I don't know what they do in the USG but discord is so popular for this sort of stuff, it's my go to (and slack or github) for exfiltrating data (legitimate pen

I don't know what they do in the USG but discord is so popular for this sort of stuff, it's my go to (and slack or github) for exfiltrating data (legitimate pentest or adversary simulation). It's very easy to get a webhook URL for a chatroom and just upload data to it or generate a url to download arbitrary attachments. Now, I would imagine anyone worth their salt would use dedicated rooms or servers for anythint nerarious. But in the corporate world there are sooo many security vendors that specialize in "dark web monitoring" which includes popular criminal forums but anywhere at all including discord, 4chan, reddit, telegram (very very popular now) and other places that attract anyone that will trade information. They monitor keywords that are related to your company and alert you, even pretend to be one if them and get the data to see what is being sold. Now I have seen USG entities do a lot more than this against targeted individuals. My guess is they just don't have enough people to do dragnet monitoring at their very large scale (even to look at keyword matches or tune rules). They'll probably just outsource this to google (owns mandiant now who have nation state level intel collection capacity) or crowdstrike.