User Guide

Synapse-Cybera User Guide

Synapse-Cybera adds Storm commands to ingest money-mule bank account intelligence and per-account evidence packages from the CYBERA API using your existing API key.

Getting Started

Check with your Admin to enable permissions and find out if you need a personal API key.

A user with their own key adds it as a self-scoped configuration:

cybera.config.add my_config myapikey --scope self

Every command takes an optional --config to pick a configuration by name. Without one you get your own if you have added it, and the global one if you have not.

Ingesting the mule account feed

cybera.intel.feed ingests the CYBERA Premium FIAT feed. Each record becomes an econ:bank:account for the mule account, a risk:attack for the report, and a risk:threat for the operator behind it.

> econ:bank:account:iban=AE920340003708510314301 | tee --join { :issuer -> ou:org } { :contact -> ps:contact } { <(uses)- risk:attack }
ou:org=aa39f782057b1354ce1d3ec8d1de1d05
        .created = 2026/09/04 19:08:10.208
        :country:code = ae
        :name = emirates islamic bank
ps:contact=e3cc908e0a21d1b6d1ab8bb09b174dc4
        .created = 2026/09/04 19:08:10.213
        :id = bkac_ciarppjokqh6zdz4
        :loc = ae
        :name = renanao theophilus seleko
        :type = cybera.holder
risk:attack=a3a246b4779c0fe0ba68887bd3e2237f
        .created = 2026/09/04 19:08:10.203
        :actor = ('risk:threat', 'a3a246b4779c0fe0ba68887bd3e2237f')
        :detected = 2026/08/04 00:00:00.000
        :ext:id = bkac_ciarppjokqh6zdz4
        :reporter = 45c6b4565ce30290fa7b4e36fa347617
        :reporter:name = cybera
        :type = cybera.advancefeefraud
econ:bank:account=80f398ff17c60a65e249722076aa2561
        .created = 2026/09/04 19:08:10.214
        :contact = e3cc908e0a21d1b6d1ab8bb09b174dc4
        :iban = AE920340003708510314301
        :issuer = aa39f782057b1354ce1d3ec8d1de1d05
        :issuer:name = emirates islamic bank
        :swift:bic = MEBLAEAD
        #rep.cybera.advancefeefraud

The contact is the holder the criminal supplied, which makes it the money mule rather than the person running the scam. The organization is the bank that issued the account, named again by the routing identifiers on :aba:rtn and :swift:bic.

Re-running the command updates the existing nodes rather than creating duplicates. Every report an operator is behind shares one risk:threat, so a walk from there covers all of them.

Use --since-last for incremental pulls. The command records the newest dateRecorded it has seen and resumes from there:

cron.add --name cybera.intel.feed --period daily@02:00 { cybera.intel.feed --since-last }

The checkpoint is written once the pull completes, so --size cannot be combined with it. Date filters apply to dateRecorded, the date CYBERA first ingested the record, not to when the scam activity was observed:

cybera.intel.feed --start-date 2026-05-01 --end-date 2026-05-31

Evidence

An evidence package holds the scam-bait correspondence, the entities the scammer referenced with the context each was used in, and the other mule accounts provided during the same engagement.

cybera.intel.feed pulls one for every record by default, which costs a request per record. Use --no-evidence for a large or exploratory pull:

cybera.intel.feed --no-evidence

cybera.intel.evidence pulls or refreshes a single report:

It also takes inbound risk:attack nodes, which is where the CYBERA id lives:

econ:bank:account:number=40630262974066296 <(uses)- risk:attack | cybera.intel.evidence

An account with no evidence package is reported and skipped rather than failing the batch.

