Studio 471

Many countries have retired checks as a financial instrument, but billions of checks are still written every year in the U.S. This has proved to be a boon to fraudsters. There is an entire underground industry dedicated to stealing and fabricating checks that is not slowing down and is tricky to combat. Often, images of stolen checks are posted on Telegram and offered for sale to other fraudsters. In this Studio 471, Eric Huber, who is Cybercrime Research Leader at TD Bank, discusses why check fraud is such a huge problem and how financial institutions can counter it. Huber is the curator of the Fraudster Glossary, which is an index of terms used on cybercrime forums.

Participants:
Eric Huber, Cybercrime Research Leader, TD Bank
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Cyber deception involves various techniques to manipulate adversaries, whether it’s baiting them with fake resources or trapping them in frustrating loops. Tim Pappa is a former FBI supervisory special agent who specializes in deception techniques. In this Studio 471, Tim discusses what kinds of threat intelligence can be gained from deception techniques, its limitations, the Bell-Whaley framework and how organizations can start their own scalable deception programs.

Participants:
Tim Pappa, Incident Response Engineer - Cyber Deception Strategy, Content Development and Marketing, Walmart
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Over last several years, clusters of English-speaking threat actors have conducted data breaches on a wide scale. These groups come from an online community known as Com or Community. In the beginning, these threat actors mostly focused mostly on harassing each other, stealing short usernames, cryptocurrency and cheating at games. But then they transitioned into serious data theft, extortion and ransomware. They’ve been intensely investigated by private companies and law enforcement, which have collaborated together to uncover some of their real-world identities and resulted in arrests. In this Studio 471, Michael Fletcher, a former Cybercrime Technical Analyst with the Australian Federal Police, describes the origins of The Com, the tactics used by these threat actors and why they pose a threat to organizations.

Participants:
Michael Fletcher, former Cybercrime Technical Analyst, Australian Federal Police
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Telegram has emerged as a significant platform for cybercriminal activity. Threat actors offer goods and services ranging from payment card details to login credentials to malware and other hacking tools. This ecosystem is vast, and it’s challenging to track. Sayak Saha Roy is an assistant professor at Louisiana State University working on online fraud prevention and usable security. He and several colleagues presented a paper at the Usenix Security Symposium in August 2025 titled “DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram.” The paper describes how the researchers used a language model to identify cybercrime-related posts on Telegram channels with a high degree of accuracy. In this Studio 471, Roy describes how it can be used for cyber threat intelligence research, moderation and more.

Participants:
Sayak Saha Roy, Assistant Professor at Louisiana State University, Online Fraud Prevention and Usable Security
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Structuring a cyber threat intelligence (CTI) program differs for every organization depending on size, the assets it is trying to protect and the threat landscape affecting their particular industry. Kobe Shwartz is the Head of Cyber Threat Intelligence and Analysis at Signify and is also the founder of a consultancy, Underdark.ai. He was formerly a Russian cybercrime and espionage analyst in the Israeli government. In this Studio 471, Shwartz discusses how he started the CTI team at Signify, which was formerly known as Philips Lighting. He also discusses how to manage alert overload, the importance of “Dark Web” intelligence and how to measure return on investment in a CTI program.

Participants:
Kobe Shwartz, Head, Cyber Threat Intelligence and Analysis, Signify
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Jacob Larsen was involuntarily pulled into the dark world of doxing, which is the practice of publishing sensitive personal information about someone online with the intent of intimidating, harassing or extorting them. Larsen’s assailants wanted him to turn over a short username he held for an online game. He refused to be extorted and instead began studying doxing in his free time and even interviewed threat actors who run Doxbin, one of the most prominent doxing sites. In this Studio 471, Larsen discusses the effects of doxing, how sites like Doxbin take advantage of legal loopholes and how to defend against being doxed.

Participants:
Jacob Larsen, Threat Researcher, Offensive Security Lead, CyberCX
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Threat actors doing crime online use a variety of precautions and technologies to avoid getting caught. Mick Deben is a cybersecurity consultant with DMC Group in the Netherlands. He recently completed his master’s degree thesis, which focused on creating a knowledge base around these anonymity techniques. The knowledge base is called Concealment Layers for Online Anonymity and Knowledge (CLOAK), and it’s intended to give CTI practitioners another way to fingerprint threat actors. In this Studio 471, Deben discusses how he developed CLOAK and how practitioners can use it.

Participants:
Mick Deben, Cybersecurity Consultant, DMC Group
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Most organizations will be touched by an IT security incident at some point whether it be a data breach, ransomware or fraud. These complex incidents may draw attention from consumers, the media, customers and partners as well prompt legal and regulatory inquiries. This is when organizations’ crisis communications plans are put to the test. How can organizations control the narrative? How can they manage requests for more detail while forensic investigations are underway? What if threat actors drip-feed samples of stolen data? In this Studio 471, Tom Bolitho of FTI Consulting shares how IT security incidents can be managed to minimize reputational damage.

Participants:
Tom Bolitho, Senior Director, Strategic Communications, Cybersecurity & Data Privacy Communications, FTI Consulting
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Security operations centers, or SOCs, are a core defensive component for organizations.  Quickly processing alerts can give a clue if an organization is under attack. But the volume and quality of alerts can greatly vary depending on how well the detection rules have been written. Some rules may return too many low-quality alerts, which can distract analysts from more important ones. Luca Allodi and Koen Teuwen of Eindhoven University of Technology co-authored a recent academic study that examines how to write lower-noise rules for intrusion detection systems (IDSs). The researchers developed six design principles for rule writing that balance specificity with coverage. The aim is to help analysts make better sense of what’s going on in their networks. The research also resulted in the development of a command-line tool, suricata-check, which gives feedback on how a rule written for the Suricata open-source IDS can be improved.

Participants:
Luca Allodi, Associate Professor and head of the Threat Analysis group within the Security Cluster of the Eindhoven University of Technology
Koen Teuwen, PhD Candidate at Eindhoven University of Technology
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/

Roman Sannikov immigrated with his parents from Russia to the United States when he was a teenager. Through his parents, he kept up his Russian-language skills. For more than two decades, he worked as an interpreter for the FBI and U.S. Department of Justice, interviewing cybercriminals and even secretly acting as a moderator of a top but now-defunct Russian language cybercriminal forum. He has worked cyber threat intelligence (CTI) and blockchain analysis companies including Recorded Future, Flashpoint and TRM Labs. He now runs Constellation Cyber, a CTI consultancy based in New York. In this Studio 471, Sannikov shares his insight into the Russian cybercriminal landscape, the evolution of online crime and what lies ahead with ransomware.

Participants:
Roman Sannikov, Founder, Constellation Cyber
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
----------

Stay in Touch!

 Twitter: https://twitter.com/Intel471Inc

LinkedIn: https://www.linkedin.com/company/intel-471/

YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg

Discord: https://discord.gg/DR4mcW4zBr

Facebook: https://www.facebook.com/Intel471Inc/