# Never use your personal or work network directly

Research Environment Options:
├── Dedicated Hardware
│   ├── Air-gapped laptop for high-risk research
│   ├── Separate network connection (mobile hotspot)
│   └── Hardware write blockers for media analysis
│
├── Virtual Environment
│   ├── Whonix (Tor-routed Debian VMs)
│   ├── Tails (amnesic live system)
│   └── Qubes OS (compartmentalized VMs)
│
├── Network Isolation
│   ├── VPN (non-logging, paid with crypto)
│   ├── Tor Browser (never maximize window)
│   └── Multi-hop: VPN → Tor → (VPN)
│
└── Identity Separation
    ├── Dedicated research personas
    ├── Separate email (ProtonMail, Tutanota)
    └── Cryptocurrency for any transactions

# Whonix is recommended for dark web research
# Two-VM architecture: Gateway (Tor) + Workstation

# Download from whonix.org
# Import both OVA files into VirtualBox

# Gateway VM settings:
# - Network Adapter 1: NAT
# - Network Adapter 2: Internal Network "Whonix"

# Workstation VM settings:
# - Network Adapter 1: Internal Network "Whonix"

# All traffic from Workstation routes through Tor Gateway
# Even if Workstation is compromised, real IP is protected

# Update Whonix (in Gateway and Workstation)
sudo apt-get update && sudo apt-get dist-upgrade

# Install additional tools (Workstation)
sudo apt-get install mat2 bleachbit keepassxc

Credential Sources to Monitor:
│
├── Stealer Logs (Redline, Raccoon, Vidar, LummaC2)
│   ├── Full browser data (passwords, cookies, autofill)
│   ├── Cryptocurrency wallets
│   ├── VPN and RDP credentials
│   └── Sold in bulk on Telegram and markets
│
├── Breach Databases
│   ├── Collections (Collection #1-5, COMB)
│   ├── Service-specific breaches
│   ├── Combo lists (email:password pairs)
│   └── Sold or leaked on forums
│
├── Phishing Kits
│   ├── Real-time credential capture
│   ├── Session cookies (MFA bypass)
│   └── Often sold to other actors
│
└── Initial Access Brokers (IABs)
    ├── VPN/RDP access to corporate networks
    ├── Web shell access
    ├── Citrix, VMware, Pulse Secure credentials
    └── Priced by company revenue/size

#!/usr/bin/env python3
"""
Credential exposure monitoring using public APIs
For educational purposes - use commercial services for production
"""
import hashlib
import requests
import time

def check_hibp(email: str, api_key: str = None) -> dict:
    """Check Have I Been Pwned for email breaches"""
    headers = {
        'User-Agent': 'CredentialMonitor/1.0',
        'hibp-api-key': api_key  # Required for production use
    }
    
    url = f"https://haveibeenpwned.com/api/v3/breachedaccount/{email}"
    
    try:
        response = requests.get(url, headers=headers, timeout=10)
        if response.status_code == 200:
            return {'breached': True, 'breaches': response.json()}
        elif response.status_code == 404:
            return {'breached': False, 'breaches': []}
        else:
            return {'error': f"API returned {response.status_code}"}
    except Exception as e:
        return {'error': str(e)}

def check_password_pwned(password: str) -> int:
    """Check if password appears in breach databases using k-anonymity"""
    # Hash password with SHA-1
    sha1_hash = hashlib.sha1(password.encode('utf-8')).hexdigest().upper()
    prefix = sha1_hash[:5]
    suffix = sha1_hash[5:]
    
    # Query HIBP Passwords API (anonymous, no API key needed)
    url = f"https://api.pwnedpasswords.com/range/{prefix}"
    response = requests.get(url, timeout=10)
    
    # Check if our suffix is in the results
    hashes = (line.split(':') for line in response.text.splitlines())
    for h, count in hashes:
        if h == suffix:
            return int(count)
    return 0

def monitor_domain(domain: str, api_key: str) -> list:
    """Get all breaches affecting a domain"""
    headers = {
        'User-Agent': 'CredentialMonitor/1.0',
        'hibp-api-key': api_key
    }
    
    url = f"https://haveibeenpwned.com/api/v3/breacheddomain/{domain}"
    response = requests.get(url, headers=headers, timeout=30)
    
    if response.status_code == 200:
        return response.json()
    return []

# Example usage
if __name__ == "__main__":
    # Check password (safe - uses k-anonymity)
    count = check_password_pwned("password123")
    print(f"Password found in {count:,} breaches")
    
