XFTFSecurity For the Folks

Lesson 1.3

Why OSINT Matters

Learning Objectives

  • Explain why reconnaissance is the first phase of most attacks, using the Cyber Kill Chain and MITRE ATT&CK
  • Describe how OSINT fuels social engineering, using current breach data
  • Explain the value of OSINT for defenders
  • Analyze real-world case studies and identify the OSINT techniques and lessons in each

Reconnaissance Is Step One

The Lockheed Martin Cyber Kill Chain (2011)

Lockheed Martin’s Cyber Kill Chain describes the stages of a targeted attack. Reconnaissance comes first:

# Phase What happens
1 Reconnaissance The attacker selects a target, researches it, and looks for weaknesses
2 Weaponization The attacker builds a malicious payload suited to the target
3 Delivery The payload is sent (email, website, USB, etc.)
4 Exploitation The payload triggers and exploits a vulnerability
5 Installation The attacker establishes persistent access
6 Command and Control (C2) The attacker remotely controls the compromised system
7 Actions on Objectives The attacker achieves the goal: stealing data, deploying ransomware, etc.

Teaching point: every later phase depends on the quality of phase one. A phishing email (delivery) only works if the attacker knows who to send it to and what will look believable. That knowledge comes from OSINT.

The model also gives defenders a mindset: break the chain as early as possible. If attackers can’t learn much in phase one, the rest of the attack gets harder.

MITRE ATT&CK: the Reconnaissance tactic (TA0043)

MITRE ATT&CK is a widely used knowledge base of real-world attacker behavior. Its Reconnaissance tactic is described as: “The adversary is trying to gather information they can use to plan future operations.” It covers both active and passive collection.

As of 2026, the tactic lists 12 techniques:

ID Technique Plain-language meaning OSINT?
T1595 Active Scanning Probing the target’s systems directly Active recon (beyond pure OSINT)
T1592 Gather Victim Host Information Learning about the target’s devices and software Often OSINT
T1589 Gather Victim Identity Information Names, emails, credentials of employees Often OSINT
T1590 Gather Victim Network Information Domains, IP ranges, DNS, network layout Often OSINT
T1591 Gather Victim Org Information Business relationships, roles, locations, schedules Often OSINT
T1598 Phishing for Information Tricking people into revealing information Social engineering, not OSINT
T1682 Query Public AI Services Using public AI tools (like LLMs) to research targets (added March 2026) Yes
T1597 Search Closed Sources Paid or restricted sources, such as threat intel vendors or dark web markets Gray area
T1596 Search Open Technical Databases DNS, WHOIS, certificates, internet-scan databases Yes
T1593 Search Open Websites/Domains Social media, search engines, code repositories Yes
T1681 Search Threat Vendor Data Researching what security vendors have published about threats Yes
T1594 Search Victim-Owned Websites The target’s own website Yes (semi-passive)

Most of these techniques happen outside the defender’s network, where the defender can’t see them. That’s the core reason recon is hard to detect and why reducing public exposure matters (Module 9).

Each technique has sub-techniques; students can explore them on the ATT&CK website (link in References).

Attackers Are Doing It Anyway

  • If an organization doesn’t know what it exposes, attackers will find out first.
  • Recon is cheap (mostly free tools), fast (hours, not weeks), and quiet (passive recon leaves little or no trace on the target’s systems).
  • This creates an asymmetry: the attacker needs to find one useful weakness; the defender needs to know about all of them.
  • Doing OSINT on your own organization is simply seeing what attackers already see.

OSINT Fuels Social Engineering

Social engineering means manipulating people into giving up information, access, or money. It’s one of the most reliable attack methods, and OSINT is what makes it convincing.

What the data says

  • The Verizon 2026 Data Breach Investigations Report (DBIR) found that the human element was involved in 62% of breaches, up from 60% in the 2025 report.
  • “Human element” is a broad category that includes things like falling for phishing, reusing stolen credentials, and making errors.
  • Coverage of the 2026 report also highlights the growth of mobile-focused social engineering (voice phishing and SMS scams) and AI-assisted deception.

