Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!

Over last several years, clusters of English-speaking threat actors have conducted data breaches on a wide scale. These groups come from an online community known as Com or Community. In the beginning, these threat actors mostly focused mostly on harassing each other, stealing short usernames, cryptocurrency and cheating at games. But then they transitioned into serious data theft, extortion and ransomware. They’ve been intensely investigated by private companies and law enforcement, which have collaborated together to uncover some of their real-world identities and resulted in arrests. In this Studio 471, Michael Fletcher, a former Cybercrime Technical Analyst with the Australian Federal Police, describes the origins of The Com, the tactics used by these threat actors and why they pose a threat to organizations. Participants: Michael Fletcher, former Cybercrime Technical Analyst, Australian Federal Police Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!

Telegram has emerged as a significant platform for cybercriminal activity. Threat actors offer goods and services ranging from payment card details to login credentials to malware and other hacking tools. This ecosystem is vast, and it’s challenging to track. Sayak Saha Roy is an assistant professor at Louisiana State University working on online fraud prevention and usable security. He and several colleagues presented a paper at the Usenix Security Symposium in August 2025 titled “DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram.” The paper describes how the researchers used a language model to identify cybercrime-related posts on Telegram channels with a high degree of accuracy. In this Studio 471, Roy describes how it can be used for cyber threat intelligence research, moderation and more. Participants: Sayak Saha Roy, Assistant Professor at Louisiana State University, Online Fraud Prevention and Usable Security Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!

Jacob Larsen was involuntarily pulled into the dark world of doxing, which is the practice of publishing sensitive personal information about someone online with the intent of intimidating, harassing or extorting them. Larsen’s assailants wanted him to turn over a short username he held for an online game. He refused to be extorted and instead began studying doxing in his free time and even interviewed threat actors who run Doxbin, one of the most prominent doxing sites. In this Studio 471, Larsen discusses the effects of doxing, how sites like Doxbin take advantage of legal loopholes and how to defend against being doxed. Participants: Jacob Larsen, Threat Researcher, Offensive Security Lead, CyberCX Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!