Cyber Defense eMagazine May 2019

QIDs from associated metadata, the inquiry can reveal the location, associates, aliases, and true
identities of malicious actors. Just as important, artifacts can also provide insight into past, present and
future activities.
Use case #1: Oleksandr Ieremenko
In 2016, the U.S. Department of Justice secured a guilty plea from a New Jersey man who was part of a
complex insider trading scheme that exploited confidential information stolen from three separate
business news wire services. Prosecutors alleged that the scheme netted tens of millions in illegal profits.
The indictment also identified the still-at-large technical mastermind who hacked into the business
wires—a Ukrainian citizen named Oleksandr Ieremenko
Mining the indictment for names, email addresses, online handles and other identifiers, we were able to
run a series of PAI queries just on Ieremenko. Obviously, we already had a true identity to go on, but the
query was fruitful for several reasons. First, we learned a lot about Ieremenko’s associates. While these
malicious actors weren’t indicted, learning who they were and where they operated gave us a better
context for understanding the types of malware and tools Ieremenko typically sought to secure. In turn,
that information turned up a lot of useful information about Ieremenko’s skills, capabilities and past
targets. We were even able to assess, with a high degree of confidence, what sorts of targets and
schemes Ieremenko was working on before, during and after the indictment.
Use case #2: The Iranian Professor
Using an email address associated with a spear-phishing campaign, we ran a PAI query. As it turned out,
this hacker employed sloppy tradecraft by failing to more fully obfuscate QIDs associated with the creation
of the email address. While sloppy tradecraft may sound like a lucky break, the key point is that hackers
are human. They make human mistakes because they’re lazy, careless, poorly trained, pressed for time,
etc. These mistakes leave behind artifacts that analysts and investigators can exploit.
In any case, our PAI query told us that the hacker was an Iranian professor. With her true identity, we
were able to discover her location, associates, and develop information about her activities, past, present
and future. Just as important, we were able to reduce the likelihood that we were meant to discover her
true identity as part of a false flag operation.
Unfortunately, this hacker hasn’t been brought to justice—and likely won’t be. Nevertheless, her identity,
area of operation, skill-level, and modus operandi provides a powerful check on her operations going
forward.
123