How Breach Data Cracks the Toughest Investigations

Matteo Tomasini: You really have to show your work, and it really has to be bulletproof. You have to explain why you made certain assumptions, or ideally, don’t assume anything ever.

You just can’t say, “Oh, it’s this person 100%.” You say, “This is why I think it could be this person,” and then let investigators, law enforcement, whoever, kind of go from there.

AJ Nash: Hello, and welcome to another episode of “NeedleStack.” I’m AJ Nash, founder and CEO of Unspoken Security. I’ve done a whole lot of stuff in my career. I don’t know, 19, 20 years in the intelligence community. Been in the private sector about a decade, a little more now. Primarily building intelligence programs, helping people build their intelligence programs, advocating for intelligence-driven security, all those kinds of things.

And today, as always, joined by my lovely and talented co-host, Kacper Piwowar. Kacper, you wanna tell the people a little about yourself?

Kacper Piwowar: Yeah, of course. So my name is Kacper Piwowar. I work at Authentic8. I’m a senior product marketing manager. Been in the cybersecurity space for a while, mainly on the corporate side. Been in tech overall, like 15 years or so. So, I have quite a breadth of experience kind of talking about all the different things that we talk about here.

I’m excited to get into it. It’s gonna be fun.

AJ Nash: Yeah, and I’m excited today specifically. Like today we’ve got a very cool guest, Matteo Tomasini. He’s founder and CEO of District4 Labs, which is a deep and dark web data company that offers investigators and cyber analysts access to billions of records with compromised personally identifiable information.

Matteo was previously managing director and cyber practice lead for Prescient, a global risk management intelligence services firm. And he’s also served as director of incident response and threat intelligence at BlueVoyant and was a senior practitioner at K2 Intelligence. His expertise includes deep and dark web investigations, social media intelligence, online threat monitoring, threat attribution, and complex cyber investigations. Matteo, it’s a hell of a bio. Anything you want to add?

Matteo Tomasini: No, no, that’s about it. Yeah.

AJ Nash: Outstanding.

Kacper Piwowar: So let’s get into it, right? What are we talking about today? I’ll kind of precurse that, and then, we’ll look to Matteo to shed some light on some of the topics. So the dark web and the hunt for hard targets. Specifically, what does it actually take to use OSINT to track down a transnational criminal network or a threat actor on the FBI most wanted list?

I would agree that it often starts with a single thread, whether that’s an email, a username, a name, or no digital footprint. Any sort of piece of data is critical to the investigation. So in this chat with Matteo, we’re gonna pull back the curtain on hard target investigations, how analysts pivot from a compromised data point to a full picture person of interest, corroborate what they find against open sources, and move from scattered fragments all over the place to attribution and identity resolution.

So I’ll kick off here, Matteo, if you don’t mind, because I’m very curious as to how this is done. I think we’ve seen a lot of it in like movies, right? Somebody gets like, a passport photo or something, and then magically they’re into like this dark web that actually looks like a spider web, and they’re clicking buttons, and then they download stuff, then they know where to show up at the person’s house, right?

Bit of a naive point of view, but it works in Hollywood. So with that, where did you start with gathering information? Like where do you actually begin if somebody says, “Hey, I really wanna find out more about this particular threat actor”?

Matteo Tomasini: When we’re kind of doing a digital footprinting exercise, trying to determine the extent of someone’s online and then by extension, physical presence, generally speaking, kind of starting with more basic sources. So starting with, you know, public records. When I was doing investigations for fourteen, fifteen years, or so, I’d always start, you know, in the US, you know, we have TLO, we have, you know, Accurint, we have Clear, that can provide additionalidentifiers associated with your person.

If you have a name or you have a phone number, put those in and get some potential emails, potential phones, potential addresses. And most important thing is to appreciate that this is all potential, right? Like, these are all leads that you need to follow. And that’s kind of like a theme in the investigation.

Like, every piece of data you get back, you just can’t assume that it’s reliable or that it’s accurate. You need to spend time validating, even when you are talking about public records. An address could be the mother’s address where the guy was living for a couple months, or phone number could be a work number.

It could just be someone’s completely different number. So typically I like to start there. And then there is that kind of process of validating the identifiers. So understanding, are these addresses legitimate? Are these phone numbers legitimate? Are these names and maiden names legitimate?

One of the best sources for identifying whether this data is valid is just comparing it to other data sources that you have. So whether it’s social media data you might find, breach data, and that’s part of the reason I became so in love with breach data and started a breach data company, is because early on, when I was doing investigations, like twenty eleven, twenty twelve, I found that breach data was a good way beyond all the other value that it has to validate identifiers.

Because a lot of hacks, you know, people are putting in legitimate information. They’re putting in, you know, their legitimate email, legitimate phone number, and, you know, vice versa. If you’re searching for an email address you find in TLO, and your subject is John Smith, and it keeps coming back to a Rebecca Johnson, in all the breaches, maybe that’s not the right email.

So that’s where I typically start is, you know, looking at public records. Obviously, if, you know, we’re talking about, you know, most wantedbulletins, you know, the FBI has, you know, lists of identifiers they can look at. You know, World Check has lists of identifiers that they provide as well.

But even those, spend some time validating them, ’cause that’s the most important part of investigation, is at every stage validating your findings. Otherwise, you end up in this cycle where you end up with God knows what data. Garbage in, garbage out, right? Just validating at every step. And contextualizing everything at every step.

Kacper Piwowar: The one thing I’ve kind of realized with that is that when you’re going through the investigative workflow and you have, let’s say, a target of interest, ideally you’re looking for the criminal to make a mistake, right?

They reuse something, whether it’s an email, a username, even a time zone, right? You’re trying to get a thread. And sometimes it’s not even necessarily that, you know, you have like a burner email, for instance, that you know is like gibberish@so-and-so.com. But if you can correlate, let’s say, the password to that burner to three other different emails, then you found your pivot, right?

So I think the creative process, like you just said, it’s important to be flexible at the beginning because there’s a lot of ways that you can start to investigate and find different threads as you move along.

Matteo Tomasini: Yeah, no, I live for the pivot. And I think it’s just, you know, going from one identifier to another identifier and, you know, to your point, yeah. Criminals, like, do mess up. They’re gonna find them in breaches. You know, they’re gonna have an online presence. Even if they don’t have an online presence, they’re gonna have some sort of, you know, presence in, you know, data collected by other people.

You know, you can have the cleanest online presence, no social media, nothing, but your data will still exist in different silos no matter what, whether it’s public records, whether it’s, you know, breaches, whether it’s posts on someone else’s page, whatever it is.

And some of the best cases I’ve done were when we’re looking at these very hard targets who have amazing operational security because they’re going out to do bad things. So they’re like, “Okay, I’m gonna go out and do bad things. I’ve started doing bad things as of, whatever, a few months ago, so I have to keep everything clean.

I have to make sure I always log into websites or whatever with a VPN. I don’t use the same VPN every time. Maybe I change passwords every now and then. Don’t use the same username.” But invariably, they’re gonna forget to turn on their VPN one time. They’re gonna maybe use a variation of a password or variation of a username.

Their machine is gonna be infected and then game over. The data from their machine as part of a malware log. More interestingly is even though they’re doing everything they possible now to make sure they don’t get caught, very likely, they weren’t doing the same thing a year ago, two years ago, three years ago.

So as soon as you get that one little opening, you can kind of open their whole footprint, right? Like you mentioned pivoting on a password. That’s a great one, right? Like they signed up for an account, using this burner email, burner phone, burner whatever life, but they used a variation of a password that they’d previously used, maybe ten years ago or something, and they just forgot about it, right?

‘Cause it was an account that they created ten years ago when they were a kid or something like that. I can’t tell you how many– I’ve probably found like, I don’t know, six or seven kinda Russian hackers, by essentially pivoting through time and finding a Minecraft account that they created when they were 12 years old, using a real IP address and maybe their mother’s name or something like that.

So that’s the thing to appreciate is, you know, bad guys mess up too. Bad guys get hacked. Bad guys forget to turn on their VPN. And yeah, once you have one small opening, then it’s kinda game over. Thing is knowing all the possible openings, right? ‘Cause, you know, the threat actor could do nine out of 10 things right, but if you don’t know to look for that 10th thing, you’re never gonna get there.

AJ Nash: Everything you’re talking about is human nature, right? Sometimes I think we mythologize, if that’s a word, threat actors as these scary, no-face hooded guys in the dark doing these awful things and that they’re brilliant and some are, but they’re also people, right?

And as you said, people have a tendency, we all have this tendency, reusing passwords, reusing accounts, forgetting we used an account someplace else. It’s hard to keep really pure tradecraft on either side, right? Coming out of the US intelligence community, humans have the same issue.

We do a lot of work in cyber, obviously, in the intelligence community and it’s very difficult. Now, obviously it’s a, you know, it’s an easy place to plug for, you know, Authentic8 Silo. It’s the reason I use the tool and have forever is because it kind of takes care of that stuff for me, as long as I remember to launch the same workspace every time.

But it cleans up some of that stuff for me. But still, I’ve seen people even in that environment make the mistake. Once you’re in there, but if you go someplace and log in somewhere and you use a username or a password, people love to use the same username or variations of a username or an alias or a handle that can start tying things back together.

People, you know, if you’re in message boards or whatever, there’s a pattern to how people talk, you know, how people write. Some people love the em dash even before AI came along, or some people never capitalize anything, or, you know, some people like myself love ellipses for whatever reason.

So, you know, there’s other things that can come in there. So I think it’s interesting you’re pointing out, all these little details. But I want to backtrack for a second. You mentioned a couple databases real quick. You mentionedTLO, which is TransUnion for those who don’t know. And so all these data aggregators, right, and how validation’s an issue, ’cause I’ve gone through a lot of these data aggregators, and they’re not perfect by any means.

Personally, I will tell you I had a story where some of my data conflicted, and so there was apparently somebody with the same or similar name to me who’s a felon in a different state that I’ve never been to. And so I saw some of that and I was like, and I had to go in and fix it.

And you can reach out to these data providers

Point out that this isn’t you, et cetera. And I did get them to clean some of it up. I couldn’t get the data providers to do what I needed them to do. But I was able to go in and put in requests to have all the data pulled out of their databases altogether, which you can do if you go through their processes.

So I got myself pulled out, plus this other guy, so I protected all of his information as well from all these aggregators. But I’m

Kacper Piwowar: Maybe you’ll get a check in the mail.

AJ Nash: I don’t think so. My guess is no. But it doesn’t look like he’s somebody who’s giving money away. It seems like he does more of the opposite.

But I’m curious, how much time and effort do you have to put into, you know, the unraveling in some of these databases, right? You get in there and you start putting together, and as you, like you said, it’s an email address, but actually it’s, you know, somebody’s relative or a friend or maybe it’s just false ’cause it’s unrelated.

Like how much work are you putting into, you know, if you can calculate like percentages of the overall effort if you’re trying to track somebody down, how much of it’s just unraveling these data providers messy data, or is it just not as complicated as that usually?

Matteo Tomasini: That’s kind of like the first stage. The first step is making sure you have the right identifiers going in. Generally speaking, it’ll probably take maybe a couple hours at the very beginning, just to… ‘Cause you want to start with as wide a base as possible.

You want as many emails as possible, as many phone numbers as possible, as many IP addresses as possible. I’m personally obsessed with trying to find as much as possible. Like my previous company, I built tools to try to find as many identifiers as possible, tools that are still being used to this day.

Even before I technically start the investigation, I’m already pivoting to see if my initial identifiers are accurate. I’m still doing part of the investigation while trying to identify things as legitimate, finding new identifiers from there.

It’s completely iterative. I don’t know if it actually really ever stops. You’re constantly validating new inputs that you get in, then you have to search for those. You’re gonna get new things and you’re like, “Oh, that’s not the right, Matteo Tomasini or that’s not the right address or whatever.”

Let me go back a step. All right, now let me go forward again. So it’s constant. It’s constant. So, you know, maybe a couple of hours at the beginning, but then, you know, at every step you’re constantly doing that

AJ Nash: Well, that brings up the next question kind of a broader sense of let’s talk about best practices in general. Are there industry best practices? Is there certification for this? Is there training for this kind of thing? Who established what the best practices are?

and what are you seeing as issues with current investigative practices, whether it’s tool selection or tool consolidation, or whether it’s people just abusing opportunities or just lack of training? I’m just curious what your thoughts are on the current best practices and challenges in the industry.

Matteo Tomasini: Yeah. I mean, so it’s really interesting time to be in investigations, which I’m kind of sad I’m not in investigations anymore. But I’m kind of on the other side kind of building the tools that, you know, people like me would use as part of investigation. So I mean, in terms of training, like I’m kind of the wrong person to ask, I think.

So I just kind of tried to learn everything on my own. Just ’cause when I was starting out, there weren’t that many, you know, classes, tools, training that you could do. I think that’s changed a lot now. You know, I know like, you know, Cynthia Hetherington, Osmosis Group has kind of, I think it’s OSC certification, something like that.

I think maybe OSINT Foundation has something similar. There are these certifications for deep and dark web, for open source intelligence. There’s a lot of courses that are even focused on China OSINT or Middle East OSINT, which are interesting and great. I think one of the great things that I’m kind of seeing among analysts is that technical proficiency is

much greater now than it was before. I think people have been appreciating that they can’t just expect to get handed everything, and that the tools that they’re using aren’t the alpha and omega. Like there’s other stuff out there. And people trawling through GitHub looking for interesting little tools and Python scripts that might help them out.

So they’re realizing that stuff is out there, so I need to know how to use those and become more technically proficient. First thing maybe on the flip side is now with the advent of AI, the kind of platformification, that’s not a word, but of like everything, right?

Because there was this period where there were all these different tools spread out all over the place, so people kind of had to learn how to use all these different tools. That was good, and then there was some consolidation, but not a crazy amount. So people would use this tool that aggregated 10 different sources, and then you’d go over here for the two or three other things that you need to do.

Now, you know, there’s these tools that basically claim to do everything for you. So, I think there’s people who assume that they do everything for you. So they kind of do their investigation from A to Z inside these tools when there are things that these tools don’t do, right? Maybe they don’t have all the PDNS data that, you know, companies like Censys might have.

They definitely don’t, a lot of them. Or you know, all the domain registration records at Domain Tools dark web data that you know, a DarkOwl or CyberSix or Flashpoint might have. So it becoming kind of almost too comfortable and”Oh, I have this tool. or this platform, it does everything, so I don’t need to kind of do anything else.”

I’ve noticed that like over the last maybe year or two, and kind of Maybe a corollary to that is because these tools kind of make it very easy to get an answer, there’s some that kind of have little AI agents built in, and they’ll maybe do some auto pivoting for you, or, you know, you put in a, a search term and they give you back results.

A lot of the time, you know, these platforms won’t give you full raw data behind that ultimate result. They don’t provide enough context to that result. So you might put in an email and you get all these social media profiles back. So the analyst is gonna be like, “Okay, great. All these social media profiles are definitely associated with this email.”

And it’s like, maybe, maybe not. Like you need to understand the methodology, by which that social media profile was arrived at. You need to understand the full context. Like, again, maybe that wasn’t the right email, but you put it in, it gave back your social media profile, so you’re not kind of going further.

So that’s, again, that validation step, it’s not fully appreciating everything that goes into getting that result. And it’s kind of people trying to get the easy way without doing the grunt work to understand like, oh, when you’re investigating internet infrastructure, you need to pivot off of a MX record.

You need to, do this, do that. Instead here in this tool, they’re giving you this answer, but you don’t know how it got there. And because you don’t know how you got there, you can’t know how valid it is

Kacper Piwowar: And do you think that, because one of the things we’ve seen is like the time to result is being condensed, right? With the advent of AIs and agents, there are those that are like AI first, which are basically saying, “Hey, we’ve built really sophisticated agents. They can crawl all the things that an analyst can.”

They’re measuring what the output is, what the analysis is. If it meets a particular threshold or a benchmark, then, it’s, quote-unquote, “good enough,” right? Then there are some that argue, “Hey, there always needs to be a human in the loop for this type of work because somebody has to check and verify.”

So I think there’s almost like these two camps, but as the technology improves literally hour after hour, is there gonna come a point where the majority of investigative work is done by agents, doesn’t need to be done by people? as long as they have access to the right systems and they’re provided the right context and workflows, then do you see the analyst role going from what it is traditionally, which is like you mentioned earlier, a lot of kind of grunt work, seeding through information, creating reports, and whatnot, to more of the analyst being like a consultant, which is handed this information from the agents that do it?

Matteo Tomasini: For me, the analyst is the most important part of the investigation, and there’s always gonna need to be an analyst in the loop. Especially if you’re doing proper… You’re not doing investigations of the hobby. You’re doing investigations for clients on behalf of law enforcement to hand over to law enforcement.

You need to be in the loop. Like, because, there is this cycle and, you know, because AI agents are gonna maybe try to validate some data. but if there’s one thing off, 13 pivots later, and I’m dealing with this now ’cause I’m trying to build this algorithmic pivoting thing, and AI was just a nightmare.

I started going back to scoring and waiting and all that stuff. But just to say you need an analyst, I think, at every stage, to validate kind of what’s going in and to properly review the results and to provide enough context. Like, you can put in a lot of the analyst mindset into, all right, this is how you should pivot, this is when you should pivot, this is likely to be valid, this is likely not to be valid, et cetera.

At a certain point, you just run a huge risk. AI just kind of going off on its own. I think there was a news article the other day where AI produced this report for I think some operations in Iran that was completely wrong.

So yeah, AI is great as force multiplier, right? That’s the common kind of phrase.

It would’ve been amazing, when we were doing monitoring engagements or sorting through tens of millions of Twitter posts and Instagram posts or dark web posts. Huge. Like, “Hey, show me any posts that could potentially be referencing, drug use or criminal activity,” or, “Show me this, show me that.”

But even then, you’d wanna look and make sure like, “Okay, how did you come to this? How did you get to this result?” So yeah, I think it’s a great tool to have. But unfortunately, even the companies that are creating the AI agents, don’t understand AI.

Like, and they’ve admitted as much, right? In that New York Times article about Anthropic, like, “We don’t know why it’s doing this. We don’t know why it’s doing this.” So if they don’t know why it’s doing certain things, you’re definitely not going to. And if your intelligence product is gonna be relied upon, by law enforcement, attorneys, really anyone, like you need to make sure that it’s accurate.

You need to provide as much context as possible. So it’s great that’s frankly one of big concerns is analysts that are just starting off now that aren’t gonna go through, you know, like the… and it can be a pain, you know, of like all the dead ends and the chasing the rabbit holes and doing all this, ’cause they’re gonna be like, “Hey, you know, Mr.

Whatever, Claude or Mr., you know, GPT, don’t go down any rabbit holes. Just find me the results.” It’s like, you can’t do that. It’s certainly helped me with certain things, but, you need a trained analyst at the wheel who can provide proper context, can contextualize results, can validate results, and can understand, when maybe the results aren’t accurate.

The same way even for coding. Like, if you’re just some guy who says, “Claude, hey, code all this stuff,” that’s one thing. If there’s a developer who’s asking Claude to program, it’s like, “Oh, wait. Oh my God, this introduced a giant security vulnerability,” or, “Oh my God, that’s gonna actually delete my entire database because it did this.”

AJ Nash: You make good points, right? You have to have that requisite data or that requisite knowledge first, right? So it’s a calculator, right? I, as a kid, I’m old enough to say this, I guess we weren’t allowed to use calculators in school for the most part, right? And then you get a little older and you’re allowed to, but it was only after you had already proven you could do the work.

You had to show your work, right? If I know that two plus two is four, I know it, I can explain it in detail. But therefore I can use a calculator. Yeah, that’s right.

Kacper Piwowar: Who remembers that?

AJ Nash: But therefore I can use a calculator because I understand if it’s wrong.

If I click two plus two in a calculator and it says seven, I know it’s wrong. If I never understood what two plus two was to begin with, and I just trust the technology, then I’m not capable of even identifying the problems, which is what you’re saying. and the AI is, combined with, as Kacper mentioned, this pressure to get things done faster, product- productivity, and just move quickly.

It’s making us lazier as a society, and there’s a lot of data to support that now, a lot of research that says it makes us lazier, or to use a better term, we’re just under so much pressure. Maybe you’re not lazy, it’s just you’re more easy to trust and move on. “Hey, I’ve got nine things to do today.

I really only have time to do six, so I’m gonna have AI help me, and like a few of those, I’m not gonna really QC them the way I should because I need to get all nine done. And, you know, if a couple of them aren’t good, I guess we’ll figure it out later.” Which is fine until you’re putting bombs on targets and things that have real significant consequences to it.

I think you make a great point that it’s a force multiplier and we need to be using this technology clearly. But I think it’s too easy to just offload things to the technology and then accept it. I’ve seen people do this who start like they’re gonna be very diligent and they research everything, and when they get things from AI, they check every fact, et cetera.

And then over time, you just do less and less of that. You start trusting it more. Either the fact-checking’s working well, so you stop looking as hard, or again, you get busier. I think, most people I know, myself included AI hasn’t given us less work, it’s made expectations higher. So what used to be, “Hey, I used to be able to get nine of these things done in a week, now I’m expecting 18 done in a week because I have this tool.”

Well, God forbid AI goes down, by the way, because you’ve changed all of your capacity to tie to that. But when you get into the kind of work you do, that’s really dangerous because again, these are impactful, you know, research projects, investigations that can have serious consequences.

So people need to understand tradecraft, and I’m worried, as you mentioned, that the new generation coming up, they’re not going to. They’re not gonna be taught tradecraft and they’re gonna trust the technologies, and they’re not gonna be able to foolproof it. And then if you throw in this, and malinformation, things like that, that can make it very hard to unravel it later to understand, “Hey, how did we get to this conclusion and where was the data?

I’ve got all the supporting data though, and all the supporting evidence,” and it has supporting evidence, but it’s actually just circular reporting based on fiction. It’s gonna be much, much more difficult. So I’m curious about your thoughts on that and how we’re going to, or if we’re able to do a better job.

Again, standardization, you mentioned training isn’t really a thing and certifications isn’t your strength, so I don’t want to pick on you too much there. But I wonder if that isn’t something we need to look more at, is creating a scenario where more people have to be certified and go through standards and training on this before they’re just let loose with AI and a mandate.

Matteo Tomasini: I definitely agree with that. Like, I think, training now is that much more important. Like, you need to fully understand every kind of arena that you’ll be looking into as an investigator, whether it’s understanding social media, understanding dark web, understanding public records, understanding internet infrastructure.

Like, you need to be properly trained on all these different aspects, because all these different aspects are gonna play a part in almost every investigation that you do. And understanding how they kind of meet each other, how you can kind of pivot from social media to dark web to whatever IPs to internet infrastructure, et cetera, and then back again,

understanding… Like for me, for District4, context is just the most important thing. So being able to understand exactly how that result was arrived at. The only way you’re gonna be able to do that is by arriving at that result yourself and not trusting an AI agent to do that.

So you’ll know maybe the AI agent did well, like it did it right. But until you can say that, you can’t trust it. This is not to shit on AI. Like, I think it’s great to triage, when you have millions of alerts and you’re looking at billions of posts and this and that, and maybe it can help summarize certain things for you, which is good.

But just be aware of its limitations. Be aware that it might not be trained in the same way that you should be trained in, or maybe you are trained in.

Kacper Piwowar: I think it’s interesting that we kinda covered the spectrum of some of the things you should and shouldn’t do. I’d be interested, Matteo, because I did read an article recently about how District4 Labs helped the Hungarian government with one of their leaks. I believe it was some of the government officials, and they ended up finding some commonalities in the passwords, and then they were able to attribute that back which I thought was kinda cool.

Which leads me to the wider question, let’s say you have all this information. At what point do you direct your findings to the proper authorities, and how does it actually look like in terms of real-world consequences? ‘Cause a lot of what we’ve spoken about is this digital investigation.

We’ve put together this report. We have some analysis, but do you have any insight of, “All right, that’s great, but now we gotta take it into action in the real world,” and then what does that look like? ‘Cause I’m sure, AJ, you’ve probably read about some of these trials that take, like, who knows how long, five years, six years, seven years to get, some sort of extradition warrant, et cetera.

So it seems like even if the pace digitally is quick, the real-world process is still slow and cumbersome because it follows all the legal red tape that you have to follow.

Matteo Tomasini: Yeah. I mean, it’s just really situation dependent. Like, so when I was in. kind of my background is corporate investigation, so more often than not you’re, you know, doing work on behalf of a corporate client. And, you know, if there is a legal angle, you’re dealing with, you know, their counsel and then they’re referring it to law enforcement.

Sometimes we’re, you know, handing stuff off to law enforcement we might find or, you know, customers of District4 are. Like, I know, you know, we have these things called log stealers, which is basically, I was referencing it earlier in the conversation, where, you know, a person’s machine is infected and, you know, it can be anyone’s machine, including a threat actor.

And then basically all the cookies, browser history, saved credentials, autofills, et cetera, are exfiltrated and posted on some C2 center, usually Telegram or something like that. So, you know, we’ve had clients who have found people visiting or having accounts on CSAM websites and things like that.

So then it’s just like quick, like, “Hey, let me search for this CSAM website. All right, who has an account here?” Like, done. So, like, we’ve had, you know, numerous arrests occur just because of that. But, you know, to kind of the earlier point, you have to verify the hell out of it, right? Because, you know, maybe that person was looking at it on a shared computer at a library, and there’s all the other people, so now you’re gonna start knocking down all these other doors.

So even with that data where it’s like data from a machine, you know it’s from a machine, you still need to spend time validating it. And we had an interesting case where they were able basically do a threat attribution case leveraging our data and social media sources that led directly to an arrest of someone in Australia.

It really depends. More often than not, when you’re in the corporate intelligence world, it’s not your say when things go to law enforcement. You can just advise like, “Hey, here’s this.” A lot of our clients appreciate that law enforcement doesn’t have all the time in the world to do these investigations.

So more often than not, you’re putting together a nice package saying, “All right, this is what I found.” And kind of to our earlier point, you need to really show your work. You can’t just say, “Oh, I know it’s this person because I’m using this crazy platform, and this platform said… ‘

Kacper Piwowar: Cause Gemini said so.

Matteo Tomasini: Or even like, great OSINT platforms out there. You can’t just say, “I know it because of Maltego. I know it because of, you know, Nexus Explorer. I know it because of whatever, FiveCast.” Like, you have to be able to say, “I went from… I started with this email address, and then I found it, you know, in a breach that gave me this phone number that’s connected to this social media account,” and so on.

You really have to show your work, and it really has to be bulletproof. You have to explain why you made certain assumptions, or ideally, don’t assume anything ever. Never obviously deal with absolutes. Just say, “Hey, this is likely associated with this person because of this, and this.”

That’s one thing I learned early on is just never, ever deal in absolutes, because you just never know. Especially if you’re taking these cases to court, which was often the case, you just can’t say like, “Oh, it’s this person 100%.” You say, “This is why I think it could be this person,” and then let investigators, law enforcement, whoever, kind of go from there.

AJ Nash: You bring up some interesting points when you talk about the confidence. Somewhere in the intelligence community, we use confidence language. You’ll rarely, if ever, see an intelligence professional say, “Absolutely, this is it.” High confidence, low confidence, moderate confidence, lots of caveat language.

Intel people are rarely gonna say, “This is 100% what happened.” You might have even witnessed it firsthand, and you might not be certain what happened. So those are tough. But as you’re pulling that together, from a legal standpoint, how important is the provenance of the data, is chain of custody?

Especially now, again, in the age of AI, where it’s so easy to create fake things that are very consistently good and improving. I assume, I’m not a lawyer, but I suspect that’ll also be used in a lot of defenses. A lot of defense attorneys are gonna say, “It’s fake. This is manufactured. It’s AI.”

So how hard is it to keep provenance to have chain of custody, to be able to track that down? How do you handle that to make sure when you show the evidence, somebody doesn’t go, “Well, it’s manufactured,” and be able to prove the date and the time that you found this and where it was and all the connections?

Matteo Tomasini: Yeah, no. Provenance context is incredibly important. Like, you know, whenever we did investigations, like we would just assume that anything could go down at any minute. So, you know, when I was doing investigations, I would use a tool called Hunchly, which would basically kind of save your pages in MHTML format.

Again, it’s not perfect, but you know, it’s just kind of good. Like, why do you think this phone number was listed on this website? Oh, because I saw it on the website. Prove it. Oh crap. It’s gone now. The website’s gone. So then you can at least show like something for that. But it wasn’t as much an issue in the past that people would alter things or change things, but it’s certainly becoming the case now.

And that’s the other kind of double-edged sword with AI. As easy it is to like analyze content, it’s also easy to generate just a bunch of fake content and that’s one of the reasons you really need to fully appreciate and completely understand your sources.

Whether it’s when you’re using an OSINT platform, understanding my social media data is coming from OSINT Industries and Epios and maybe Social Net. And I know that they’re able to correlate an email address because they’re using this technique. Oh, that technique is legitimate.

I understand the techniques. I can say it’s associated, that it wasn’t manufactured. And this is becoming a bigger issue at District4 is, threat actors are fabricating datasets orthey’re altering datasets or they’re merging together two different datasets that are completely different to create like a crazy dataset.

I was given a dataset by a threat actor who said, “Oh, this is, you know, really crazy.” And I saw it. It was like selling for like $2,000 everywhere else. This threat actor gave it to me, and it was like, Coinbasetransactions with information on how much money they had in different cryptocurrencies, name, email address, physical address, phone number, et cetera.

I started to look at it and the names and addresses, email addresses were all accurate, but, you know, there were about 30,000 lines. You know, every address was like some variation of like of a tree. It was like Pine, Orchard, Oak, something like that. I’m like, “This is starting to look really weird.” And like every company was about six or seven different companies.

And I’m like, “Oh,” so basically this threat actor had taken a real, maybe a marketing list with email addresses and names and then just created, and I was actually, ’cause I’ve been looking at like, there’s this Python script called like Fake Company or something, and it always generates the same seven companies.

So I saw those and I’m like, “Oh, they used that.” but then for the crypto, even the crypto balance, they were all between $2,999 and 5,000, you know, 500,009, whatever it is. So I’m like, “Oh, okay. They just did like a random, you know, dot whatever in Python.” So you’re seeing that a lot or sometimes they’ll just completely fabricate datasets.

AJ Nash: So we spend a lot of time validating the data is what it says it is. Because, you know, sometimes they’ll relabel like old database. Like, “Oh, this is the hot new Home Depot database,” and it was like, you know, Adobe database from 12 years ago or something. So that happens a lot. Are you saying criminals can’t be trusted? Are you saying they lie?

Matteo Tomasini: I’m starting to think that maybe they might be not be completely trustworthy. My whole, like, universe is falling as we speak. And because I came up as an investigator, like, I, you know, realized how important it was to kind of trust your data and, you know, not to, you know, disparage, but there’s, you know, like, some fly-by-nights kind of, you know, breach data shop that just will just index everything under the sun.

They don’t care, you know, where it came from, how legitimate it is, et cetera. And then it becomes that issue of, you know, garbage in, garbage out. Like, “Oh, this person is associated with this email address.” How do you know that? “Oh, because I found it in this breach.” End of story. But then you look at the source like, oh, wait, no, that breach is fake.

It’s not legitimate or it’s mislabeled, so you can no longer assume that they had an account at Home Depot or whatever it is. So no, that’s become a huge problem and that’s why I love how easy these OSINT platforms make it to do the work and how even some will do automatic report generation and they’ll give you a finished product especially when they add on AI.

But then you don’t see all the raw data that went into it. You don’t see the kind of process like, “Oh, this was here, it led to this. You just see the end result, and that’s frankly kind of scary, and it’s never something I personally would ever use. I might use it to be like, “Okay, oh, let me see what it did,” and then, I’d spend hours and hours working backwards trying to figure out how it got there.

And, you know, maybe it’s great, maybe it’s good, but without that validation process, to me, it’s just not meaningful. It’s nice, but it’s not, may provide good leads, right? It’ll provide good leads. “Oh, maybe I should look into this. Oh, I looked into this. That’s not legitimate. Or I looked into this. Oh, actually the platform did pretty good on that one. Okay, cool. I can look at that one.”

Kacper Piwowar: Do you think there’s, and this has always been an interesting, point of discussion around the way that OSINT workflows occur within law enforcement or federal government versus how it works in corporate settings, right? Because if you look at it, like national security oftentimes, they care about who, and I’m making an assumption here, a larger amount of time that you can spend in finding that who.

When you look at corporate security, it’s like stop the bleeding, right? Like, we need to get to this quick. So, there could be similar techniques on both sides, but I feel like the time element is different depending on which lens you use, right? Whether it’s law enforcement or corporate. That’s something that’s been discussed before.

Matteo Tomasini: So you’re saying that corporate investigations goes quicker?

Kacper Piwowar: Ultimately, they’re trying to, you know, because there is a greater time crunch, how you prioritize different leads is taken into account, right? Like, you don’t have all day to kind of be super thorough and take as much time as you like. I think there’s time pressures that are unique to the corporate setting that maybe are not as unique to, let’s say, on the law enforcement side.

AJ Nash: There’s a resources difference, right? Coming out of the government space, attribution’s more important sometimes in the government space ’cause you also have response actions that you may not have in the private sector. If it’s a nation state that hacked a power plant, the government has a response action to that.

That’s a, that’s an act of war. There’s something to that. But also the government has immense resources, tens of thousands of intel professionals in the intelligence community. Most companies, Matteo, I’m curious about your thoughts on this. Most companies I’ve talked to and worked with, you’re talking one or two people.

There aren’t the resources to do it. So like you said, yeah, we’d love to know who did this, but let’s start with can we stop the bleeding? Can we save ourselves and then backtrack to it? But I think resources have as much to do with that as anything. What are your thoughts, Matteo?

Matteo Tomasini: Yeah. It’s resources and then even access to tools. Like, there’s a lot more friction in the government space in terms of getting access to new tools. Like, you know, in the corporate world, you make a case, you get a quote, and then, God willing, you’ll get access to it in a couple of weeks or three weeks.

In the government world, that’s not how it works. We have a government agency in the US who’s been trying to buy our data for a year and a half now, and they desperately need it. They love it. They wanna use it, but they can’t. Meanwhile, we’ve sold to God knows how many corporate clients.

That’s a huge issue. And sometimes they’re not allowed to use certain data, right? Like, OSINT obviously is becoming huge in the government. But there’s still a lot of friction, the high side versus the low side and intermingling data, or God forbid it, there’s anything associated with an American citizen, then it becomes an anathema.

And actually, funny enough, like, Kacper, I think without having a time crunch is something that it actually happens for US law enforcement.but European law enforcement, it’s the opposite. You’re actually judged on how quickly you can close cases.

And that’s why we have greater adoption of our data in Europe than in European law enforcement than US law enforcement because beyond helping to close cases, breach data can help you close cases a lot faster.

Like, there’s investigations that we’ve done in three minutes that have taken other people like three years. 10 minutes versus three years. I’m exaggerating a little. But it’s a huge time saver. And in Europe they’re like, “Oh, we need to save as much time as possible.

Let’s get the best tools. Let’s find every way possible. Let’s use breach data. Let’s get nice social media platforms, et cetera.” Whereas in the US, you can have a case sitting, and I’m not in law enforcement, this is what I’ve been told, for months, even a year, and it doesn’t really affect your performance rating or whatever.

Whereas like in Germany, “Oh my God, you have to really get on your cases, otherwise, you’re not gonna move up.”

Kacper Piwowar: Yeah. That’s interesting, the discrepancy between the two.

AJ Nash: Yeah. Well, it’s a good point. And I mean, I chimed in and said terrible metric. Maybe that’s an oversimplification. You do want people that are efficient trying to get work done, right? So there’s good in that, but it’s that balance between are you doing that or are you rushing people through, you know, and just trying to close cases, right?

