Towards Group-level Cybercriminal Profiling: Cultural Dimensions and Participation Roles in Dark Web Communities

We propose an automated text-analysis approach that combines cultural-dimension inference (Hofstede and Meyer dimensions) with participation-role classification (Reader-to-Leader framework) to characterize potentially cybercriminal communication beyond technical indicators. Using 17,196 messages from the DREAD dark web forum, we estimate role labels (Contributor, Collaborator, Leader) and multi-label cultural signals with supervised language models, enabling analysis of how cultural dimensions vary across roles and co-occur within messages. Results show that cultural dimensions are unevenly distributed across participation roles, forming role-conditioned communication patterns. Applications-First and Egalitarian dimensions exhibit the highest cross-role variance and most clearly separate participation strata, while Leader messages are distinctly associated with Long-Term Orientation (LTO), low Power Distance (PDI), and Restraint. We also observe both high and low PDI as distinctive within the leader role, suggesting greater variability in how power distance is expressed. In terms of overall prevalence, however, LTO, low PDI, and Restraint emerge as some of the most common dimensions in leader messages. Recurring co-occurrence and conditional patterns further indicate structured cultural configurations within forum discourse. These patterns can support grouplevel profiling, role inference, and identification of leadership and coordination structures, while culture is treated as a contextual rather than deterministic analytical layer.