OSINT Intelligence Specialist Programme — DSTA Edition

Open Source Intelligence
Specialist Training

From OSINT fundamentals to AI-driven intelligence automation — build operational
collection, analysis, and reporting capabilities in an intensive hands-on programme.

13 – 16 Oct 2026 (4 Days)
DSTA Lecture Theatre, Singapore
10:00 – 17:30 Daily · ~20 Participants
4DAYS
Intensive Course
21+
Verified Curriculum Runs
AI Based
OSINT Automation
DARKWEB
Threat Intelligence
3,500USD
Per Participant
Register Now Programme Overview
Programme Highlights

Why This Programme?

This DSTA-tailored programme is built around real-world intelligence workflows.
The programme is entirely dedicated to AI-Driven OSINT operations.

AI-Driven OSINT Automation

LLM-powered collection automation, generative AI for intelligence report drafting — real operational workflows covered end-to-end.

Dark Web Intelligence Analysis

Hands-on dark web monitoring and threat intelligence collection using the StealthMole platform and operational tradecraft.

Hands-On Curriculum

Learn by doing — not by listening. Real tools, real scenarios, immediate operational capability uplift.

Legal & Ethical Standards

All exercises conducted strictly within legal and ethical boundaries. Privacy protection principles fully respected throughout.

Defence-Focused Scenarios

Case studies and scenarios curated for defence and national security contexts — directly applicable to your operational environment.

Certified Instructors

Taught by StealthMole's senior OSINT practitioners with proven operational backgrounds across Asia-Pacific.

What is OSINT?

Open Source Intelligence Overview

Understanding OSINT — what it is, how it is used, and what the boundaries are.

OSINT Definition

OSINT (Open Source Intelligence) refers to intelligence gathered and analysed from publicly available sources — internet, social media, news, public databases, academic publications, and more.

It is used across government intelligence agencies, cybersecurity teams, corporate security, journalism, and law enforcement as one of the most critical intelligence disciplines in the digital age.

Legal & Ethical OSINT Principles
Collect only publicly available information (no unauthorised access)
Establish a clear and legitimate purpose for collection
Comply with data protection laws and regulations
Safeguard collected data securely
Use analysis results responsibly
Key Use Cases
Cyber Threat Intelligence (CTI) collection & analysis
Corporate competitive intelligence & supply chain risk
Incident response & threat actor tracking
Law enforcement support & digital forensics
Investigative journalism & fact-checking
Personal digital security & privacy management
Prohibited Activities
Unauthorised system access or hacking
Stalking-type collection for personal tracking
Illegal trading or sharing of collected data
Generating or manipulating disinformation
Violating the privacy of others
Tools & Platforms

OSINT Core Tools

Key tools you will practise hands-on throughout the programme.

Maltego
Visual link analysis & relationship mapping platform
Link Analysis
SpiderFoot
Automated OSINT collection & scanning tool
Automation
Shodan
Internet-connected device search engine
Infrastructure
Google Dorking
Advanced search operator-based precision intelligence
Search Intel
StealthMole
Dark web monitoring & threat intelligence platform
Dark Web
Recon-ng
Modular web reconnaissance framework
Recon
Reverse Image Search
Image reverse lookup via TinEye, Yandex, Google
GEOINT
theHarvester
Email, domain, and subdomain collection tool
Email OSINT
WHOIS / DNS
Domain registration & DNS record analysis
Domain
SOCMINT Tools
Social media intelligence collection tools
Social
ChatGPT / Claude
AI-powered intelligence report drafting & automation
AI
Wayback Machine
Historical web page archival & retrieval
Archive
Schedule & Benefits

Programme Schedule & Exclusive Benefits

Four intensive days of hands-on OSINT training — 13–16 October 2026.

