Putting all eggs in a single basket: A cross-community analysis of 12 hacking forums

Hackers have established large online communities in the form of online discussion forums. These forums help hackers with their goals: to hack, commit credit card/identity fraud or theft, launder money, and carry out digital attacks on physical infrastructure. There is need from security organizations and law enforcement to monitor these activities to identify individuals of interest, emerging threats and malware, and develop effective disruption strategies. However, as studies have consistently shown that as these communities are disrupted, new ones emerge. This might lead users of these forums to not put all their eggs in a single forum but rather diversify their efforts across multiple forums, in which case the removal of a forum will not create a lot of damage to the overall larger community. This is where the literature falls short, there is a dearth of knowledge about how hackers behave across forums, whether they do diversify. This paper aims to add to this knowledge by studying hacker activity across 12 online discussion forums, and identifying users who might not be relevant in a single forum, but are key across the larger community. This would allow for the targeting of specific users and the disruption of the flow of information across the larger community.