Cybercrime presents a significant threat to global society. With the number of cybercrimes increasing year after year and the financial losses escalating, law enforcement must advance its capacity to identify cybercriminals, collect probative evidence, and bring cybercriminals before the courts. Arguably to date, the approach to combatting cybercrime has been technologically centric (e.g., anti-virus, anti-spyware). Cybercrimes, however, are the result of human activities based on human motives. It is, therefore, important that any comprehensive law enforcement strategy for combatting cybercrime includes a deeper understanding of the hackers that sit behind the keyboards. The purpose of this systematic review was to examine the state of the literature relating to the application of a human-centric investigative tool (i.e., profiling) to cybercrime by conducting a qualitative meta-synthesis. Adhering to the PRISMA 2020 guidelines, this systematic review focuses specifically on cybercrime where a computer is the target (e.g., hacking, DDoS, distribution of malware). Using a comprehensive search strategy, this review used the following search terms: “cybercrime”, “computer crime”, “internet crime”, “cybercriminal”, “hacker”, “black hat”, “profiling”, “criminal profiling”, “psychological profiling”, “offender profiling”, “criminal investigative analysis”, “behavioral profiling”, “behavioral analysis”, “personality profiling”, “investigative psychology”, and “behavioral evidence analysis” in all combinations to identify the relevant literature in the ACM Digital Library, EBSCOhost databases, IEEE Xplore, ProQuest, Scopus, PsychInfo, and Google Scholar. After applying the inclusion/exclusion criteria, a total of 72 articles were included in the review. This article utilizes a systematic review of the current literature on cyber profiling as a foundation for the development of a comprehensive framework for applying profiling techniques to cybercrime—described as cyber behavioral analysis (CBA). Despite decades of research, our understanding of cybercriminals remains limited. A lack of dedicated researchers, the paucity of research regarding human behavior mediated by technology, and limited access to datasets have hindered progress. The aim of this article was to advance the knowledge base in cyber behavioral sciences, and in doing so, inform future empirical research relating to the traits and characteristics of cybercriminals along with the application of profiling techniques and methodologies to cybercrime.

Background: Over the course of the last decade, cybercrime has become a significant global concern. A comprehensive approach to crimes that occur in cyber contexts needs to address not only the technological aspects of cybercrime but also the human elements. Therefore, the aim of the current research is twofold: first, to gain an in-depth understanding of the pathways that lead to criminal hacking behavior through interviews with current or former criminal hackers, and second, to explore how the lived experiences of these individuals fit within theoretical explanations of hacking. Method: Semi-structured interviews were conducted with a sample of ten current and former criminal hackers. Participants for this study were recruited through social media and hacker forums. Interviews were conducted from November 2023 to March 2024. Data collected during the interviews were analyzed through a process of thematic analysis. Focusing on the lived experiences of these hackers, a “pathway of hacking” behavior, expanding upon those proposed in research emanating from Europe, was identified. Findings: Notably, the current study found that young males who are curious and creative in childhood, experience destabilizing events, and develop an early interest in technology are well placed to follow the pathway to criminal hacking behavior. Online gaming was identified as a possible gateway to criminal hacking activities. A sense of overcoming a challenge, being elite, and having “control over the machine” encourages youth to continue criminal hacking activities. In addition to the identification of a criminal hacking pathway, an integration of existing cyberpsychological, psychological, criminological, and sociological theories is presented to provide a theoretical explanation for the initiation, continuation, and desistence of criminal hacking behavior. This work represents the first effort to present an integration of theories (e.g., Social Learning, General Theory of Crime, Flow, and the cyberpsychological theoretical construct of the “Online Disinhibition Effect”) based on the stages of the criminal hacking pathway.