Cyber Investigations What happened, how far it went, and what the evidence shows

01Definition

What are cyber investigations?

Cyber investigations are structured inquiries into incidents in which computers, networks, cloud services, accounts or digital channels were used to cause harm. The harm might be theft of money through a manipulated payment instruction, encryption of systems by ransomware, unauthorized access to personal data, theft of trade secrets by a departing employee, or a fraud carried out with a cloned voice on a video call. In every case the goal is the same: establish what actually happened, with evidence.

That distinguishes cyber investigations from general incident response. Incident response focuses on stopping the attack and restoring operations, which is urgent and essential. Investigation runs alongside it and asks the questions that matter afterwards. How did the attacker get in. When. Which accounts and systems did they use. What data did they view or take. Was money moved, and where did it go. Is there evidence that identifies who was responsible. Those answers drive legal notification decisions, insurance claims, recovery efforts, litigation and, where appropriate, referrals to law enforcement.

Delator's cyber investigations are performed by its own consultants. Nothing technical is subcontracted. The team includes technology specialists of many kinds, consultants with U.S. military intelligence and Department of Homeland Security backgrounds, and former law enforcement officers who have handled digital evidence for prosecution. The combination matters, because an investigation has to be technically correct and also presentable to a lawyer, a regulator, an insurer or a court.

02Authorization

Written authorization comes before any technical work

Every Delator cyber investigation begins with a written authorization signed by the owner of the systems involved. That document defines which systems, accounts, devices and data sources are in scope, the dates the work may take place, the rules of engagement, who can approve changes, and the emergency contacts on both sides. It is not a formality. Accessing a computer or account without authorization is a crime under laws such as the U.S. Computer Fraud and Abuse Act and the UK Computer Misuse Act 1990, and most countries have similar offences, many modelled on the Council of Europe's Budapest Convention on Cybercrime.

Ownership is not always obvious. Cloud tenants, managed service providers, personal devices used for work, shared accounts and systems belonging to subsidiaries in other countries can all complicate the question of who can authorize access. Delator's consultants work through those questions with the client and counsel during scoping, and where a third party controls a relevant system, such as a hosting provider or a vendor, the scope either includes that party's authorization or relies on data the client is entitled to obtain from it.

The same principle applies to employee devices. A company can generally authorize examination of company-owned equipment and company accounts, subject to local employment and privacy law. A personal phone is a different matter, and Delator will not examine one without the device owner's informed consent or a lawful order. Getting these boundaries right protects the client and preserves the value of the evidence.

What the written authorization covers

Delator's authorization document is short enough to sign quickly in an emergency and specific enough to settle questions later. It is signed by someone with real authority over the systems, typically a senior officer, and where counsel engages Delator it sits alongside counsel's engagement letter rather than replacing it.

• The legal entity that owns the systems and the name and title of the signatory
• Systems, tenants, accounts, devices and data sources in scope, and any that are expressly excluded
• Start and end dates, and how the period can be extended
• Permitted activities, such as forensic imaging, log export, memory capture and malware analysis
• Rules of engagement for live systems, including what may not be changed or shut down
• Emergency contacts on both sides, available around the clock during the active phase
• Data handling terms: storage location, access, retention and return or destruction at closure

03First hours

The first hours: preserving evidence while the incident is contained

The decisions made in the first hours of an incident often determine what an investigation can later prove. Rebuilding a compromised server without imaging it first, resetting every password before collecting authentication logs, or letting cloud audit logs roll over after their default retention period can destroy the evidence needed to scope the incident. Containment and preservation must happen together.

Delator follows the principle described in RFC 3227 of collecting the most volatile evidence first: memory and running processes, network connections, then system and application logs, then disk images and backups. In cloud environments, the priority is exporting audit and sign-in logs, mailbox audit records and identity provider data before retention limits expire, and preserving configuration states that may change as remediation proceeds.

Delator's incident handling aligns with NIST Special Publication 800-61, whose third revision, published in April 2025, places incident response within the broader risk management functions of the NIST Cybersecurity Framework 2.0. For forensic technique, the team draws on NIST SP 800-86 and on ISO/IEC 27037, the international guideline for identifying, collecting, acquiring and preserving digital evidence.

