Cyber criminals are intelligent, elusive individuals, making it difficult for law enforcement to track them down. Not all hackers manage to escape retribution, however. Here, Joanne Newton, deputy head of the school of computing at Arden University, explores the traps they fall in to, and how they get caught…

Cyber criminals go to many lengths to hide their identity and cover their tracks. The use of proxy servers, VPNs and encryption can mean it is incredibly difficult to track down and bring a hacker to justice. Because of this, according to industry data only four to five percent of hackers are actually caught, but high-profile cases showcase how even the most skilled can make simple mistakes which lead to them being apprehended.

In 2016, for example the capture of Guccifer 2.0, a hacking persona who became famous for leaking data from the Democratic National Committee, was possible because the hacker failed to activate a VPN before logging on, allowing investigators to trace the IP address back directly.

There was also the high-profile case of Hector Monsegur, leader of the Lulzsec Group that hit organisations such as Playstation, Fox News and the FBI. He was caught after forgetting to use the Tor system to hide his location when accessing a chat room.

There are a number of human flaws and traits that can lead to arrest, from the need to show off and gain credit for crimes – which is more common than you might think – to the inherent ability of humans to make the most basic errors and mistakes.

In July 2019 Paige A. Thompson, a former Amazon employee, was arrested and accused of stealing personal data of millions of Capital One customers.

She was tracked down after she posted online about possessing knowledge of multiple companies and was found to have files and information on Capitol One and Amazon, as well as social security numbers and bank account details from more than 30 different organisations on multiple devices in her bedroom.

There are many types of hackers carrying a range of different risk levels, from hacktivists – who look to raise awareness of a specific issue – to full-scale cyber terrorists. Of those operating, script kiddies tend to be the least experienced, leaving them most likely to face capture. This type of hacker typically tends to rely on tools developed by other attackers to penetrate a network or system, using these tools to target easy-to-penetrate systems which are vulnerable to widely-known threats.

According to industry data, ransomware attacks almost doubled in 2021. The market for ransomware is becoming increasingly professional – with cybercriminal services-for-hire creating an environment in which ransomware is offered as a service.

There is also a diversification of approaches when it comes to extorting money – with threats to publicly release data, or inform their victims’ families about an incident, all of which adds to the danger levels and increases the risks of being caught.

Much can be learned from hackers’ previous mistakes, and organisations globally should consider how they can take real-world observations and apply them to their own business to reduce the threat level.

Knowledge bases of adversary tactics and techniques exist, which can help organisations to plan for all eventualities using real-world observations. The aim of these frameworks is to improve detection by identifying the actions the cyber-criminal may take allowing the organisation to identify gaps in defences.

Forward-thinking organisations should be using this kind of system to help develop a framework for defence developing, penetration testing and threat modelling, to ensure their businesses are as protected as they can be from these threats.

Joanne Newton is Deputy Head of the School of Computing at Arden University.