Cross-Platform Identity Linking

Cross-platform identity linking may be one of the most potent tools available to cybersecurity teams because it allows them to turn the table on bad actors and undermine their schemes when they least expect it. However, linking identities across platforms also takes time, training, experience, and expertise, making it a desirable but inaccessible tactic for most teams—at least until now. 

Cross-Platform Identity Linking Explained

What is cross-platform identity linking?

It’s the process of identifying an individual or group that made posts using different identities and profiles in different forums and channels. Despite trying to obscure the origin of the posts and create the appearance of coming from multiple entities and locations, cross-platform identity linking stitches these disparate threats together and traces them back to their common source. Making those connections can be quite simple in some cases or require complex sleuthing and deep analysis in others. 

Why is cross-platform identity linking important?

When it comes to investigations, one clue is valuable, but two or more clues start to form a trail that can be traced back to the perpetrator. Cross-platform identity linking helps security teams to find a larger quantity and quality of threat intelligence by seeing the hidden links between clues. They can follow those links to turn one clue into multiple or, alternatively, ascertain how multiple clues relate to the same threat or threat actor. It’s a powerful tool for cybersecurity, both to expedite and enrich investigations, that can give teams the edge they need to proactively defeat attacks and continuously improve at resilience—provided they have the means to make it work. 

Why is cross-platform identity linking necessary? 

On one hand, it’s necessary because it takes an advantage away from bad actors and gives it to security teams instead. On the other hand, cross-platform identity linking is necessary because threat actors go to great lengths to obscure those links. Here’s why:

• Fresh start – Threat actors who have burned bridges in the past may try to “start over” by adopting a new digital identity.
• Market segmentation – Like any vendor, hackers target their outreach efforts by tailoring their name, image, and messaging to the audience. 
• Escape capture – Threat actors who don’t “cover their tracks” make it easier for law enforcement to find them and build cases against them. 

Why is Cross-Platform Identity Linking Becoming More Important?

Why is cross-platform identity linking rising in relevance?

Cross-platform identity linking has become more common over time as the focus of cybersecurity has shifted from reactively responding to attacks to proactively preventing them. As cyber attacks get more damaging and harder to stop, especially now that threat actors are adopting AI, defenders must seek advantages wherever they can. Monitoring what hackers are saying and doing, not just in one place but in multiple, is more relevant than ever because it gives defenders an edge that’s more elusive than ever. 

What is the history of cross-platform identity linking?

The concept of exposing fake identities and linking together criminal activities has existed for as long as investigations themselves, but cross-platform identity linking as discussed here is a very recent development. Online criminal forums and marketplaces, where bad actors could easily manipulate their identities, are a new phenomenon. Effective tools and techniques to link identities across platforms did not exist until now. The need to make these links has, historically, outpaced the ability—but that’s starting to change. 

What happens without cross-platform identity linking?

Anyone who has not spent time in today’s threat actor communities might be surprised at how mature they are, with large numbers of users, well-developed illicit economies, and lots of coordinated activity. Malicious actors have never been more unified and cooperative, gaining strength in numbers, making it ever-more important for defenders to be aware of what’s happening on the dark web, in illicit Telegram channels, and inside forums. Without cross-platform identity linking, a rich source of threat intelligence goes untapped.

How does cross-platform identity linking relate to OSINT?

Open source intelligence (OSINT) can be divided into two categories, active and passive, and cross-platform identifying linking falls into the latter, meaning it’s a way to gather intelligence on hackers without their knowledge. Profiling attackers to predict or identify their activities becomes much easier once their chatter can be tracked between platforms and their motives fully understood. Linking the identity of a user in one place to the identity of a user in another can be done by comparing details like these. 

• Usernames
• Writing Styles
• Sale Items
• PGP Keys
• Email Address
• Contact Information
• Cryptocurrency Addresses

Flare: A Smart Solution for Cross-Platform Identity Linking

How does Flare support cross-platform identity linking?

Flare’s Continuous Threat Exposure Management platform makes cross-platform identity linking both easy and expansive. It continuously searches the clear, deep, and dark web for threats like exposed credentials and stolen session cookies. When documenting the threat, Flare also captures details for context like usernames, email addresses, and more. With all that information in one place, combined with tools to find matches, Flare makes the links between identities appear obvious no matter how many identities or platforms are involved. That way, while threat actors believe they’re operating under secrecy, their actions are really being tracked by security teams who can see all their illicit activities. 

What resources are available for cross-platform identity linking?

Flare maintains a database with billions of data points. With so much information to draw on, security teams can not only easily trace what bad actors are doing in multiple locations but, crucially, turn that intelligence into actionable insights about how to make security stronger and stop more attacks. With an unparalleled amount of data to draw from and intuitive tools for investigation and analysis, Flare makes cross-platform identity linking a dynamic addition to any security strategy. 

What are the benefits of using Flare for cross-platform identity linking?

The Flare technology makes intelligence gathering and threat hunting a more productive process overall:

• Save time: Someone could spend endless hours searching for OSINT, or instead rely on Flare to automate and scale the entire process. 
• Learn more: More context from more platforms makes links easier to find and more revealing about the attacker’s intentions.  
• Stop incidents: Intelligence gained through cross-platform identity linking could be the difference-maker for stopping attacks before they cause damage. 
• Build resilience: Discovering what vulnerabilities hackers intend to exploit makes it clear how to increase resilience by updating plans, policies, or protections. 

As a complement to our technology, we offer the Flare Academy, where students can learn even more about subjects like OSINT and cross-platform identity linking:

• Watch experts explain how they approach cross-platform identity linking.
• See demonstrations of real techniques and tactics.
• Access resources and ask questions in our Discord community.
• Learn from past trainings on-demand, for free.
• Register for future training sessions, also free. 

Cross-Platform Identity Linking and Training with Flare Academy

Flare Academy training provides security practitioners with highly relevant and highly engaging lessons on subjects like threat intelligence, operational security, investigation techniques, and more. Led by expert instructors, these free trainings combine on-demand video lessons with diverse learning tools. Students can also gain access to the Flare Academy Discord Community where they can ask questions, explore advanced topics, and continue their learning journey wherever it leads. 

Find the right option at Flare Academy: sign up for the next training here.