anonymous masked hacker man over dark space, terrifying male sit with laptop, want to get access to data. young hacker have his own methods to access to any kind of system wherever
The demands of modern cybersecurity call for tracking malicious groups by looking beyond standard network indicators. Threat actors have become quite adept at concealing both identities and infrastructures. So defense teams must become open-source intelligence (OSINT) experts in order to track them down.
One of the most effective, yet frequently overlooked, techniques is the OSINT threat actor investigation that analyzes leaked document properties. These properties are also known as metadata.
When threat actors publish leaks or leave operational files behind on a compromised server, they also expose structural data embedded within those files. The same is also true for documents included in phishing attacks. Security analysts can systematically analyze the information, allowing them to pivot from an isolated incident to more advanced threat attribution.
The Basics of Document Metadata
Whenever a digital document is created or modified, the software used to do the job embeds hidden information within its file structure. This is true whether you are creating a text document, PDF, spreadsheet, or image. Embedded metadata can include everything from the creator’s username to the very time and date the document was created. Some software packages even embed information pertaining to language and operating system.
The data exists to assist with file management and collaboration across different systems. But it is also a gold mine for security experts looking to trace careless threat actors who either don’t know about the metadata or do not think it can be weaponized against them. Imagine a ransomware group publishing data collected during a phishing lure. Metadata artifacts left in their documents contribute to a unique fingerprint that could ultimately identify them.
How Properties Are Turned Into Attribution
DarkOwl, a leading provider of OSINT tools and threat actor intelligence, explains that document properties can be leveraged for attribution purposes. Security experts establish patterns across multiple incidents, then analyze those patterns to turn raw metadata into actionable intelligence.
1. Visual and Language Clues
Document metadata often reveals the default language or keyboard layout of the author’s system. Therefore, if multiple documents associated with a particular incident show similar creation paths for default templates in a specific language, investigators can narrow down the incident’s geographical origin.
2. Embedded Usernames
Certain types of apps, like office suites, make it possible for authors to embed their names. Security analysts can look at the ‘author’ and ‘last modified by’ fields to get either real names or network usernames. Name identifiers can be tracked across different operations for the purpose of linking seemingly unrelated incidents to a single individual or group.
3. Constructing Timelines
Timestamp data embedded within a document’s properties can reveal an author’s work hours. By plotting creation dates and times on a graph, security analysts can align incidents with threat actor operational habits and time zones.
Essential OSINT Tools for Metadata Analysis
Making use of document metadata is a lot like putting together a puzzle. You lay out all the pieces and analyze them to see how they fit together. DarkOwl says security teams rely on a set of essential OSINT tools to get the job done.
ExifTool is a command-line app that reads, writes, and looks at metadata across multiple file types. FOCA extracts hidden information while also automating the task of mapping usernames, servers, and software versions. Analysts also use a variety of online analyzers to safely check file headers and properties without putting their own systems at risk.
Digital documents leave breadcrumbs of data that can be used to identify and track threat actors. Whether they know it or not, carelessly leaving behind documents rich with metadata jeopardizes their identities and locations.
About the Author