CYBERA mints an id per report rather than per scammer, so the same operator turns up under several. The package names them, and they collapse onto one risk:threat:

> risk:attack:ext:id=bkac_v1h04og3gwwbs9u1 :actor -> risk:threat -> risk:attack
risk:attack=38a6d31b04596734e0f450899dc24b5d
        .created = 2026/09/04 19:08:10.375
        :actor = ('risk:threat', '38a6d31b04596734e0f450899dc24b5d')
        :ext:id = bkac_v1h04og3gwwbs9u1
        :reporter = 45c6b4565ce30290fa7b4e36fa347617
        :reporter:name = cybera
        :type = cybera.governmentimpersonationscam
risk:attack=cfd663667ff7b744d775403965adcacb
        .created = 2026/09/04 19:08:10.389
        :actor = ('risk:threat', '38a6d31b04596734e0f450899dc24b5d')
        :ext:id = bkac_285667qzhaumt89q
        :reporter = 45c6b4565ce30290fa7b4e36fa347617
        :reporter:name = cybera
risk:attack=38fdb6d177793845d3bcfd0572385e48
        .created = 2026/09/04 19:08:10.398
        :actor = ('risk:threat', '38a6d31b04596734e0f450899dc24b5d')
        :ext:id = bkac_y58klju1npfiwpg9
        :reporter = 45c6b4565ce30290fa7b4e36fa347617
        :reporter:name = cybera

The other two exist as risk:attack nodes now, so when the feed reaches them it fills in their bank details rather than creating anything new.

A name CYBERA types as a government or a company becomes an ou:name; an untyped one becomes a ps:name. Neither claims the organization or the person was involved – a scammer signing as the Australian Government has used the name, not the agency.

Attached files are downloaded into the Axon and parsed with Synapse-FileParser when that optional Power-Up is available. The raw .eml of each message lands on :bytes, anything else on inet:email:message:attachment:

> inet:email:message:bytes -> file:bytes
file:bytes=sha256:87ee18ece0db294b2fbac85ff48ef52e63ec6ab680f13297c7ddb5d4e176b6ab
        .created = 2026/09/04 19:08:10.455
        :md5 = a2ab8192b4b6109a0d0bf9619b8942bd
        :mime = message/rfc822
        :sha1 = 9d845c008658708cecc182dd7a107c389271d6fe
        :sha256 = 87ee18ece0db294b2fbac85ff48ef52e63ec6ab680f13297c7ddb5d4e176b6ab
        :sha512 = 96c38d2131e16b069508c77f6d2910022d93b79cd8828bb090352ae3a753f38cfe481384d52b1fab4123f3c2dd7702c58c4fa2cfb04b3c06d48117f5769a194c
        :size = 111821

Pivoting from an ingested account

The operator behind a report, and the addresses they used:

> risk:attack:ext:id=bkac_v1h04og3gwwbs9u1 :actor -> risk:threat -(uses)> inet:email
inet:email=communitygrantshub.dss.au@gmail.com
        .created = 2026/09/04 19:08:10.446
        :fqdn = gmail.com
        :user = communitygrantshub.dss.au

The routing identifiers that address an account:

> econ:bank:account:iban=AE920340003708510314301 :swift:bic -> econ:bank:swift:bic
econ:bank:swift:bic=MEBLAEAD
        .created = 2026/09/04 19:08:10.210
        :business = aa39f782057b1354ce1d3ec8d1de1d05

Every account CYBERA classified as an advance fee fraud:

> econ:bank:account#rep.cybera.advancefeefraud
econ:bank:account=68b12b00c87f15dad0c4c3a8898a958d
        .created = 2026/09/04 19:08:10.254
        :contact = 58c6b141a3feee17662263ea5a783642
        :iban = DK2966952001716827
        :issuer = b91bb611c8c9a6f200fde0d5d04d0232
        :issuer:name = lunar bank a/s
        :swift:bic = LUNADK22
        #rep.cybera.advancefeefraud
econ:bank:account=80f398ff17c60a65e249722076aa2561
        .created = 2026/09/04 19:08:10.214
        :contact = e3cc908e0a21d1b6d1ab8bb09b174dc4
        :iban = AE920340003708510314301
        :issuer = aa39f782057b1354ce1d3ec8d1de1d05
        :issuer:name = emirates islamic bank
        :swift:bic = MEBLAEAD
        #rep.cybera.advancefeefraud

Who the scam-bait correspondence for a report came from:

> risk:attack:ext:id=bkac_v1h04og3gwwbs9u1 -(uses)> inet:email:message :from -> inet:email
inet:email=communitygrantshub.dss.au@gmail.com
        .created = 2026/09/04 19:08:10.446
        :fqdn = gmail.com
        :user = communitygrantshub.dss.au

A name the scammer claimed, and the analyst note on how they used it:

> ou:name='australian government' <(about)- meta:note
meta:note=d18705e8871ebfe43ecf265905a53e86
        .created = 2026/09/04 19:08:10.498
        :text = Appears in branding 'Community Grants Hub - Australian Government' implying official government affiliation.

