A PI operates with legal, ethical, and defensive motivations:
- The PI carefully follows the digital profiling pipeline: foundation & planning, psychological analysis, OSINT/SOCMINT data gathering, IMINT verification, behavioral analysis, and multi-sourcing.
- Unlike a threat actor, the PI must perform an ethical and legal check, ensuring all collected evidence can be used in court, supporting actions like victim protection or threat attribution rather than exploitation.
- The PI examines:
- Alias links, forum posts, public breach data, and social networks to map out the threat actor’s digital presence.
- Behavioral TTPs (Tactics, Techniques, Procedures), motivations (financial gain, ideology, revenge, etc.), and technical capabilities, often using industry tools to track trends and gather evidence.
- Phase 1: Foundation/Planning
- Define intelligence requirements: Proof of threat’s intent, methods, and identity.
- Set objectives: Attribution, risk mitigation, and enabling defensive response.
- Phase 2: Psychological & Motivational Profiling
- Evaluate motivation (e.g., financial, political), communication style, and escalation patterns.
- Assess emotional states, operational patterns, or group affiliations.
- Phase 3: OSINT/SOCMINT Collection
- Gather public data: darknet forum mentions, past hacks, domain registrations, cryptocurrency trails.
- Use social engineering defensively (e.g., controlled engagement) for evidence—not for manipulation.
- Phases 4-7: Verification and Triangulation
- Cross-reference data across leaks, public breach databases, and imagery intelligence (IMINT) for real-world tie-ins.
- Multi-source verification to avoid bias or planted false flags.
- Phases 8-9: Counter-OSINT & Reporting
- Audit and protect investigative methods to avoid tipping off the target.
- Compile an evidence-based, court-ready report, ensuring all data gathered respects legal thresholds.
- Pseudonyms, cryptocurrency wallets, communications on forums, malware development, historical campaigns, breach patterns, preferred victims, exploited vulnerabilities, group memberships, and operational infrastructure.
- The process includes specific tools and methods (e.g., AI-driven link analysis, dark web monitoring platforms, reverse image tools, and geolocation software) to legally support law enforcement, corporate defense, or targeted advisories.
- The PI must recognize the threat actor may attempt disinformation, OPSEC (operational security), or plant misleading artifacts, so a “trust but verify” approach is mandatory.
- Defensive review includes stripping metadata, auditing investigative practices, and maintaining confidentiality to protect both the investigator and the integrity of the evidence.
back to the main guide