A New Threat Frontier: Leveraging Discord for OSINT

The open-source intelligence (OSINT) landscape is rapidly evolving, constantly requiring security professionals to expand their reach beyond traditional platforms. Discord, a platform widely known and used by gaming communities, is becoming a favored communication tool for a wide range of threat actors and illicit communities—making it an important source for OSINT investigations.

To help security teams understand this new covert vector, Flashpoint hosted an on-demand webinar, providing critical insights and practical methodologies for navigating and identifying potential threats lurking among the millions of servers on this gaming-centric messaging platform.

Discord: An Unexpected Haven for Threat Actors

Discord is becoming increasingly favored by threat actor communities due to its unique server-based structure that allows for the creation of private, topic-specific communities. While the vast majority of private servers are non-nefarious, Discord’s server structure makes it extremely difficult for investigators to discover harmful discussions and track illegal activity taking place within the platform. 

In the webinar, Flashpoint highlights several key areas where this structure presents significant challenges for organizations:

1. Illicit marketplaces: Threat actors are creating Discord servers dedicated to the coordination and sale of contraband, from drugs to stolen credentials.
   
2. Extremist communities: Flashpoint has found many extremist groups using the platform for ideological discussions and the planning of real-world activities.
   
3. Direct-action groups: Protestors and rioters are leveragingDiscord’s features for event planning and logistics, including staging locations and protest routes.
   
4. Protective intelligence: Communities are often sharing sensitive information, such as personal details of executives and key personnel, making executive protection a significant challenge.

OSINT Tips and Tricks: Investigations into Discord

Effective intelligence gathering requires specific knowledge that goes beyond passive observation. Our on-demand webinar outlines a multi-step investigative approach to identify and access hidden illicit Discord communities to extract critical information.

Tip 1: Finding Servers

While the first challenge lies in discovery, many illicit discussions and communities exist in plain sight. To surface these transcripts, Flashpoint provides a first-hand look into how to use specialized Discord search engines like dyskadia.com and discord.me to find publicly listed servers. Using OSINT pivoting techniques to leverage information from other social media platforms such as X and Reddit, investigators can uncover hidden communities using specific keywords and even emojis.

Tip 2: In-Server Extraction

After sourcing this information, security teams need to effectively extract it. In this webinar, Flashpoint provides a detailed overview into how to use Discord’s robust internal search function to filter thousands of messages. This tool, when combined with specific operators and modifiers, allows security teams to find exactly what they’re looking for, such as geolocation information.

Tip 3: Mitigating Risk

Lastly, Flashpoint emphasizes key operational security (OPSEC) and ethical considerations. There is a non-negotiable need for a managed attribution system that protects an investigator’s identity and host machine from exposure. Additionally, we underscore the importance of developing a thorough game plan before engaging with any server—especially those with lower member counts where interactions may be required to maintain unscrutinized access and credibility.

Enhance Investigations with Flashpoint

To gain a comprehensive understanding of Discord’s emerging role in the intelligence landscape, including a step-by-step walkthrough of investigative techniques and ways to navigate risky environments, watch the full on-demand webinar recording: Discord for OSINT: Level Up Your Investigations.