BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.hackfest.ca//hf2026//talk//WPFKMY
BEGIN:VTIMEZONE
TZID:EST
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10;UNTIL=20061029T070000Z
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:STANDARD
DTSTART:20071104T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000402T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=20060402T080000Z
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
BEGIN:DAYLIGHT
DTSTART:20070311T030000
RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-hf2026-WPFKMY@cfp.hackfest.ca
DTSTART;TZID=EST:20261030T183000
DTEND;TZID=EST:20261030T192000
DESCRIPTION:Cybercrime investigations rarely begin with a clean dataset. Th
 ey begin with fragmented information scattered across forums\, Telegram ch
 annels\, marketplaces\, leak sites\, credential sales\, and actor conversa
 tions.\n\nThis case study shows how a real-world collection of isolated cy
 bercrime events was transformed into connected investigative evidence. Ind
 ividual events initially appeared unrelated\, but many contained small tra
 ces such as aliases\, contact handles\, cryptocurrency wallets\, domains\,
  URLs\, organization names\, and infrastructure that could be used to iden
 tify relationships between actors\, targets\, and recurring criminal activ
 ity.\n\nUsing sanitized examples\, we will walk through how these artifact
 s were extracted\, normalized\, enriched\, and compared across different s
 ources. We will also show how contextual analysis helped identify intent\,
  risk indicators\, criminal activity types\, relevant entities\, and recur
 ring behavioral patterns.\n\nThe session focuses not only on successful co
 nnections\, but also on the investigative decisions behind them\, includin
 g which signals were useful\, which produced noise\, where automated analy
 sis helped\, and where human validation remained necessary.\n\nAttendees w
 ill leave with a repeatable approach for turning fragmented cybercrime dat
 a into structured evidence that can support triage\, monitoring\, attribut
 ion hypotheses\, and deeper investigations.
DTSTAMP:20261014T084535Z
LOCATION:Track 2 (306A)
SUMMARY:From Isolated Events to Connected Evidence: Structuring Fragmented 
 Cybercrime Data - Matheus Bezerra
URL:https://cfp.hackfest.ca/hf2026/talk/WPFKMY/
END:VEVENT
END:VCALENDAR