My Darkwebathon journey started in December 2021. It was the first time that the Anti-Human Trafficking Intelligence Initiative (ATII) had conducted a global CTF. The event was for a worthwhile cause. 400+ participants among 56 teams joined the virtual fight against various real-world criminal entities. ATII launched their own dark web intelligence monitoring tool during the competition, which helped us track these criminals. I’d like to share more about my experience in the hopes that others might see the value of applying intelligence work to special events that help solve real, global problems.

If you’re interested in all of the different types of events– including threat intelligence focused activities – here is an overview of the ATII event challenges from the past 3 years:

One fruitful aspect of the event was the free use of new tooling. ATII provided training related to sponsor-related tools, which we could access for a limited time. Their platform had a large dataset with selectors, crypto addresses, graphs, screenshots, image hashes and more. At the 2023 conference I attended, we also leveraged tools like DarkOwl and SOSIntel, which are dark and clear web data scraper tools allowing users to find important intel. We also used DarkBlue to pivot intelligence data and store snapshots of crawl data pages with historic versions. Plus, the cryptocurrency forensic investigation tool, Qlue, provided intelligence on whether the specific crypto addresses were risky, suspicious or good and when the transactions happened.

My Experiences and Awards

During my 2021 Darkwebathon experience, my team started the investigation with a single email ID and an image hash data set. Our goal was to complete an intelligence report in 2 days. Using the platform's dataset and sponsored tools, my team found various information about the threat actor – including a phone number, crypto addresses, a website, and social media. Sponsors provided challenge winners with prizes that included tool licenses and course memberships for up to a year. My team secured 2nd place in this event, and I won the Cryptocurrency Challenge Award.

I learned about even more tools and strategies during the 2023 Darkwebathon. My team used the data scrapers tools to find threat actor data. We also used open-source databases like Google, Virustotal, and Whois to track pivot intel, like contact information and social media and WhatsApp accounts. I researched the concept of pig butchering scams and created a detailed report on it. Our team successfully submitted 19 different reports that were hundreds of pages in length. I secured the first-place prize for the cryptocurrency challenge, and my team earned 2nd place in the OSINT challenge.

Below are my some Maltego graphs I created during the 2023 Darkwebathon:

Image

Figure 1: Rings of PigButchering Scam

Image

Figure 2: Maltego Fireworks

Below are my 2022 Maltego graphs:

Image

Figure 3: Dark Web Sun with golden rays of Cryptos

Image

Figure 4: Dark Web Sun with Golden Rays of Cryptos

Image

Figure 5: Dark Web Sun with Golden Rays of Cryptos

Conclusions

The Darkwebathon was a fantastic event! Unlike most CTFs, all participants worked with real human trafficking-related data collected from the dark web. This type of event is extremely useful in understanding dark web activities and gaining insights about threat actors. One main takeaway from these events is that by using appropriate methods and tools, we can avoid the risk of exposure. This event gives the entire infosec community the opportunity to gain hands-on practice and training using helpful tools.

Learn more about ATII and the Darkwebathon from the following ref links: