Child Online Sexual Exploitation and Abuse: Understanding Adversarial Tactics, Techniques, and Procedures

Background: Child Sexual Exploitation and Abuse is a longstanding global issue, increasingly amplified by digital technologies, mobile devices, and internet access. This shift has intensified Child Online Sexual Exploitation and Abuse (COSEA). WeProtect 2020, a Global Alliance Intelligence brief report, indicated a 200% rise in online abuse forums. Existing studies focus on child protection, grooming, and survey-based analyses and draw inferences regarding grooming tactics and thematic analysis. Social issues such as underreporting, limited threat intelligence sharing, and low cyber awareness persist, leading to vulnerabilities and various exploitations. Further, a lack of social engagement and support persists, posing serious challenges for victims and law enforcement. Multiple studies have used the term Online Child Sexual Exploitation and Abuse (OCSEA) that focus on a technology-centric approach. However, the paper considers Child Online Sexual Exploitation and Abuse (COSEA) child-centric approach as we explore challenges of a child accessing the internet and engaging in online activities. Methods: This study analyses COSEA using the MITRE tactics, techniques, and procedures (TTP) framework to examine perpetrator behavior, motives, and potential attribution, considering the evolving threat landscape. Results: TTP-based analysis enables the identification of adversary intent, methods, and opportunities. The study contributions are threefold: (1) we explore COSEA and its manifestations; (2) we apply the MITRE TTP framework with subjective expert judgment to analyze perpetrator behavior and the victim; for instance, what leads victims to become complicit in wrong acts; and (3) propose mitigation strategies and stakeholder roles. Conclusion: By integrating technical, social, and behavioral perspectives, it highlights the roles of economic, societal, and deterrence factors and recommends policy, education, and collaborative threat-intelligence sharing to enhance child online safety.