• Do not wipe or rebuild affected systems until counsel and the investigators agree evidence has been preserved
• Export cloud and identity logs immediately; default retention periods can be short
• Record every action taken by internal staff and vendors, with times, so investigators can distinguish them from attacker activity
• Preserve copies of attacker communications, ransom notes and fraudulent emails in original format with headers
• Contact your bank immediately if money has moved, because recall chances fall quickly with time
• Notify your cyber insurer early, since many policies set conditions on which vendors and counsel may be appointed

04BEC

Business email compromise and payment diversion investigations

Business email compromise remains one of the most financially damaging forms of cybercrime reported to the FBI's Internet Crime Complaint Center. The pattern is familiar: an attacker gains access to a mailbox, or impersonates one convincingly, watches conversations about payments, and inserts a change of bank details at the right moment. Sometimes the compromised mailbox belongs to the victim; often it belongs to a supplier, customer, law firm or title agent, and the victim's systems were never breached at all.

A BEC investigation answers several questions in parallel. Which mailbox was compromised, and how: phishing, password reuse, an MFA fatigue attack, a malicious OAuth application consent, or a session token theft that bypassed multi-factor authentication entirely. What mailbox rules did the attacker create to hide replies. Which messages did they read, forward or send. Whose side of the transaction was breached, which often determines who bears the loss. And where did the money go.

Speed matters for recovery. In the United States, victims should report to IC3 and their bank as quickly as possible, because the FBI's Recovery Asset Team works with financial institutions to freeze funds that are still within reach. International transfers can sometimes be recalled through the banking network if the receiving bank acts before the funds are moved on. Delator supports these steps by quickly establishing the facts the bank and law enforcement need, and later by tracing funds that have already moved, working with counsel on any court process required to freeze them.

What the mailbox evidence usually shows

In Microsoft 365 and Google Workspace environments, sign-in logs, unified audit records and mailbox audit data can show the attacker's IP addresses and devices, the rules they created, the folders they accessed and the messages they sent. Message headers distinguish lookalike domains from genuine accounts. Taken together, this evidence typically establishes the entry point, the dwell time and the extent of the attacker's visibility into other conversations, which matters when deciding whether other counterparties need to be warned.

05Ransomware

Ransomware and extortion: scoping access, exfiltration and sanctions risk

Modern ransomware is usually double extortion. Before encrypting systems, the attacker copies data out and then threatens to publish it. That means recovery from backups solves only half the problem. The legal and reputational exposure depends on what was taken, and answering that question is the central task of a ransomware investigation.

Delator reconstructs the intrusion from initial access through lateral movement, privilege escalation, data staging and exfiltration, mapping attacker behaviour to MITRE ATT&CK techniques so that findings are precise and comparable. Evidence of exfiltration can come from firewall and proxy logs, cloud storage access records, endpoint telemetry, the presence of archiving or transfer tools, and data volumes leaving the network. Where data has been published on a leak site, analysis of the published files can confirm what the attacker actually held.

Decisions about engaging with an extortion actor belong to the client, its counsel and its insurer. Delator does not negotiate on a client's behalf. It does supply facts that bear on those decisions, including what data the attacker likely holds and what is known about the group involved. The U.S. Treasury's Office of Foreign Assets Control has warned, in an advisory updated in 2021, that facilitating ransomware payments to sanctioned persons can violate U.S. sanctions, which is one of many reasons those decisions should involve counsel.

Backups, restoration and the evidence they hold

Attackers increasingly target backups before triggering encryption, deleting snapshots or encrypting backup servers to increase pressure. Backup systems also hold evidence: snapshots taken before and during the intrusion can show when attacker tools first appeared and what systems looked like before they were altered. Delator works with the restoration team so that restoring operations does not overwrite the snapshots that answer the scoping questions, and so that restored systems are checked for persistence mechanisms the attacker may have left behind.

06Accounts

Account takeover, insider misuse and executive targeting

Account takeover investigations focus on how an attacker gained control of an account and what they did with it. The account might be a corporate identity with access to sensitive systems, a customer account in an online platform, a social media profile used to impersonate an executive, or a personal email account that controls password resets for everything else. SIM swapping, credential stuffing, session hijacking and help desk social engineering are common paths, and each leaves a different trail.

