An Assessment of Geopolitical Discussions in Cybercrime Forums

Prof. Masarah Paquet-Clouston’s project, An Assessment of Geopolitical Discussions in Cybercrime Forums, conducted with master student Isa-May Beauchamp and Estelle Ruellan from Flare systems, examines how geopolitical topics are addressed within cybercrime forums. The research started from the observation that cybercrime and geopolitics are sometimes intertwined within cybercrime forums, with users claiming involvement in geopolitical issues. However, to what extent cybercrime forums themselves serve as spaces where geopolitical cyber activity is discussed, coordinated, or encouraged needed to be further investigated.

The project analyzed conversations from three major cybercrime forums in 2024 and used large language models to identify geopolitical discussions across thousands of conversations. These discussions were then examined through manual content analysis to better understand their themes. The research found that about half of the flagged conversations were calls for action, involving some form of operational intent, while the other half were social chats in which participants shared opinions or discussed geopolitical conflicts and attacks without necessarily urging action.

Overall, the findings suggest that cybercrime forums are not major hubs for organizing geopolitical militant activities. While some forums showed more calls for action than others, the overall prevalence of geopolitical discussions was low, leading the research team to conclude that more substantial coordination is likely happening elsewhere, in more private spaces. The project also offers a reusable methodology for applying AI and large language models to identify and summarize discussions on other topics of interest to the cyber threat intelligence (CTI) community.