16: Extracting Useful Cyber Threat Intelligence from Underground Markets | Studio 471

Many countries have retired checks as a financial instrument, but billions of checks are still written every year in the U.S. This has proved to be a boon to fraudsters. There is an entire underground industry dedicated to stealing and fabricating checks that is not slowing down and is tricky to combat. Often, images of stolen checks are posted on Telegram and offered for sale to other fraudsters. In this Studio 471, Eric Huber, who is Cybercrime Research Leader at TD Bank, discusses why check fraud is such a huge problem and how financial institutions can counter it. Huber is the curator of the Fraudster Glossary, which is an index of terms used on cybercrime forums. Participants: Eric Huber, Cybercrime Research Leader, TD Bank Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!

Cyber deception involves various techniques to manipulate adversaries, whether it’s baiting them with fake resources or trapping them in frustrating loops. Tim Pappa is a former FBI supervisory special agent who specializes in deception techniques. In this Studio 471, Tim discusses what kinds of threat intelligence can be gained from deception techniques, its limitations, the Bell-Whaley framework and how organizations can start their own scalable deception programs. Participants: Tim Pappa, Incident Response Engineer - Cyber Deception Strategy, Content Development and Marketing, Walmart Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!

Over last several years, clusters of English-speaking threat actors have conducted data breaches on a wide scale. These groups come from an online community known as Com or Community. In the beginning, these threat actors mostly focused mostly on harassing each other, stealing short usernames, cryptocurrency and cheating at games. But then they transitioned into serious data theft, extortion and ransomware. They’ve been intensely investigated by private companies and law enforcement, which have collaborated together to uncover some of their real-world identities and resulted in arrests. In this Studio 471, Michael Fletcher, a former Cybercrime Technical Analyst with the Australian Federal Police, describes the origins of The Com, the tactics used by these threat actors and why they pose a threat to organizations. Participants: Michael Fletcher, former Cybercrime Technical Analyst, Australian Federal Police Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!

Telegram has emerged as a significant platform for cybercriminal activity. Threat actors offer goods and services ranging from payment card details to login credentials to malware and other hacking tools. This ecosystem is vast, and it’s challenging to track. Sayak Saha Roy is an assistant professor at Louisiana State University working on online fraud prevention and usable security. He and several colleagues presented a paper at the Usenix Security Symposium in August 2025 titled “DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram.” The paper describes how the researchers used a language model to identify cybercrime-related posts on Telegram channels with a high degree of accuracy. In this Studio 471, Roy describes how it can be used for cyber threat intelligence research, moderation and more. Participants: Sayak Saha Roy, Assistant Professor at Louisiana State University, Online Fraud Prevention and Usable Security Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!

Structuring a cyber threat intelligence (CTI) program differs for every organization depending on size, the assets it is trying to protect and the threat landscape affecting their particular industry. Kobe Shwartz is the Head of Cyber Threat Intelligence and Analysis at Signify and is also the founder of a consultancy, Underdark.ai. He was formerly a Russian cybercrime and espionage analyst in the Israeli government. In this Studio 471, Shwartz discusses how he started the CTI team at Signify, which was formerly known as Philips Lighting. He also discusses how to manage alert overload, the importance of “Dark Web” intelligence and how to measure return on investment in a CTI program. Participants: Kobe Shwartz, Head, Cyber Threat Intelligence and Analysis, Signify Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!