Cyber Threat Intelligence

This research line at TU/e SEC is led by Luca Allodi and Emmanuele Zambon and studies the cybercriminal ecosystem as a source of threat intelligence. Underground forums, closed marketplaces and Telegram communities are where attack tools, stolen data and criminal services are advertised and traded. Threat intelligence collected there is used for situational awareness, to prioritise defences and to support law enforcement. Our work asks three related questions: which of these communities are relevant to the threat landscape, what attackers actually buy once a market works, and how researchers and analysts can find and collect data from these communities at scale. A recurring element across the work is the use of economic theory, in particular information asymmetry and signalling, to explain why some criminal markets function and others do not.

Which communities matter

A large part of threat intelligence work implicitly assumes that if cybercrime is discussed or advertised in a community, that community matters for defenders. Earlier work in economics of security already questioned this: markets where buyers cannot judge product quality, and sellers cannot be held to their promises, tend to fill up with scams, old malware and recycled data. Following Akerlof, these are “markets for lemons”. Activity in such a market says little about the threats organisations actually face.

In [1], we turned this observation into an evaluation framework. Starting from the literature and a manual investigation of underground forums, we identified 28 market mechanisms that address moral hazard and adverse selection, such as restricted access, seller verification, escrow, dispute resolution and reputation systems, and organised them along the Business Model Canvas. We applied the framework to 23 underground forum markets. As an external indicator of a market’s relevance, we searched these forums for 836 aliases of cybercriminals who were later indicted, taking a link between a convicted seller and a market as evidence that the market can support trade in effective criminal products. Markets where convicted criminals were active resembled each other more than they resembled the other markets. In particular, they had administrators who did not take part in trade themselves, verified their sellers, and had economic incentives to keep the market working.

Telegram has since become an important venue for cybercrime, but it lacks most of the structures that forums use to build trust, such as persistent identities, reputation scores and moderated dispute processes. In [3], together with the Cambridge Cybercrime Centre, we studied how trust is established in this setting using signalling theory. We analysed 1.1 million messages from 167 cybercriminal Telegram communities, identified six market segments (cyberattacks, digital infrastructure, digital piracy, fraud tools, personal data, and tutorials), and built a framework of the trust signals sellers and administrators use, from proof-of-delivery messages and vouching to pinned rules, escrow and automated bots. A methodological contribution of the paper is a Monte Carlo simulation of user browsing, which estimates how many of these signals a buyer actually encounters. Signal counts at community level give a different picture than signal exposure at user level: vouching systems, for example, are frequent in cyberattack communities overall, but more than 99% of them sit in a single community, so a typical user rarely sees one.

Exposure to trust signals differs strongly between market segments and changes over time. Trust on Telegram also relies more on individual sellers than on market-level mechanisms, which makes the ecosystem more fragmented than forums. For threat intelligence this means that a single, static monitoring approach is unlikely to capture what happens across segments.

What attackers buy

Once a market functions, the next question is what its customers want. Most studies of underground markets rely on indirect signals, such as user feedback, to infer sales, or on leaked databases of markets that have already closed. In [2] we used a feature of a leading, invite-only Russian market for Impersonation-as-a-Service (pseudonymised as IMPaaS.ru, first characterised in [7]) that made it possible to observe which individual stolen user profiles were sold. Each profile contains browser fingerprints, cookies and credentials that let an attacker impersonate the victim. Over 161 days we tracked 11,357 advertised profiles, of which 1,193 were sold. The paper documents how to monitor a closed market over time while avoiding its anti-crawling measures, and how to analyse the resulting incomplete, high-dimensional data.

We estimated sales of up to about 700 profiles per day and a revenue between 540k and 715k USD over the observation period. Supply was stable and dominated by European profiles, while demand was concentrated on specific profile types, including profiles from North America and profiles with access to cryptocurrency services. Modelling the purchase decision shows that the wealth of the victim’s country and the browser and cookies included in a profile explain much more of the decision than price or the set of stolen credentials. We interpreted these preferences within an existing cyber-risk model, which links measurements on criminal markets to the risk faced by different groups of users.

Finding and collecting the data

Both questions above depend on access to data from communities that are dispersed, short-lived and often protected against automated collection. A third part of our work therefore develops methods and tools for discovery and collection, which are made available to other researchers where possible.

On Telegram, new communities are mostly found by following references from known ones. In TeleHunt [4] we built a modular pipeline that starts from seed communities taken from the open or dark web, classifies messages as cybercriminal or not and by market segment using fine-tuned language models, and then expands the search by following pointers to other communities. Earlier studies characterised fixed collections of communities. TeleHunt is designed to compare discovery strategies with each other. The evaluation shows that invitation links are the most productive type of pointer, compared to user handles and forwarded messages, while additional context filtering adds little. Most communities found were public or lightly gated, and fraud tools and cyberattack communities were the most frequent and the most connected to other segments. Rediscovery of already-known communities stayed low, which suggests that the reachable ecosystem is far from exhausted. The resulting labelled dataset covers 6,022 communities (3,471 of them cybercriminal) and 172 million messages.

For forums, earlier work in the group produced THREAT/crawl [6], a trainable crawler that can be reused across forum layouts. METEORA [5], developed in a student project, addresses the operational side of long-running forum collection. Forum-specific navigation and extraction are isolated in adapters, while the shared system manages sessions, checkpoints, recovery after blocks, and coordination of multiple scrapers. Browser-level evasion reduces the automation artifacts that forum defences look for. In tests on three active forums, single workers ran for more than four hours each, recovered from route blocks and session replacement, and a new forum could be added without changing the generic worker logic.

Outlook

Current work extends these lines to the longitudinal evolution of the Telegram underground, including migration between platforms after law enforcement action, and to the connection between what is observed in criminal markets and the decisions made by defenders in security operations.

References

1. M. Campobasso, R. Rădulescu, S. Brons, and L. Allodi. You Can Tell a Cybercriminal by the Company they Keep: A Framework to Infer the Relevance of Underground Communities to the Threat Landscape. In Workshop on the Economics of Information Security (WEIS), 2023. arXiv:2306.05898
2. M. Campobasso and L. Allodi. Know Your Cybercriminal: Evaluating Attacker Preferences by Measuring Profile Sales on an Active, Leading Criminal Market for User Impersonation at Scale. In 32nd USENIX Security Symposium, pp. 553–570, 2023. Paper
3. R. Ricaldi, T. Marjanov, L. Allodi, and A. Hutchings. Uncovering the Trust Signals Supporting Telegram’s Cybercrime Economy. In 2025 APWG Symposium on Electronic Crime Research (eCrime), 2025. doi:10.1109/eCrime66972.2025.11327769
4. R. Ricaldi, V. Asanache, and L. Allodi. TeleHunt: A Framework and Tool for Efficient Cybercriminal Community Discovery on Telegram. arXiv preprint, 2026. arXiv:2606.04657, code
5. Z. Petrov. METEORA: Modular Evasive Thread Extractor Orchestrating Resilient Adapters. Technical report, Eindhoven University of Technology, 2026.
6. M. Campobasso and L. Allodi. THREAT/crawl: a Trainable, Highly-Reusable, and Extensible Automated Method and Tool to Crawl Criminal Underground Forums. In 2022 APWG Symposium on Electronic Crime Research (eCrime), 2022. doi:10.1109/eCrime57793.2022.10142081
7. M. Campobasso and L. Allodi. Impersonation-as-a-Service: Characterizing the Emerging Criminal Infrastructure for User Impersonation at Scale. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pp. 1665–1680, 2020. doi:10.1145/3372297.3417892