IT Forensics · OSINT

OSINT investigation following a ransomware incident

Following a ransomware incident, research into publicly available information provides important additional insights: Which group can the ransom note and tools be attributed to? What methods are known to be used by this group? Is company data being advertised on a leak site? This research complements the technical investigation, but does not replace it.

Enquire without obligation

This point is particularly important in OSINT research, as the scope, quality and reliability of publicly available information can vary greatly depending on the research question, the individual or organisation concerned, and the platform used. Corporate research, an infrastructure analysis and the verification of a single piece of social media content must not be treated in the same way. The source, timeliness, verifiability and legal framework determine which information is reliable and which research method is appropriate.

We are also investigating whether cryptocurrency payment addresses demanded as part of a potential blackmail scheme can be publicly linked to other incidents.

Technical background

Groups leave behind recognisable tell-tale signs: the structure of the ransom note, file extensions, contact portals, Tor addresses and tools. Security researchers and authorities publish indicators (IOCs) and reports on this. Payment addresses on public blockchains can be analysed, but links to specific individuals can only be established to a limited extent.

Relevant evidence and data sources

  • Ransom note, file extensions and contact details
  • Public threat intelligence reports and IOC lists
  • The group’s leak pages (monitoring and documentation)
  • Wallet addresses and transaction histories

Why LanCologne?

LanCologne does not conduct OSINT investigations according to a standardised, one-size-fits-all approach, but rather on the basis of the specific question of evidence, the available public sources and the relevant legal framework. Our staff have decades of experience in information technology and many years of practical experience in IT forensics.

Here’s how we do it

  • Recording of the blackmail note and technical details.
  • Cross-referencing with public sources and identifying points for forensic analysis.
  • Documentation of sources, including the date and an assessment of their reliability.

Borders

  • OSINT does not usually identify perpetrators as individuals.
  • Information provided by groups (e.g. on leak sites) may be inaccurate or exaggerated.

Possible results

  • Probable group allocation, with reasons given
  • Best practices as a checklist for forensic analysis
  • Documentation of leak announcements

Typical areas of application

•Judicial and non-judicial expert reports
•Supplementary investigations as part of existing IT forensic investigations
•Support for businesses, solicitors, courts and public authorities
•Verification of digital traces and online content
•Analysis of corporate, infrastructure and threat intelligence from open sources
•Investigating incidents of fraud, trademark infringement and cyber security breaches
•Cross-checking of automatically generated search results
•Documentation and archiving of ephemeral online content
•Documentation for courts, solicitors, insurance companies, public authorities and businesses

Why is this area of investigation relevant to forensics?

Following a ransomware incident, researching publicly available information on the malware used and the attackers’ infrastructure can usefully complement the technical investigation of the incident.

The forensic value lies not solely in the volume of information found, but in its source and reliability. A single social media post, a register entry or a technical infrastructure note can be misleading without context. That is why we document how a piece of information may have come about, what alternative explanations exist and what further sources support the finding.

We are also investigating whether cryptocurrency payment addresses demanded as part of a potential blackmail scheme can be publicly linked to other incidents.

Particularly in the case of OSINT research, attempts at full verification may also reach their limits if online content has been deleted, made private or deliberately designed to be misleading. A lack of verifiability, closed platforms and rapidly changing content highlight why timely documentation and transparent communication of existing limitations are so important prior to the actual analysis. Omissions at this stage cannot always be rectified later on.

Frequently Asked Questions

How can an OSINT investigation help following a ransomware incident?+
It can usefully complement the technical investigation, for example by researching the malware used and the publicly identifiable attacker infrastructure.
Does this research replace technical incident analysis?+
No, it complements the technical investigation but does not replace the forensic analysis of the systems concerned.
Can the attacker be identified through such an investigation?+
It is often not possible to identify individuals beyond any doubt; however, we document reliable evidence, where this is publicly available.
How soon should such an investigation begin following an incident?+
As soon as possible, as relevant public traces relating to the attacker’s infrastructure can change rapidly.
Does the mapping help with decryption?+
Sometimes: Decryption tools have been released for individual families. This is rarely the case with the latest variants.
Is it legal to search on leak sites?+
Monitoring and documenting – yes; downloading published data requires legal review.
Is OSINT replacing forensic analysis?+
No. OSINT provides context; forensics determines what happened within one’s own network.

Related topics

🔗 Related topics

LanCologne – IT Forensics OSINT Cologne

Do you require professional OSINT research on „OSINT investigation following a ransomware incident"? LanCologne supports you in the structured, documented analysis of publicly available digital sources in the context of existing IT forensic, legal or internal corporate enquiries. The key here is not to generate as many hits as possible, but to secure technically sound and verifiable information.

Get in touch now