Insider cases are different in tone but similar in method. When a departing employee is suspected of taking customer lists, source code or product designs, Delator examines company-owned laptops, company accounts, cloud storage, email and endpoint logs for evidence of copying, uploading, printing or forwarding. The output is a factual account of what moved, when and to where, suitable for counsel to use in seeking injunctive relief or negotiating return of the material. Delator's insider threat investigations page describes the wider programme side of this work.

Some cyber investigations raise questions about the people involved, such as whether a suspected insider has links to a competitor or whether an attacker persona matches a real individual. Where a scope includes background checks on employees or individuals, Delator leverages a locally licensed partner in its network to complete that work and does not do it itself.

Help desk and identity provider attacks

Some of the most damaging recent intrusions began with a phone call to an IT help desk, in which an attacker posing as an employee persuaded staff to reset a password or enrol a new multi-factor device. These cases leave little malware to analyse. The evidence sits in help desk tickets, call records, identity provider logs and the sequence of administrative changes that followed. Delator reconstructs that sequence and identifies the verification step that should have stopped it.

07Notification

Data breach scoping and the notification clocks it drives

Once personal data or regulated information is involved, legal deadlines start running, and many of them start from when the organization became aware of the breach or determined it was significant. The investigation has to produce reliable scoping facts quickly enough for counsel to meet those deadlines, and then refine them as the picture becomes clearer. Over-notification creates unnecessary alarm and cost; under-notification creates regulatory exposure.

The table summarizes some regimes that frequently apply to multinational incidents. It is not exhaustive and is not legal advice; counsel determines which obligations apply and how. What the table shows is why cyber investigations must be organized around time, with early findings delivered in stages rather than held back for a final report.

08Forensics

Digital forensics and evidence that holds up

Forensic soundness is what separates an investigation from an opinion. Delator acquires evidence using forensic tools that do not alter the source where avoidable, verifies acquisitions with cryptographic hash values, and records each transfer of custody. Where live collection is necessary, such as memory capture or cloud log export, the steps taken and their effects are documented so that another examiner could understand and reproduce them.

Sources vary by case: laptops and servers, mobile devices, cloud tenants, email platforms, collaboration tools, endpoint detection systems, firewalls, identity providers and backup systems. Each has its own artefacts and retention behaviour. An experienced examiner knows that browser history, prefetch records, USB connection logs, cloud sync databases and mailbox audit entries can each tell part of the story, and that their absence can be as significant as their presence.

Findings are reported with the evidence that supports them and the limits that apply. If a log source was not available for part of the period, the report says so. If a conclusion rests on inference, the reasoning is set out. That candour is what allows a report to survive an opposing expert's review.

Moving evidence across borders

International cyber investigations often require moving data from one country to another for analysis, and that transfer can itself be regulated. Transfers of personal data out of the EU or UK need a valid mechanism under Chapter V of the GDPR. China's Personal Information Protection Law and Data Security Law restrict providing data stored in China to foreign judicial or law enforcement authorities without government approval. Delator plans collection and analysis locations during scoping so that the investigation does not create a new compliance problem.

09Crypto

Cryptocurrency tracing in cyber investigations

Cryptocurrency appears in many cyber investigations: as the ransom currency in extortion cases, as the destination of funds stolen through account takeover, and as the medium for investment fraud schemes. Public blockchains record transactions permanently, so value can be followed from address to address. The analytical challenge is attributing addresses to real entities, especially exchanges and other service providers that hold customer identification records.

Delator traces flows, documents each hop, identifies where funds reached exchanges or other regulated providers, and explains the clustering and attribution methods used. Counsel can then seek disclosure or freezing orders against those providers, and law enforcement can use the analysis in their own inquiries. Confidence is graded plainly, because mixing services, cross-chain bridges and privacy coins can introduce real uncertainty. Delator's international asset tracing page covers how digital assets fit into wider recovery efforts.

Investment and relationship-based crypto fraud

A large share of crypto losses come not from technical intrusion but from long-running deception: fake trading platforms, fraudulent investment advisers, and schemes in which victims are groomed over weeks before being persuaded to transfer funds. These cases still benefit from tracing, because the funds usually pass through exchanges at some point. Delator documents the communications, the platforms used and the on-chain flows, giving counsel and law enforcement a coherent account rather than a pile of screenshots.

