Criminal Intelligence and Investigations Flashcards

What is the FBI's primary cyber threat intelligence mission?

Answer: Investigating cyber intrusions, attribution of attacks, and disrupting nation-state and criminal cyber actors

The FBI leads federal domestic cyber threat investigation, combining intelligence analysis with law enforcement authority to investigate and disrupt cyber actors.

What is 'ransomware' as a cyber threat the FBI investigates?

Answer: Malicious software that encrypts victim data and demands payment for decryption keys

Ransomware is a category of malware that holds victim data hostage until a ransom is paid, often targeting hospitals, schools, and critical infrastructure.

What does 'TTP' stand for in the context of FBI cyber intelligence?

Answer: Tactics, Techniques, and Procedures used by cyber threat actors

TTPs describe the behavioral patterns and methods used by threat actors, enabling attribution and the development of defensive countermeasures.

What is 'attribution' in FBI cyber investigations?

Answer: The process of identifying the responsible threat actor behind a cyber attack

Attribution involves using technical indicators, tradecraft patterns, and intelligence to identify the nation-state or criminal group responsible for an attack.

What is a 'watering hole attack' in the context of cyber threat intelligence?

Answer: Compromising a website frequently visited by the target to infect visitors with malware

In a watering hole attack, adversaries compromise a legitimate website their targets commonly visit, using it as a vector to deliver malware.

What is 'dark web' intelligence and why is it relevant to FBI investigations?

Answer: Intelligence collected from encrypted, anonymized networks that host criminal marketplaces and forums

The dark web hosts illicit marketplaces, criminal forums, and infrastructure that the FBI monitors to identify threat actors and gather investigative intelligence.