Cybercrime revenue streams and money laundering techniques

An investigation into cybercriminal financial operations, following the money to examine how threat actors generate, transfer, and launder illicit proceeds, including the operational security and threat modelling required to safely perform this research and which OSINT and blockchain tools and techniques to use. 

This presentation summarises the highlights of four years of research exploring how cyber criminals make a profit, tracing back how they steal or extort money and how they ultimately get to spend it. For decades the cyber security community has focused on stopping threat actors by patching vulnerabilities, but this approach alone is clearly not enough. We need to target their financial operations. 

Through this research, it became clear that there is a lot of misleading information online and a general lack of understanding about this topic within the cyber security community. This presentation takes the audience through that research journey, helping them understand the fundamental techniques that allow cybercriminals to profit. There is a lot more work to be done in this space, and the goal is to inspire more professionals to explore this lesser examined area of cyber security. 

The presentation covers the following topics: 

1. Operational Security:​How to set up operations to conduct this kind of research, the threat modelling involved and what options are available, from air-gapped laptops and Tails to Qubes OS and VMs
2. Blockchain Primitives:​Since the majority of cybercrime transactions happen in crypto, a deep dive from the basics of KYC, CEX, DEX and bridges and how they are used by criminals, then exploring in detail how chains like Monero and Zcash are being leveraged and how smart contracts like Tornado Cash are used to successfully launder money. This includes which techniques and tools to use to track transactions on and off chain, with a mix of OSINT, Tor and block explorer tools.
3. Money Laundering Techniques:​ An in-depth analysis of layering techniques aimed at obfuscation and anonymisation, followed by a review of integration strategies based on the amounts being laundered
4. Case Studies:​Real-world examples including the Lazarus Group, which managed to launder hundreds of millions, as well as how InfoStealers and ransomware groups go from demanding a ransom to laundering it.
5. Countermeasures:​ Novel techniques that can be used to combat cybercriminals, such as blacklisting assets when they travel through certain chains, deploying nodes to weaken Monero, and other emerging approaches.
6. Future Challenges:​ A look at the evolving challenges in the space of dark web and cybercrime transactions.

​