10AI fraud

Deepfake and AI-enabled fraud investigations

Generative AI has made impersonation cheap. Voice cloning can reproduce an executive from a few minutes of public audio, and video deepfakes can be convincing enough to deceive staff on a live call. In a widely reported 2024 case, an employee in the Hong Kong office of engineering firm Arup transferred roughly US$25 million after a video conference in which the other participants, including a person presenting as the chief financial officer, were deepfakes.

Investigating these incidents means reconstructing the deception and the money trail together. Delator preserves the communications involved, including meeting platform logs, call records and any recordings, examines how the attacker obtained the context they used, such as compromised mailboxes, leaked documents or public sources, and traces the resulting payments. Analysis of synthetic media can sometimes identify artefacts or inconsistencies, but detection tools are imperfect, and Delator reports their results with appropriate caution.

The most valuable output is often a clear account of which control failed. A payment approval that relied on recognizing a voice or a face is vulnerable by design. Out-of-band verification through a known number, multi-person approval for unusual transfers, and code words for urgent requests are practical defences. Delator's security consulting work helps organizations build those controls after an incident.

• Verify any unusual payment request through a separately sourced, known phone number, never one supplied in the request
• Require two people to approve new payees and changes to bank details
• Treat urgency and secrecy in a payment request as warning signs in themselves
• Limit the public audio and video of senior executives where practical, and brief them on impersonation risk
• Rehearse the response, so staff know a challenge to a senior caller will be supported

11Privilege

Privilege, reporting structure and working with counsel

How a cyber investigation is engaged can affect whether its findings are protected from disclosure in later litigation. In the United States, courts have examined this closely. In the Capital One data breach litigation in 2020, a federal court in Virginia ordered production of a forensic report even though outside counsel had engaged the firm, finding that the work would have been done in the ordinary course of business regardless of litigation. The lesson for companies is that engagement terms, the purpose of the work, who receives the report and how it is used all matter.

Delator commonly works under an engagement with breach counsel, with communications routed through counsel and the scope tied to legal advice. Where a company also needs a technical report for operational or regulatory purposes, it may be appropriate to separate that from the privileged legal investigation. These are decisions for counsel. Delator's role is to structure its work and reporting so that whichever approach counsel chooses can be followed consistently.

Delator also coordinates with the other parties who typically surround a significant incident: the cyber insurer and its panel requirements, the client's internal IT and security teams, managed service providers, public relations advisers and, where the client chooses to report, law enforcement agencies. Clear lines of communication avoid duplicated work and contradictory statements.

Working with law enforcement

Whether to report an incident to police or a national cyber agency is the client's decision, made with counsel. Reporting can open doors that private parties cannot, such as requests to foreign authorities, coordination with other victims of the same group and, in some cases, access to decryption keys recovered in prior operations. When a client chooses to report, Delator prepares the technical summary and indicators the agency will need, and preserves evidence so that it remains usable if a prosecution follows.

12Outcomes

What clients receive from Delator cyber investigations

Clients receive findings in stages. Early scoping findings give counsel what they need for initial notification and containment decisions, clearly labelled as preliminary. Later updates refine scope as more evidence is analysed. The final report sets out a timeline of attacker activity, the root cause, the systems and data affected, evidence of exfiltration or its absence, indicators of compromise for defenders, and specific remediation recommendations.

Remediation advice is practical and tied to what actually happened. If the attacker came in through a misconfigured remote access service, the recommendation addresses that service and the process that left it exposed. If a payment control failed, the recommendation addresses the approval workflow. Where a client wants to test whether fixes work, Delator's penetration testing and social engineering services can be engaged separately under their own written authorizations.

Throughout, Delator's cyber investigations aim for one standard: findings that a general counsel, a CISO, a regulator and an opposing expert would each accept as fair and well-supported.

Step by step

How an Engagement Works

1. 01

   Urgent call and triage

   We take the facts, advise on immediate preservation steps, and identify counsel, insurer and key contacts.

