An Automated Forensic Pipeline Using STIX 2.1 and OSINT for Neutralization of Transnational Pig Butchering and Business Email Compromise Fraud Infrastructure
An Automated Forensic Pipeline Using STIX 2.1 and OSINT for Neutralization of Transnational Pig Butchering and Business Email Compromise Fraud Infrastructure
This technical report presents a scalable, fully automated forensic neutralization pipeline designed to identify, enrich, and systematically dismantle transnational cyber-fraud infrastructure, specifically Pig Butchering and BEC campaigns. The framework integrates Bash-based discovery with Python-driven forensic enrichment, utilizing STIX 2.1 standardization and MITRE ATT&CK mapping. As of June 2, 2026, the pipeline has processed over 1,800 malicious domains. This research is conducted independently and emphasizes cryptographic audit logging, legal compliance (CFAA, GDPR, CCPA), and ethical targeting.
Threat Intelligence, Digital Forensics, Automated Takedown, MITRE ATT&CK, Cyber Fraud Infrastructure, Business Email Compromise, Domain Abuse, Pig Butchering, Infrastructure Neutralization, STIX 2.1, Cybercrime Disruption, OSINT
Threat Intelligence, Digital Forensics, Automated Takedown, MITRE ATT&CK, Cyber Fraud Infrastructure, Business Email Compromise, Domain Abuse, Pig Butchering, Infrastructure Neutralization, STIX 2.1, Cybercrime Disruption, OSINT
selected citations These citations are derived from selected sources.This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).0 popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.Average influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).Average impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.Average
Citations provided by BIP!Popularity provided by BIP!