So it’s a tough spot. You know, what is the right amount of time to spend on an investigation? What is the right speed at which you need to get to a point of prosecution if there’s gonna be one or clearing somebody? I don’t think there’s a right answer to that. It’s a tough place to be for sure.

Listen, this has been a really interesting discussion. I’m sure we could talk for a long time. We’ll have to have you back because I would love to get into some actual war stories. Obviously sanitized for everybody’s protection. But

I’m curious if you have one, like people love a good story. Do you have one really cool war story off the top of your head?

Matteo Tomasini: Oh, man. I mean, I’ve probably done like hundreds and hundreds of investigations like over the years. They’re all kind of interesting, exciting. Like the ones that have always like been my favorite are the threat attribution cases, you know, trying to identify who’s behind, you know, a certain account.

There was one, actually a really interesting one, where we were contracted by a media entertainment company. And they were looking to identify, you know, someone who was essentially trying to hack into their systems.

He had a very common username, so that wasn’t a greatlead. but he was present on Discord. So kind of again, mother being the necessity of invention, I started writing tools to scrape and collect data from everyDiscord message board that this person was in.

We just had his Discord handle, basically. From there got a Steam ID, ’cause he mentioned one time to a friend like, “Hey, I’m on Steam. This is my tag,” or I forget what it’s called, Steam username or whatever. Found his Steam ID.From there, leveraged a tool that let you find all previous Steam IDs.

I think it was like callsteamid.eu or something like that. Part of it was knowing that this tool even exists, right? Like knowing that people change their usernames and there is this tool out there. There’s a few now, I think. This was maybe seven, eight years ago, where you can see all of them and find a more uncommon username.

Started pivoting on that. Long story short, found the guy. Ended up being someone in Australia and after told the client, they sent someone to their door. Turned out that this person was actually wanted by Interpolforproducing child exploitation material, and they’d been searching him for like two, three years or something like that.

But was kind of able to get there using all the different tools that I had access to then to find this person. So that was like a nice win. Yeah.

AJ Nash: That is a great win and a great story. It’s a great example of the power of investigation. The power of open source investigation and tradecraft and experience and tools and I think you had the good point about access and time and limitations. Sometimes governments have limitations, private sector doesn’t, and sometimes it’s in reverse.

So that’s an awesome story. I always love hearing about bad guys getting wrapped up.

Kacper Piwowar: In fun ways.

AJ Nash: So listen, we’re running out of time here. I do wanna wrap up the show. Any last thoughts, Matteo? Anything you wanna leave the audience with? Anything we missed? Anything you wanna to talk about before we close out for the day?

Matteo Tomasini: For people trying to get into this industry or trying to become a better investigator, the most important thing is just learning what’s possible as an investigator. That was one of my limiting things when I first started as an analyst.

I just didn’t know what was possible. What kind of data was out there, what kind of tools were out there, how you could connect different data sources together, either programmatically or thematically. So yeah, just kind of understanding what’s out there, educating yourself on the process to exploit those different resources and then just keep hammering context.

Like when you get those results, understanding exactly why those results are what they are, and then, spending the right amount of time to determine how valuable they are and how they might help with your investigation. And then, of course, appreciating how valuable all different data sources are.

But again, I’m obviously, you know, biased. I think leveraging breach data in your investigations, whether you get it from District4 or whoever it is, just use them. That’s something I’ve been kind of on the road on the last three years, just saying like, “I don’t care if you get it from me, just get it from somebody,” ’cause breach data is probably one of the best data sources you can have, and it oftentimes serves as the glue connecting all these other different data sources together. So get it one way or another.

AJ Nash: Fantastic. So again, thank you for being on the show today. Really appreciate you sharing your wisdom and your knowledge and your experience and your stories. I really appreciate it. I think some fantastic points here, for people about the importance of tradecraft and where AI fits into the picture and how powerful the investigative process is and what the outcomes can be.

So, I want to thank you for being on the show. For everybody who’s listening and watching, thank you as well. This show is really about guests like Matteo and folks like you who listen and watch. It’s not about us, so please like, subscribe, all those things. If you have feedback, please provide that.

Kacper will read it all. It’s good stuff, I’ll hear about it, and if it’s not, I won’t,’cause I don’t like bad news. We’ll work to improve the show. We’re always trying to. Check us out. We’re all over the internet if you want to find us.

You can check us out at Authentic8’s website. It’s authenticate, number eight, dot comslash needlestack. You can find us on social media. Follow and spread the word ’cause we want to make sure we have more great guests like Matteo and a chance to have more opportunities to have these great conversations.

Kacper Piwowar: Thank you, Matteo. It was a pleasure. Love getting the different perspectives. I think it’s important. I think we covered quite a bit. And all of it is very relevant to the different sort of digital investigators that we work with, that we talk with, because this is, you know, it’s a big industry, but it’s a small industry at the same time.

And I think sharing best practices is key. And then to one of the things that Matteo, that you said that I think is important is understanding that there is a whole host of different types of tools out there to help you get to the outcomes that you need to. You just have to understand the art of the possible.

AJ Nash: Very true. Good words to finish with. All right, so thanks again, everybody. Appreciate it. With that, we’ll close out the show for today. This has been another episode of NeedleStack