How OSINT makes social engineering work

OSINT finding How it’s used in an attack
Employee names and roles Choosing who to target and who to impersonate
Email format Generating valid addresses for everyone found on LinkedIn
Vendors and software in use Fake invoices from a real vendor, fake login pages for real software
Current events (merger, new CFO, office move) Creating urgency and believable context
Personal details (pets, hometown, schools) Guessing passwords or security question answers, building rapport
Travel posts Timing a “the CEO needs this wire transfer now” scam while the CEO is unreachable
Voice and video of executives online Raw material for AI voice cloning and deepfake calls

Value for Defenders

OSINT isn’t just something to defend against — it’s a core defensive capability:

  • Attack surface management: discover forgotten subdomains, exposed services, and shadow IT.
  • Threat intelligence: understand which threat actors target your industry and how.
  • Leak detection: find exposed credentials, secrets in code, and stolen data before attackers use them.
  • Brand and executive protection: find impersonation accounts, phishing sites, and threats.
  • Incident response: pivot from an attacker’s domain or IP to related infrastructure; understand who you’re dealing with.
  • Third-party risk: check whether vendors have been breached.
  • Physical security: monitor for threats to offices, events, and staff.
  • Awareness training: show employees real examples of what’s public about the company (with care and consent).

Beyond Cybersecurity

OSINT also matters for society:
- Accountability journalism: exposing wrongdoing by governments and corporations
- Human rights: documenting war crimes and civilian harm with verifiable evidence
- Missing persons: volunteer efforts like Trace Labs
- Fighting disinformation: debunking fake or recycled media

Case Studies

Each case follows the same structure: what happened → OSINT techniques used → lessons → discussion question. Pick one or two for the intro lecture; use the rest for deeper sessions.

Case 1: The Strava Global Heatmap (2018)

What happened
- Fitness app Strava published a Global Heatmap in November 2017, showing aggregated activity from its users’ GPS-tracked runs, rides, and walks.
- In late January 2018, Nathan Ruser, a 20-year-old Australian university student, noticed the map revealed military sites. On January 27, 2018, he posted that US bases were “clearly identifiable and mappable.”
- In remote areas where almost nobody else used fitness trackers, soldiers’ workouts lit up the map, outlining base perimeters, patrol routes, and supply routes in places like Syria and Afghanistan.
- Reports described the data exposing bases’ layouts and patterns of life — how and when personnel moved each day.
- In August 2018, the Pentagon issued a memo prohibiting Department of Defense personnel from using geolocation features on government and personal devices in designated operational areas, citing risks to personnel locations, routines, and numbers.
- The problem didn’t fully go away: in August 2026, Stars and Stripes reported that Strava users were still revealing routines of Middle East base life despite the restrictions.

OSINT techniques involved
- Analysis of publicly published aggregated data
- Comparing activity patterns against satellite imagery and maps
- Pattern-of-life analysis

Lessons
- Aggregated, “anonymized” data can still reveal secrets, especially where few people generate data.
- Individual choices (a morning run) add up to organizational exposure.
- Default privacy settings matter; most users didn’t realize their data fed the public map.
- Policy alone doesn’t fix behavior — the 2026 reporting shows the risk persists.

Discussion question: Your company has a secure research facility in a rural area. What public data sources might reveal its existence or activity, even if the company never mentions it?

Case 2: Identifying the Salisbury Poisoning Suspects (2018)

What happened
- In March 2018, former Russian intelligence officer Sergei Skripal and his daughter Yulia were poisoned with a nerve agent in Salisbury, England.
- UK authorities released photos of two suspects traveling under the names “Alexander Petrov” and “Ruslan Boshirov.”
- On September 26, 2018, Bellingcat and its Russian partner The Insider reported that “Boshirov” was actually Colonel Anatoliy Chepiga, a decorated officer of Russia’s military intelligence agency (GRU) and a Hero of the Russian Federation.
- On October 8, 2018, they identified “Petrov” as Dr. Alexander Mishkin, a GRU military doctor.

OSINT techniques involved (and where it went beyond OSINT)
- Standard techniques first: reverse image searches and phone database lookups — which found nothing.
- Deductive reasoning: they consulted former Russian military officers to work out which military academy likely trained GRU officers for operations in Western Europe, and estimated graduation years.
- Public records: yearbook photos, reunion photo galleries, a news article about academy graduates who had received the Hero of Russia award.
- Leaked databases (not truly public): leaked Russian residential and phone databases circulating as torrents showed a person named Anatoliy Chepiga linked to a military unit.
- Passport file data (not public): passport records obtained from sources included a photo resembling a younger “Boshirov” and details confirming his unit and birthplace.

