Christina Lekati<p>How can Human Intelligence be leveraged in Cyber Threat Intelligence?<br>The Dark Overlord investigation is an interesting report (together with all the resources it includes), showcasing how HUMINT can help to better understand threat actor activities, and even infiltrate the inner circles of these groups and uncover their true identities.</p><p>Note that:<br>🔹 HUMINT is utilized in CTI to help collect information that is not readily available through the observed threat actor TTPs or OSINT. The goal is to collect intelligence through direct communication with threat actor accounts (and their affiliates) regarding future plans, targets, motives, etc. In this report, there was also an additional effort to collect information on the identities, activities, and aliases.</p><p>🔹 OSINT and SOCMINT monitoring was ongoing and supported the HUMINT collection efforts. This is a generally recommended practice.</p><p>🔹 I particularly like the reference to the communication and personality of the group members. The report notes that the communication style of the TheDarkOverlord members is overall arrogant, impatient, and eager to demonstrate superiority - traits that ultimately lead them to their own demise. (feeling untouchable can make one pretty careless when disclosing details, especially when this is paired with the need to demonstrate superiority.)</p><p>Overall, this report is worth a read.</p><p><a href="https://infosec.exchange/tags/HUMINT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>HUMINT</span></a> <a href="https://infosec.exchange/tags/Socialengineering" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Socialengineering</span></a> <a href="https://infosec.exchange/tags/OSINT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OSINT</span></a> <a href="https://infosec.exchange/tags/opensourceintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>opensourceintelligence</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cti</span></a></p><p><a href="https://nightlion.com/wp-content/uploads/2020/12/The-Dark-Overlord-Investigation-Report-Night-Lion_v1.01.pdf" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">nightlion.com/wp-content/uploa</span><span class="invisible">ds/2020/12/The-Dark-Overlord-Investigation-Report-Night-Lion_v1.01.pdf</span></a></p>