2026-10-30 –, Track 2 (306A) Language: English
Cybercrime investigations rarely begin with a clean dataset. They begin with fragmented information scattered across forums, Telegram channels, marketplaces, leak sites, credential sales, and actor conversations.
This case study shows how a real-world collection of isolated cybercrime events was transformed into connected investigative evidence. Individual events initially appeared unrelated, but many contained small traces such as aliases, contact handles, cryptocurrency wallets, domains, URLs, organization names, and infrastructure that could be used to identify relationships between actors, targets, and recurring criminal activity.
Using sanitized examples, we will walk through how these artifacts were extracted, normalized, enriched, and compared across different sources. We will also show how contextual analysis helped identify intent, risk indicators, criminal activity types, relevant entities, and recurring behavioral patterns.
The session focuses not only on successful connections, but also on the investigative decisions behind them, including which signals were useful, which produced noise, where automated analysis helped, and where human validation remained necessary.
Attendees will leave with a repeatable approach for turning fragmented cybercrime data into structured evidence that can support triage, monitoring, attribution hypotheses, and deeper investigations.
This session presents a practical case study of how fragmented cybercrime data can be transformed into connected investigative evidence.
We will walk through the process of extracting and normalizing useful artifacts from multiple online sources, enriching events with contextual information, and identifying relationships between activity that initially appeared unrelated.
Using sanitized examples, we will show how repeated aliases, contact handles, wallets, domains, infrastructure, organization mentions, and behavioral patterns can help investigators connect weak signals across different sources.
The session will also discuss the challenges of false correlations, noisy indicators, and automated analysis, showing where human validation remains necessary. The goal is to provide a practical and repeatable workflow that attendees can apply to cybercrime monitoring, triage, and deeper investigations.
Matheus Bezerra is a Software Engineer at Apura Cyber Intelligence, working on cybersecurity, OSINT, large-scale data processing, and threat intelligence platforms. His work focuses on building systems that collect, structure, enrich, and analyze large volumes of online intelligence. He holds a B.Sc. in Computer Science and is pursuing graduate studies in Data Science.