Lessons
- Great investigations combine OSINT, deduction, expert knowledge, and persistence.
- Cover identities can be broken by linking fragments across many sources.
- This case sits in a gray area: the decisive evidence came from leaked and gray-market data, which many practitioners say is beyond OSINT. It’s a strong starting point for an ethics discussion (see Module 2).
- Bellingcat published its methodology, allowing others to scrutinize the work.

Discussion question: Should evidence from leaked databases count as “open source”? Would it be acceptable for a pentester to use similar data? Why or why not?

Case 3: January 6, 2021 Capitol Attack Identifications

What happened
- After the January 6, 2021 attack on the US Capitol, the FBI sought the public’s help identifying participants.
- Many participants had filmed and posted their own actions on social media platforms.
- Before the social platform Parler went offline in January 2021, an archivist known as @donk_enby preserved a large amount of its public content. Parler had not stripped EXIF metadata from uploads, so many videos contained exact GPS coordinates.
- Gizmodo mapped nearly 70,000 geolocated Parler posts and analyzed GPS data from 618 videos, showing users on the Capitol grounds and inside the building.
- A volunteer online community called Sedition Hunters examined public photos and videos and submitted tips to the FBI. NPR reported that Sedition Hunters were named in at least 13 cases, with many more citing evidence from tipsters and public platforms.

OSINT techniques involved
- Social media collection and preservation
- Metadata (EXIF/GPS) analysis
- Crowdsourced image and video analysis
- Matching clothing, gear, and faces across many videos (some volunteers also used facial recognition tools, which raises ethical questions)

Lessons
- People document themselves — often including evidence against themselves.
- Platform choices matter: a single platform failing to strip metadata exposed thousands of users’ exact locations.
- Archive quickly: content disappears when platforms shut down or users delete posts.
- Crowdsourcing is powerful but risky: misidentification can harm innocent people (see the 2013 Boston Marathon example in Module 7).

Discussion question: What responsibilities do volunteer investigators have when they believe they’ve identified someone? Who should they share it with, and who shouldn’t they?

Case 4: MH17 and the Buk Missile Launcher (2014)

What happened
- On July 17, 2014, Malaysia Airlines Flight 17 was shot down over eastern Ukraine, killing everyone on board.
- Photos and videos appeared on social media showing a Buk surface-to-air missile launcher moving through separatist-controlled territory that day.
- Bellingcat (which had launched just days earlier) and other open source researchers geolocated each image to confirm where and when it was taken. One photograph alone was enough to pin down the launcher’s location in the town of Snizhne.
- Researchers also geolocated the likely launch field south of Snizhne, and a video showing the launcher in Luhansk on the morning of July 18, 2014, missing one missile.
- Bellingcat’s later reporting traced the launcher back to Russia’s 53rd Brigade.

OSINT techniques involved
- Geolocation using buildings, roads, and terrain matched against satellite imagery
- Chronolocation (establishing the time of each image)
- Collecting and cross-referencing bystander social media posts
- Tracking a single vehicle across multiple independent sources

Lessons
- A few bystander photos, verified carefully, can reconstruct an event.
- Independent sources that agree are far stronger than one source alone.
- This case helped establish open source investigation as a credible discipline.

Discussion question: Why was it important to confirm each photo independently instead of assuming they all showed the same vehicle?

Case 5: The Discord Leaks (2023)

What happened
- In early 2023, photos of classified US military documents spread online.
- On April 9, 2023, Bellingcat published an investigation tracing how the documents spread across Discord communities, back to a since-deleted Discord server called “Thug Shaker Central.” Documents had been posted in Discord servers as early as October 2022.
- The New York Times followed a chain of digital evidence to Jack Teixeira, a 21-year-old member of the Massachusetts Air National Guard. Clues included a username previously connected to him, statements that the poster worked in an Air Force intelligence unit, and details visible in the margins of the document photos that matched images of his family’s home posted online by family members.
- Teixeira was arrested on April 13, 2023, and was later sentenced to 15 years in prison.

OSINT techniques involved
- Tracing content back through online communities to its earliest appearance
- Username pivoting
- Comparing background details in photos (furniture, surfaces, objects) with other public images
- Linking an online persona to a real identity through multiple independent clues

Lessons
- Photo backgrounds leak information — the documents were photographed on surfaces that matched family photos.
- Family members’ posts can expose you even if you’re careful yourself.
- Username reuse links personas across platforms.
- It’s an example of an OPSEC failure (Module 8) and of OSINT used for accountability.

