STRATIRSTR-2025-0847

STRATIR INTELLIGENCE BRIEFPARTIALLY DECLASSIFIED

PROJECT

CERBERUS

Multi-Platform Fraud Network Attribution Case Study

CASE ID: STR-2025-0847CLASSIFICATION: PARTIALLY REDACTED

STRATIRSTR-2025-0847

Executive Summary

INVESTIGATION OVERVIEW

A small group of concerned individuals reached out after discovering family members were being targeted by romance scams originating from West Africa. They had names and social profiles but no way to map the network or build an evidence package for law enforcement.

Key Outcomes

METRIC	RESULT
Fraudulent Accounts Identified	17
Investigation Duration	72 hours
Platforms Mapped	5+ social networks
Identity Confidence	High (biometric match)
Evidence Package	Delivered to clients

This brief documents the methodology used to identify, attribute, and map a coordinated fraud network using open source intelligence techniques and Stratir's proprietary tooling.

STRATIRSTR-2025-0847

Investigation Methodology

Biometric Targeting

Deployed Feynman's facial recognition module to analyze profile images across platforms. Identified shared imagery patterns indicating coordinated account creation.

Cross-Platform Verification

Cross-referenced facial recognition hits with OSINT data sources including social media archives, breach databases, and public records.

Network Mapping

Mapped communication patterns and infrastructure using link analysis. Identified shared device fingerprints, IP ranges, and payment processing accounts.

Attribution Chain

Built complete attribution chain from social profiles to real-world identities using digital footprint analysis and financial infrastructure mapping.

STRATIRSTR-2025-0847

Key Findings

Network Structure

→17 connected accounts operating as a coordinated network
→Central hub account managing multiple personas
→Shared payment infrastructure across all accounts
→Common device fingerprints indicating single operator or small team

CRITICAL OPSEC FAILURE

Subject reused profile imagery across multiple platforms, enabling biometric linking. Payment account metadata exposed real name and location data.

Evidence Collected

TYPE	ITEMS	CONFIDENCE
Profile Screenshots	47	VERIFIED
Communication Logs	12 threads	VERIFIED
Payment Records	3 accounts	HIGH
Biometric Matches	17 profiles	HIGH
Device Fingerprints	2 devices	MEDIUM

STRATIRSTR-2025-0847

72-Hour Investigation Timeline

Day 1: Initial Collection (Hours 0-24)

→Received initial target information from clients
→Deployed facial recognition across major platforms
→Identified 8 additional connected accounts
→Began infrastructure analysis

Day 2: Deep Analysis (Hours 24-48)

→Completed cross-platform verification
→Mapped payment infrastructure
→Identified additional 9 accounts
→Built preliminary attribution chain

Day 3: Documentation (Hours 48-72)

→Finalized network map
→Compiled evidence package
→Prepared client briefing
→Delivered final report

STRATIRSTR-2025-0847

Conclusion

Project Cerberus demonstrates the effectiveness of combining automated OSINT collection with expert analysis. The network was fully mapped within 72 hours, providing clients with actionable intelligence for law enforcement engagement.

OUTCOME

Evidence package delivered to clients. Network structure fully documented. All 17 fraudulent accounts reported to respective platforms.

NEED SIMILAR CAPABILITIES?VANCE@STRATIR.COM

INTEL BRIEF: PROJECT CERBERUS

PROJECT

CERBERUS

PROJECT

CERBERUS

Executive Summary

Key Outcomes

Investigation Methodology

Biometric Targeting

Cross-Platform Verification

Network Mapping

Attribution Chain

Key Findings

Network Structure

Evidence Collected

72-Hour Investigation Timeline

Day 1: Initial Collection (Hours 0-24)

Day 2: Deep Analysis (Hours 24-48)

Day 3: Documentation (Hours 48-72)

Conclusion