Day
Date
Topic
1
13 Oct (Tue)
OSINT Training Overview, Privacy & Protection, and Dark Web Fundamentals
2
14 Oct (Wed)
Various Intelligence Case Studies and Hands-On Practice
3
15 Oct (Thu)
Applying Real-World Scenarios and Writing Analytical Reports
4
16 Oct (Fri)
Advanced Dark Web Investigation and Hidden Infrastructure Analysis
Participant Exclusive Benefits
StealthMole Platform 1-Month Licence
USD 5,000 value — full dark web intelligence platform access
Online Training 1-Year Subscription
Access to on-demand OSINT learning content for 1 year
Industry Expert Networking
Direct exchange with OSINT and security industry professionals
Certificate of Completion
Official StealthMole Academy certificate issued upon completion
Workshop Materials & Cheat Sheets
Lecture materials, practice guides, and tool cheat sheets provided
Detailed Curriculum

Day-by-Day Session Breakdown

A full hour-by-hour view of the four-day programme (10:00 – 17:30 daily).

1 Fundamentals13 Oct
2 Case Studies14 Oct
3 Scenarios & Reporting15 Oct
4 Advanced & APT16 Oct
Day 1 — Overview of OSINT Training, Privacy & Protection, and Dark Web Fundamentals
13 October 2026 (Tue) · 10:00 – 17:30
10:0060 min
Orientation
  • Introduction to OSINT and real-world case studies
  • OSINT hacking competition platforms overview
  • Case studies: Changi Airport, Rwanda power plant, BJORKA
11:2060 min
Anonymous Investigation Setup: Privacy Tools & Secure Environment
  • DJ Shino profiling case (intro exercise)
  • Privacy & protection checklist
  • Environment setup: OSINT Linux distro, TorSocks test
12:2070 min
Lunch Break / Q&A
13:3070 min
Hands-On: Anonymous Account Creation and Dark Web Access
  • Tor node configuration & Iran network access setup
  • Tools for anonymous account creation (email, SMS, voice)
  • Registering on dark web forums with anonymous accounts
15:0070 min
Dark Web Environment Part 1
  • Introduction to TOR and I2P; building a Tor web server
  • Overview of Freenet and Zeronet
  • Bypassing Tor hidden service anonymity (2 vulnerability types)
16:3060 min
Dark Web Environment Part 2
  • Extended hands-on: Tor hidden service anonymity bypass
  • Review and consolidation of Day 1 content
Day 2 — Various Intelligence Case Studies and Hands-On Practice
14 October 2026 (Wed) · 10:00 – 17:30
10:0060 min
Dark Web Trends and Tracking Cases
  • Dark web anonymity principles and crime trend analysis
  • Basic intelligence search using the StealthMole platform
11:2060 min
Geolocation-Based Intelligence
  • Physical location intelligence using GPS and related signals
  • Cyber location intelligence using IP-based methods
  • Tracking real IP addresses behind dark web servers
12:2070 min
Lunch Break / Q&A
13:3070 min
Intelligence Based on Unique Characteristics
  • Identifying unique server fingerprints on the dark web
  • Applying unique characteristics to intelligence collection
15:0070 min
Intelligence Using Leaked Accounts
  • Structured analysis of leaked account datasets
  • Tracking criminal identities through credential correlation
16:3060 min
Criminal Groups on the Dark Web
  • Tracking ransomware groups and data leak operations
  • Telegram-based intelligence gathering and identity tracking
  • Facial similarity analysis for criminal identity attribution
Day 3 — Applying Real-World Scenarios and Writing Analytical Reports
15 October 2026 (Thu) · 10:00 – 17:30
10:0060 min
Latest OSINT Techniques Part 1
  • Key OSINT developments in 2024–2026
  • Real-world OSINT scenario simulation and hands-on practice
  • GEOINT using fire incident data and social media imagery
11:2060 min
Latest OSINT Techniques Part 2
  • GEOINT case study: Israel's airstrike on Iran
  • GEOINT cases and hands-on exercises related to North Korea
12:2070 min
Lunch Break / Q&A
13:3070 min
Reporting Techniques Part 1
  • Deriving intelligence insights from OSINT investigation data
  • Structured methodology for post-analysis report writing
15:0070 min
Reporting Techniques Part 2
