Hackfest - Level UP

Matheus Bezerra

Matheus Bezerra is a Software Engineer at Apura Cyber Intelligence, working on cybersecurity, OSINT, large-scale data processing, and threat intelligence platforms. His work focuses on building systems that collect, structure, enrich, and analyze large volumes of online intelligence. He holds a B.Sc. in Computer Science and is pursuing graduate studies in Data Science.

Your twitter or other social network:

https://www.linkedin.com/in/matheus-bezerra-6296b7221


Session

10-30
18:30
50min
From Isolated Events to Connected Evidence: Structuring Fragmented Cybercrime Data
Matheus Bezerra

Cybercrime investigations rarely begin with a clean dataset. They begin with fragmented information scattered across forums, Telegram channels, marketplaces, leak sites, credential sales, and actor conversations.

This case study shows how a real-world collection of isolated cybercrime events was transformed into connected investigative evidence. Individual events initially appeared unrelated, but many contained small traces such as aliases, contact handles, cryptocurrency wallets, domains, URLs, organization names, and infrastructure that could be used to identify relationships between actors, targets, and recurring criminal activity.

Using sanitized examples, we will walk through how these artifacts were extracted, normalized, enriched, and compared across different sources. We will also show how contextual analysis helped identify intent, risk indicators, criminal activity types, relevant entities, and recurring behavioral patterns.

The session focuses not only on successful connections, but also on the investigative decisions behind them, including which signals were useful, which produced noise, where automated analysis helped, and where human validation remained necessary.

Attendees will leave with a repeatable approach for turning fragmented cybercrime data into structured evidence that can support triage, monitoring, attribution hypotheses, and deeper investigations.

Threat Intelligence / OSINT
Track 2 (306A)