FOR589: Cybercrime Investigations

This section covers the intelligence lifecycle in cybercrime investigations, emphasizing structured methods for threat profiling, persona management, and secure data collection from underground sources. Students will learn to turn fragmented data into actionable intelligence to support investigations and strategic decisions.

This section teaches students to trace illicit cryptocurrency activity using blockchain analytics and attribution techniques. Through real-world case studies, students will learn to follow laundering tactics, cluster wallets, and use OSINT and off-chain data to link transactions to threat actors, aiding in investigations and asset recovery.

In this section, students learn how to safely navigate and investigate cybercriminal communities across surface, deep, and dark web environments. Uncover how forums, leak sites, messaging platforms, and infrastructure tie together into a functional underground economy—and how adversaries interact to buy, sell, and monetize access, data, and capabilities.

In this section, students will learn how to infiltrate gated criminal communities, build credible personas, and collect human intelligence (HUMINT) directly from threat actors. You’ll explore both manual and automated approaches to collecting data, from eliciting adversaries through social engineering to scraping dark web content at scale.

The final day of FOR589 is a capstone challenge that focuses on launching an investigation. Students engage in a fun and meaningful exercise that brings together various components of the entire course. The capstone will reinforce the principles taught via a simulated scenario that enables students to practice implementing their newly learned skills.