Down the Rabbit Hole — Hunt a Real Cybercriminal and Support an Actor Takedown with the Cybercrime Atlas
A hands-on OSINT team hunt on a live investigation, led by the investigators running it: Jethro Cornelissen, Lead Investigator, and Brenton Bowen, Case Lead, at the Cybercrime Atlas.
Duration: 3 hours
Format: Hands-on team workshop, bring your own laptop
Hosts of the workshop at the Digital Forensics Conference, taking place on November 5 at the Sava Centar in Belgrade:
Jethro Cornelissen
Lead Investigator, Cybercrime Atlas
Brenton Bowen
Case Lead, Cybercrime Atlas
This isn’t a CTF and nothing in it is staged. You’ll team up with fellow practitioners to work a live Cybercrime Atlas investigation, guided by the two investigators running the case. We’ll show you how we hunt, what we look for and how we find it. Then you take over: pivoting across aliases, infrastructure, breach data, crypto and digital footprints to close the gap between an online persona and a real person. Bring your laptop, your OPSEC and your best tradecraft.
The Cybercrime Atlas brings investigators from industry, law enforcement and research together to map cybercriminal ecosystems and turn open-source intelligence into packages law enforcement can act on. In this workshop you do that work yourself.
We’ll brief you on a real case: the actors, the infrastructure and the leads. After a short hands-on walkthrough of the hunting environment, you form teams and start hunting. You’ll mix with people from different backgrounds, whether that’s forensics, threat intel, law enforcement, the legal profession or the tech sector, because that’s how the Atlas works and it’s where the best finds come from. During the hunt we’ll work the floor with teams and regularly pause the room to show on screen how we hunt: the lookups, pivots and patterns that move an investigation forward. At the end, teams present what they found.
Findings that hold up may be fed back into the live case.
TARGET AUDIENCE
Digital forensics practitioners
Threat intelligence analysts
Law enforcement investigators
Legal professionals
Tech sector professionals
OSINT investigators of all experience levels
HOW THE SESSION RUNS
Briefing (~25 min)
- Who the Atlas is and how we operate
- Legal and ethical guardrails
- OPSEC rules of engagement
- An overview of the case
Hands-on: the environment (~10–15 min)
- A guided walkthrough of the hunting environment
- The tools and the shared findings board
- Everyone set up and ready to hunt
Team up and hunt (~80–100 min)
- Form teams of 5–6 and work the open leads
- We’ll be on the floor supporting teams
- Regular pauses to show techniques and strong finds on screen
Show your finds (~20–25 min)
- Teams present what they uncovered
- We show how it connects to the bigger picture
Wrap-up (~10 min)
- What happens next with the findings
- Q&A
- How to get involved with the Atlas
REQUIREMENTS
You’ll need
- A laptop. Everyone needs one, whether you hunt from your own environment or from one of ours.
- A working understanding of OPSEC. You’ll be touching real infrastructure linked to real actors, so don’t burn yourself or the case. Everyone gets our OPSEC guidelines, with clear do’s and don’ts, before the hunt starts.
- A modern browser and a willingness to work in a team.
- Curiosity, and a willingness to go down rabbit holes. We’ll explain why.
Bring your own setup
- Your own environment. If you know good OPSEC and have your own investigation environment, use it.
- Your own tools. You’re welcome to use any OSINT tools you have available.
- Paid sources. If you have access to paid or commercial sources, bring them. They often give you a fantastic head start. We’ll explain how to use them in an investigation and how to parallel-source what you find through OSINT.
- Sockpuppet accounts (research personas) set up and ready before the session.
- Familiarity with common OSINT tooling helps but isn’t required, since teams will mix experience levels.
We’ll provide
- OPSEC guidelines: the do’s and don’ts for working a live case safely.
- Virtual hunting environments for participants who don’t have a safe setup of their own, so they can carry out the OSINT investigation safely. Numbers are limited, so use your own environment if you can.
- Case briefing material, lead cards for each team, a shared findings board and a selection of the tools and resources we use.