    # Note: Email/domain checks require HIBP API key
    # Get one at: https://haveibeenpwned.com/API/Key

Forum Classification:
│
├── Tier 1: Elite/Exclusive
│   ├── Invite-only, vouched membership
│   ├── Exploit developers, APT-linked actors
│   ├── Zero-day sales, nation-state tools
│   └── Examples: (invite-only Russian forums)
│
├── Tier 2: Professional Criminal
│   ├── Vetted membership, deposits required
│   ├── Malware devs, ransomware affiliates
│   ├── Corporate network access sales
│   └── Examples: XSS, Exploit.in, RAMP
│
├── Tier 3: Mid-Level
│   ├── Registration + activity requirements
│   ├── Carding, fraud, DDoS services
│   ├── Credential sales, RaaS affiliates
│   └── Examples: BreachForums, Cracked.io
│
└── Tier 4: Entry Level
    ├── Open or easy registration
    ├── Script kiddies, low-skill actors
    ├── Tutorials, leaked tools, HQ sharing
    └── Examples: Various clearnet forums

Telegram OSINT Methods:
│
├── Manual Monitoring
│   ├── Join public channels (use burner account)
│   ├── Search @username or t.me/channelname
│   ├── Use web.telegram.org for screenshot safety
│   └── Monitor channel exports with Telegram Desktop
│
├── Automated Collection
│   ├── Telethon library (Python)
│   ├── TelegramBot API for public data
│   └── Commercial: SocialLinks, Maltego, Babel Street
│
├── Search Tools
│   ├── tgstat.com - Channel statistics
│   ├── lyzem.com - Telegram search engine
│   ├── telegram-group.com - Group directory
│   └── IntelligenceX - Telegram message search
│
└── Key Channel Types
    ├── Ransomware group announcements
    ├── Stealer log marketplaces
    ├── Carding/fraud channels
    ├── Data breach announcements
    └── Hacktivist coordination

#!/usr/bin/env python3
"""
Telegram channel monitoring using Telethon
Get API credentials from: https://my.telegram.org
"""
from telethon import TelegramClient
from telethon.tl.functions.channels import JoinChannelRequest
import asyncio
import json
from datetime import datetime

# API credentials (get from my.telegram.org)
API_ID = 'your_api_id'
API_HASH = 'your_api_hash'
PHONE = '+1234567890'

# Channels to monitor (use invite links or usernames)
CHANNELS = [
    # Add channel usernames or links
    # Example: 'channelname' or 'https://t.me/channelname'
]

# Keywords to alert on
KEYWORDS = [
    'your_company',
    'your_domain.com',
    'ransomware',
    'data leak',
    'credentials',
]

async def monitor_channels():
    async with TelegramClient('monitor_session', API_ID, API_HASH) as client:
        await client.start(phone=PHONE)
        
        # Join channels
        for channel in CHANNELS:
            try:
                await client(JoinChannelRequest(channel))
                print(f"[+] Joined {channel}")
            except Exception as e:
                print(f"[-] Failed to join {channel}: {e}")
        
        # Monitor new messages
        @client.on(events.NewMessage(chats=CHANNELS))
        async def handler(event):
            message = event.message.text or ""
            
            # Check for keywords
            for keyword in KEYWORDS:
                if keyword.lower() in message.lower():
                    alert = {
                        'timestamp': datetime.now().isoformat(),
                        'channel': event.chat.username or str(event.chat_id),
                        'keyword': keyword,
                        'message': message[:500],
                        'message_id': event.id
                    }
                    print(f"[ALERT] Keyword match: {keyword}")
                    print(json.dumps(alert, indent=2))
                    # Add alerting logic (email, Slack, SIEM, etc.)
                    break
        
        print("[*] Monitoring started...")
        await client.run_until_disconnected()

if __name__ == "__main__":
    asyncio.run(monitor_channels())

Attribution Confidence Levels:

High Confidence (Multiple corroborating sources)
├── Technical: Unique malware, infrastructure overlap
├── Operational: Consistent TTPs, targeting patterns  
├── Strategic: Timing with geopolitical events
└── Human: HUMINT, legal/government attribution

Medium Confidence (Some corroboration)
├── Shared infrastructure or tooling
├── Similar operational patterns
├── Consistent victimology
└── Some unique identifiers

Low Confidence (Single source or circumstantial)
├── Forum persona claims
├── Malware similarity only
├── Generic TTPs
└── Could be false flag

Example Assessment:
"We assess with MEDIUM confidence that this campaign 
is linked to [Actor] based on:
- Infrastructure overlap with previous campaigns
- Similar phishing lure themes
- Targeting of [sector] consistent with known interests
Caveats: TTPs are not unique and tooling is publicly available."