HADES framework detects hidden cybercriminal communities a year early

A new paper presented at ARES 2026 introduces HADES, an unsupervised framework designed to uncover hidden communities within cybercriminal underground forums. Unlike traditional graph-based methods that only capture dominant groups, HADES models users based on their textual interactions. It uses pretrained language models (specifically BERT) to generate semantic embeddings that encode latent behavioral and thematic patterns. By clustering users based on semantic similarity and assigning topic labels to the resulting clusters, HADES identifies specific threat communities that are otherwise invisible to standard detection techniques.

The framework was evaluated on three major forums: HackForums, Cracked, and BreachForums. Results show that BERT embeddings consistently outperform alternative baselines, improving cluster coherence and achieving higher silhouette scores. HADES identified dozens of distinct communities, effectively isolating small, specialized subgroups of fewer than 100 users that evade traditional detection. Crucially, because shared thematic interests often precede explicit structural connections, tracking these semantic patterns allows HADES to anticipate the formation of threat communities up to a year before they become detectable by traditional graph-based methods. This predictive capability provides a significant lead time for cyber threat intelligence operations.