Session | Topic | Description | Reading |
1 | Foundations | - A common language: Definitions and Types of Cybercrime
- Scope: Primary focus areas for the class
- The Big Picture: Key Concepts of the Ecosystem
| Syllabus Special Sauce: The Bespoke Specialization of Cybercriminals - Brandon Levene https://www.youtube.com/watch?app=desktop&v=fjvXJO0Mprk |
2 | Modern Cybercrime in Context | - Understanding the Growth of Cybercrime
- Key inflection points and trends
- Evolution of Monetization
| GitHub - Blevene/Crimeware-In-The-Modern-Era https://kumu.io/pancak3/cybercrime-ops-demo#cybercrime-ops-demo/fin7 |
3 | Business of Cybercrime and Cryptocurrency Primer | - Examining Cybercrime from a Business-Focused Lens
- Horizontal and Vertical Integrations
- Cryptocurrency and Cybercrime - Guest Speaker (40mins + 10min Q&A)
| https://documents.trendmicro.com/assets/white_papers/wp-inside-the-halls-of-a-cybercrime-business.pdf https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ |
4 | Cybercrime Organizations | - The Human Hierarchies in Cyber Criminal Organizations
- The Social Dynamics of Cyber Criminal Groups
| Selected, translated excerpts from “Conti Leaks” (PDF Provided) https://research.checkpoint.com/2022/leaks-of-conti-ransomware-group-paint-picture-of-a-surprisingly-normal-tech-start-up-sort-of/ https://www.cisecurity.org/insights/blog/the-conti-leaks-a-case-of-cybercrimes-commercialization https://arcticwolf.com/resources/blog/conti-ransomware-leak-analyzed/ https://www.secureworks.com/blog/gold-ulrick-leaks-reveal-organizational-structure-and-relationships |
5 | The Psychology of Cybercrime: Pig Butchering, Romance Scams, Business Email Compromise, and Extortion | - Understanding “low tech” cybercrime
- Psychology of extortion and human emotion
- Guest Speaker (40mins + 10 min Q&A)
| https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-us-tr-human-factor-report.pdf https://darknetdiaries.com/episode/141/ |
6 | Student Presentations | - 3-minute Student-Led Presentations with up to 1-minute Q&A
- Students will be responsible for analyzing a chosen excerpt of “Conti Leaks” chat logs and presenting findings and assessments.
| https://github.com/curated-intel/Threat-Actor-Profile-Guide/blob/main/The%20Threat%20Actor%20Profile%20Guide%20for%20CTI%20Analysts.pdf https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html |
7 | Communicating Cybercrime Intelligence | - Distill TTPs from in depth reading [Reading for context]
- Models for standardizing and organizing TTPs
- LM Killchain
- Diamond Model
- ATT&CK
- Dissecting TTPs to Build a Narrative
- Identifying knowledge gaps and resolving them
| https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf https://www.mitre.org/sites/default/files/2021-11/getting-started-with-attack-october-2019.pdf https://apps.dtic.mil/sti/pdfs/ADA586960.pdf https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ https://thedfirreport.com/2023/03/06/2022-year-in-review/ https://github.com/curated-intel/CTI-fundamentals https://www.documentcloud.org/documents/23834864-2023-dbir_full-report-final-1 |
8 | Adversary “Training” Guide | - Understanding Threat Actor Techniques and Their Propagation
- Assessing Actor Capabilities
| Translated Manual “Tokyo Leaks” (PDF Provided) Interpretation: https://blog.talosintelligence.com/conti-leak-translation/ https://www.fortinet.com/blog/threat-research/affiliates-cookbook-firsthand-peek-into-operations-and-tradecraft-of-conti https://github.com/DISREL/Conti-Leaked-Playbook-TTPs/blob/main/Conti-Leaked-Playbook-TTPs.pdf |
9 | Simulation: KC7 Cyber | - Students will use an instructor-selected module with an emphasis on pivoting and analysis
| Intro to Pivoting and Analysis - KC7 Students will participate in a threat hunting exercise using synthetic security audit log data accessible via KQL. Students *MUST* register and have a Microsoft email address in order to participate. Free, consumer accounts are eligible for accessing data. |
10 | Gameover: Operation Tovar | - Focused Assessment of Large-Scale Technical Takedown Operation and Its Aftermath
- TBD: Elliot Peterson, FBI (Operation Tovar Case Agent)
| U.S. Leads Multi-National Action Against “Gameover Zeus” Botnet and “Cryptolocker” Ransomware, Charges Botnet Administrator | OPA | Department of Justice |
11 | Monetizing Intrusions: Breaches in Focus | - Understanding the Human Cost of Stolen Data
| 2019 Baltimore Ransomware Attack: https://www.nytimes.com/2019/05/22/us/baltimore-ransomware.html https://www.vox.com/recode/2019/5/21/18634505/baltimore-ransom-robbinhood-mayor-jack-young-hackers Kaseya: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/ Costa Rica: https://www.bleepingcomputer.com/news/security/how-conti-ransomware-hacked-and-encrypted-the-costa-rican-government/ https://www.wired.com/story/costa-rica-ransomware-conti/ MoveIT: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a Accellion: https://threatpost.com/accellion-zero-day-attacks-clop-ransomware-fin11/164150/ https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion |
12 | OSINT and You | - Using OSINT Data in the Pursuit of Cybercriminals
- Guest lecturer [Ben A] (40 min + 10 min Q&A)
- Case Study: Applying Human-Centered Threat Intelligence to a Real-world Scenario
| https://www.crowdstrike.com/cybersecurity-101/osint-open-source-intelligence/ https://securitytrails.com/blog/what-is-osint-how-can-i-make-use-of-it https://inteltechniques.com/magazine.html https://www.bellingcat.com/resources/2021/11/09/first-steps-to-getting-started-in-open-source-research/ |
13 | International Responses to Cyber Crime | - The Challenges of International Cybercrime Law Enforcement
- Case Study: Legal Ramifications of Notable Cybercrime Events
| https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya https://www.cisa.gov/stopransomware/stopransomware https://securityandtechnology.org/wp-content/uploads/2021/04/IST-Ransomware-Task-Force-Report.pdf https://securityandtechnology.org/wp-content/uploads/2023/05/Ransomware-Task-Force-Gaining-Ground-May-2023-Progress-Report.pdf |