Which report a claimed affiliation came from:

> ou:name='australian government' <(uses)- risk:attack
risk:attack=38a6d31b04596734e0f450899dc24b5d
        .created = 2026/09/04 19:08:10.375
        :actor = ('risk:threat', '38a6d31b04596734e0f450899dc24b5d')
        :ext:id = bkac_v1h04og3gwwbs9u1
        :reporter = 45c6b4565ce30290fa7b4e36fa347617
        :reporter:name = cybera
        :type = cybera.governmentimpersonationscam

Every name that operator claimed, across all of their reports:

> risk:attack:ext:id=bkac_v1h04og3gwwbs9u1 :actor -> risk:threat -(uses)> ps:name
ps:name=ahmad afriliyanto
        .created = 2026/09/04 19:08:10.475
ps:name=daniel lopori
        .created = 2026/09/04 19:08:10.470
ps:name=grace holloway
        .created = 2026/09/04 19:08:10.465
ps:name=yusuf abiodun afolabi
        .created = 2026/09/04 19:08:10.480
ps:name=community grants hub
        .created = 2026/09/04 19:08:10.460

Use of `meta:source` nodes

Synapse-Cybera uses a meta:source node and -(seen)> light weight edges to track nodes observed from the Cybera API.

> meta:source=3c5b9fe6e27488024c3ef09eaa317648
meta:source=3c5b9fe6e27488024c3ef09eaa317648
        .created = 2026/09/04 19:08:10.064
        :name = cybera api
        :type = synapse.cybera

Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-Cybera. The following example shows how to filter the results of a query to include only results observed by Synapse-Cybera:

> econ:bank:account +{ <(seen)- meta:source=3c5b9fe6e27488024c3ef09eaa317648 }
econ:bank:account=38a6bf28716ac826c22ae0c275330cbb
        .created = 2026/09/04 19:08:10.160
        :contact = 758da76659a50fec77fe3ce1a22c6993
        :iban = LU314080000047903020
        :issuer = b3423eaef462ab5646179e60df07efc9
        :issuer:name = banking circle
        :swift:bic = BCIRLULL
        #rep.cybera.investmentscam
econ:bank:account=3c1921a7fdb39b48ec44a279023e9539
        .created = 2026/09/04 19:08:10.103
        :contact = 49f4185001451dc849e1b2340e6d40f8
        :issuer = 7a3b4aaaffffee6fe5fd67e32f44d91f
        :issuer:name = cibc
        :number = 6060439
        #rep.cybera.inheritancescam
econ:bank:account=448b585320ce69501cd629fb72238540
        .created = 2026/09/04 19:08:10.290
        :contact = fc98c84bad67f8d688cb4cb36d3ef6b3
        :issuer = 3b4a34d2d72468971d425ff8606bc33d
        :issuer:name = bank of montreal (bmo)
        :number = 3876834
        #rep.cybera.lotteryscam
econ:bank:account=68b12b00c87f15dad0c4c3a8898a958d
        .created = 2026/09/04 19:08:10.254
        :contact = 58c6b141a3feee17662263ea5a783642
        :iban = DK2966952001716827
        :issuer = b91bb611c8c9a6f200fde0d5d04d0232
        :issuer:name = lunar bank a/s
        :swift:bic = LUNADK22
        #rep.cybera.advancefeefraud
econ:bank:account=80f398ff17c60a65e249722076aa2561
        .created = 2026/09/04 19:08:10.214
        :contact = e3cc908e0a21d1b6d1ab8bb09b174dc4
        :iban = AE920340003708510314301
        :issuer = aa39f782057b1354ce1d3ec8d1de1d05
        :issuer:name = emirates islamic bank
        :swift:bic = MEBLAEAD
        #rep.cybera.advancefeefraud