Discussion question: List every piece of information that connected the anonymous poster to a real person. Which one could he have controlled, and which ones couldn’t he?

Related video: Discord’s location leak (2025)
- “Discord’s Strangest Doxxing Method…” by No Text To Speech (January 2025): youtube.com/watch?v=dqSoaDYRpQ0
- The video explains research published in January 2025 by a teenage bug bounty hunter (“hackermondev”).
- Apps like Discord and Signal load images through Cloudflare, which caches them in the data center nearest the viewer.
- By checking which data center cached an image, an attacker could estimate a user’s location to within roughly 250 miles.
- On Discord, a friend request was enough: the phone downloaded the sender’s avatar to show the notification, with no click needed.
- Cloudflare patched the specific bug the researcher first used. Cloudflare said protecting cached content is up to the apps that use it, and the researcher warned the underlying risk remains for any app that caches content this way.
- Lessons:
- Metadata you never see (which server handled your request) can reveal where you are.
- “Zero-click” means careful behavior alone isn’t enough.
- A VPN helps here because the cache fills near the VPN server, not near you (see Module 8).
- Teaching note: use it for awareness and defense. Don’t run the technique against real people.

Related video: vehicle OSINT
- “Some Crazy Vehicle OSINT Stories!” by Mishaal Khan (September 2026): youtube.com/watch?v=YDbWfKC05Qw
- A short clip from David Bombal’s interview “How an OSINT Expert Found a Car the Police Couldn’t” (youtube.com/watch?v=7CwVrH2Psts).
- According to the interview’s description, it covers:
- locating a missing car after a police search came up short
- investigating a hit-and-run from a partial license plate and public records
- Flock license-plate cameras and how vehicle data can reveal where people live and their routines
- license-plate recognition errors and why verification matters
- the risk of surveillance access being abused
- Lessons:
- A car is a selector: plates, make, model, and damage pivot to people and places.
- Automated plate matches still need human verification (Module 7).

Case Study Summary

Case Main techniques Main lesson
Strava heatmap Aggregate data analysis, pattern of life “Anonymous” aggregated data can still expose secrets
Salisbury suspects Deduction, records, leaked data Fragments across sources break cover identities; ethics of leaked data
January 6 Social media collection, EXIF/GPS metadata, crowdsourcing People self-document; metadata matters; crowdsourcing has risks
MH17 Geolocation, chronolocation, cross-referencing Verified bystander media can reconstruct events
Discord leaks Content tracing, username pivoting, photo background matching Backgrounds, family posts, and reused usernames expose identities

Key Terms

  • Reconnaissance: Gathering information about a target before an attack or test.
  • Cyber Kill Chain: Lockheed Martin’s seven-phase model of a targeted cyberattack.
  • MITRE ATT&CK: A public knowledge base of attacker tactics and techniques based on real-world observations.
  • Tactic / technique: In ATT&CK, a tactic is the attacker’s goal (e.g., Reconnaissance); a technique is how they achieve it.
  • Social engineering: Manipulating people into revealing information or taking harmful actions.
  • Human element: Verizon DBIR’s category for breaches involving human actions like phishing, errors, or misuse of stolen credentials.
  • Pattern of life: The routine movements and behaviors of a person or group, revealed through data over time.
  • EXIF metadata: Information embedded in photo files, which can include GPS coordinates, device model, and time.
  • Geolocation / chronolocation: Determining where / when a photo or video was taken.
  • Attribution: Determining who is responsible for an action.

Key Takeaways

  • Reconnaissance is phase one of the Cyber Kill Chain and a full tactic in MITRE ATT&CK (TA0043)
  • Most recon happens outside your network, where you can’t see it
  • Verizon’s 2026 DBIR: the human element was involved in 62% of breaches
  • OSINT makes social engineering convincing: names, vendors, timing, personal details
  • Defenders use OSINT for attack surface management, leak detection, threat intel, and incident response
  • Strava: aggregated fitness data exposed military bases — and still does
  • Salisbury, MH17, Discord leaks, January 6: small public fragments add up to big conclusions
  • Case studies also raise ethics questions: leaked data, facial recognition, crowdsourced accusations

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.