  • Key components of a professional OSINT report
  • Sample report analysis and critique
  • Data visualization and organizational techniques
16:3060 min
Group Activities — Intelligence Sharing
  • Team presentations and peer feedback on investigation findings
  • Collaborative OSINT methods and division of labor strategies
  • Integrating team findings into a unified intelligence output
Day 4 — Advanced Dark Web Investigation and Hidden Infrastructure Analysis
16 October 2026 (Fri) · 10:00 – 17:30
10:0060 min
Advanced Dark Web Investigation Part 1
  • Dark web site classification: forums, leak sites, markets, fraud infrastructure
  • Onion service structures and hidden service characteristics
  • Identifying mirrors, clones, and fake dark web services
11:2060 min
Advanced Dark Web Investigation Part 2
  • Infrastructure-based intelligence collection from hidden services
  • Case study: tracking and analysis of ransomware leak sites
12:2070 min
Lunch Break / Q&A
13:3070 min
APT Tracking & Attribution Part 1 — Lazarus / APT38 Profiling
  • APT Profiling Framework: APT lifecycle and attribution pyramid (TTPs, infrastructure, persona, motive); Diamond Model & MITRE ATT&CK mapping for state-sponsored actors
  • DPRK Threat Landscape: RGB structure and cluster mapping — Lazarus, APT38, Andariel, Kimsuky, BlueNoroff; revenue generation, sanctions evasion, espionage
  • Lazarus / APT38 Case Study: SWIFT attacks, crypto exchange heists (Ronin, WazirX); supply chain — 3CX, npm poisoning, IT Worker scheme; Hands-on: Lazarus persona profiling via StealthMole CDS
15:0070 min
APT Tracking & Attribution Part 2 — APT41 / Winnti Cluster Analysis
  • PRC Threat Landscape: MSS/PLA-affiliated clusters — APT41, APT10, APT40, APT31; contractor ecosystem and dual-mission model
  • APT41 / Winnti Deep Dive: sub-cluster overlaps (Barium, Winnti, Wicked Panda, Blackfly); supply chain attacks, code-signing theft, ShadowPad/PlugX; i-Soon leak (2024) analysis
  • Comparative Analysis: Lazarus vs. APT41 — infrastructure patterns, OPSEC failures, attribution pitfalls; shared DDW touchpoints
16:3060 min
Capstone & Final Review — Integrated APT Investigation Exercise
  • End-to-End Workflow: IOC seeding → infrastructure pivot → DDW correlation → PSINT enrichment → attribution scoring
  • Capstone Group Exercise: DPRK crypto theft, PRC supply chain compromise, hybrid actor disambiguation; build attribution case using StealthMole + OSINT tooling
  • Presentations & Wrap-up: team attribution briefs with confidence assessment; instructor feedback and course consolidation
Who Should Attend

Recommended Participants

This programme is designed for DSTA and defence-sector professionals who need operational OSINT capability.

Defence Analysts
DSTA analysts and intelligence personnel who need operational OSINT skills for national security missions
Cybersecurity Professionals
Security personnel seeking to strengthen threat intelligence and incident response capability
Intelligence & Investigators
Government agency personnel seeking advanced digital investigation techniques
Security Researchers
Researchers advancing threat actor tracking and intelligence analysis in the defence domain
Programme Managers
Leaders overseeing security operations who need a practical understanding of OSINT capabilities
Recommended Videos

Pre-Study Learning Videos

Recommended OSINT reference videos to review before the programme begins.

OSINT Introduction: What is Open Source Intelligence?
An introductory lecture covering OSINT fundamentals, concepts, and operational scope
Intro Concepts
Complete Google Dorking Guide
Advanced search operator techniques for precision intelligence collection
Basics Search Techniques
Analysing Internet Assets with Shodan
Hands-on internet-connected device intelligence collection using the Shodan search engine
Intermediate Infrastructure
Registration

Join the DSTA OSINT Academy

Limited seats available. Contact your DSTA programme coordinator for registration details.

Register Now Sign In