2. 02

   Written authorization and scope

   The system owner signs an authorization covering systems, dates, rules of engagement and emergency contacts before any technical work.

3. 03

   Evidence preservation

   Consultants collect volatile data, export cloud and identity logs, and image systems with hash verification and chain of custody.

4. 04

   Analysis and reconstruction

   We reconstruct the attack timeline, map techniques to MITRE ATT&CK, and determine access and exfiltration scope.

5. 05

   Staged findings

   Preliminary findings go to counsel early for notification decisions, followed by refined updates as analysis continues.

6. 06

   Recovery and tracing support

   Where money or cryptoassets moved, we trace flows and provide facts for bank recalls, law enforcement reports and court orders.

7. 07

   Final report and remediation

   You receive a documented timeline, root cause, scope, indicators of compromise and specific remediation recommendations.

Deliverables

What You Receive

• Preliminary scoping memo for counsel's early notification decisions
• Attack timeline from initial access to containment
• Root-cause analysis with the specific weakness exploited
• Scope of systems, accounts and data accessed, and evidence on exfiltration
• Indicators of compromise for internal defenders and partners
• Funds and cryptocurrency tracing analysis where money moved
• Forensic evidence pack with hash values and chain of custody records
• Specific, prioritized remediation recommendations
• Expert declaration or testimony support where counsel requires it

Industries

Who Uses Cyber investigations Services

• Law firms and title companiesHold client funds and confidential data that attract payment diversion and extortion.
• Financial servicesFace DORA, NYDFS and other strict incident reporting regimes alongside direct fraud losses.
• HealthcareRansomware disrupts care and HIPAA breach notification turns on precise scoping.
• Manufacturing and industrial firmsOperational disruption and theft of designs or process data carry high costs.
• Technology and software companiesSource code, customer data and cloud environments are prime targets.
• Professional services and consultanciesMailbox compromise exposes many clients' information at once.
• Family offices and high-profile executivesAccount takeover, impersonation and deepfake fraud target personal and corporate wealth.

Credentials

Who Does the Work

Delator Global's consultants come from backgrounds where finding facts under pressure is the job: U.S. military intelligence, the Department of Homeland Security, former law enforcement officers of every kind, former bounty hunters, and technology specialists across networks, applications, forensics and data. Behind them sits a network of locally licensed partners holding a wide range of licences and certifications, so every part of an engagement is done by someone entitled to do it in that country.

• Military intelligenceCollection planning, analysis and reporting discipline.
• Homeland securityFederal investigative and border, trade and financial crime experience.
• Law enforcementInterviewing, evidence handling and courtroom testimony.
• Bail enforcementLocating people who do not want to be found, lawfully.
• TechnologyNetwork, application, cloud and forensic specialists.
• Licensed partnersLocal licences for the work local law reserves.

Related services

Related Delator Global Services

• Penetration testingInternational Penetration TestingDelator Global provides international penetration testing for companies whose systems, offices and data sit in more than one country.
• CorporateInsider Threat InvestigationsInsider threat investigations examine what happens when someone with legitimate access, an employee, contractor, partner or former staff member, uses it to take data, steal trade secrets, commit fraud or cause harm.
• CorporateInternational Asset TracingInternational asset tracing is the work of finding out what a debtor, a fraudster or a counterparty really owns or controls outside its home country, and where it sits, so that a judgment, an arbitral award or a fraud claim turns into money.
• ConsultingInternational Security ConsultingDelator Global provides international security consulting to general counsel, CFOs, CISOs and compliance leaders who need practical advice on risks that cross borders.
• Penetration testingSocial Engineering Testing and Red Team ExercisesDelator Global runs social engineering testing and red team exercises for organizations that want to know how their people, processes and defences hold up against a determined attacker.

Every Delator Global service

Countries

Where Delator Global Works

Delator Global handles matters in 152 countries, with a country page for each and a city page for every city over 200,000 people. Larger markets are listed below; the full list is on the international page.

• United Kingdom
• Canada
• Mexico
• Germany
• France
• India
• Brazil
• Australia
• Japan
• United Arab Emirates
• South Africa
• Nigeria
• China
• South Korea
• Spain
• Italy
• Netherlands
• Poland
• Turkey
• Philippines
• All 152 countries