6 Things to Know About Improving Threat Intelligence Collection

Guest blog courtesy of Flare.

In a Threat Intel Workshop hosted with Senior Threat Intelligence Researcher Tammy Harper from Flare, six key insights were revealed on improving threat intel collection practices. Below are the questions asked and answered.

1.   How does the disruption to Telegram affect threat actors?

After the arrest of the Telegram CEO in August 2024, the messaging platform that has been popular with threat actors has begun to collaborate with law enforcement in an effort to cut down on criminal activities on the app.

Over the last few years, threat actors have shifted their operations from traditional dark web forums so that Telegram serves as a complement or popular alternative. Now that Telegram is working with law enforcement, how does this change the cybercrime landscape?

Malicious actors are seeking out other platforms like Signal, Sessions, Matrix, Simplex, and more, but they do not have the same user experience as Telegram. For example, when comparing Telegram and Signal, Telegram is more community-forum oriented, making it easier for participants to find each other and supports social features, like stickers, that build community. From a malicious actor perspective, the file support capabilities make sharing and storing stolen information easier, too. Meanwhile, a look at Matrix shows that it has a higher potential for honeypotting which can deter threat actors.

There are some other questions on what this change will cause, such as: will Telegram truly increase cooperation with authorities? Will Telegram become a more moderated app? But for now it may be too early to have definite answers.

2.   The infrastructure and IoCs you collect, are they often this "noisy"? Often the IoCs collected by our team are clean with no reports found, making it more difficult to detect during the monitoring phase.

Security teams use IoCs in two different ways:

When security teams collect IoCs for incident response and forensics, they take a targeted, reactive approach asking questions about:

The IoC data is similarly streamlined, as it more likely focuses on evidence that the teams can observe in or collect from their systems like:

When collecting dark web threat intelligence for red teaming, security analysts are looking for clues to identify threats proactively. With a broader purpose, the valuable information is more varied and can include:

In the workshop example, we reviewed a specific log belonging to a threat actor. Since the purpose was proactive identification across a system, all of the information was relevant.

3.   How much time do you spend to dwell for each threat hunting?

Gathering threat intelligence during the threat hunting process should be focused around the core question: “So what?”

With the large amount of threat intelligence available from the dark web, security analysts need to take a structured approach to their gathering and analysis so that they can remain productive without falling into rabbit holes.

Actionable threat intelligence collection and analysis distills data into insights that enhance risk management by enabling security teams to implement proactive measures against potential attacks. For every investigation, the primary questions that security analysts should ask include:

Asking “so what?” might feel harsh, but it helps researchers stay focused on their main goal to ensure they find relevant information that furthers the investigation.

4.   How do you determine what, who, and where you will research? Is it in response to an investigation, incident, event or out of your own interest?

Security researchers generally build effective intelligence requirements that ask:

As they build out their requirements, they should consider these three essential components:

At Flare, we follow the same process, triggering investigations based on what customers need. To stay one step ahead of trends, we tailor our research to provide insights about meaningful dark web activities that help improve cybersecurity and strategic business outcomes, like:

5.   Do you track card leaks as well? How do you map the observed TTPs or IoCs like how do you differentiate between legitimate behavior?

The foundation of threat intelligence gathering and threat hunting are twofold:

Open Source Intelligence (OSINT) is publicly available information that can be categorized as:

Security researchers have access to clear web OSINT that includes known:

Dark web threat intelligence provides contextual insight into:

By combining these different data points, security researchers can build profiles around these IPs to determine which ones are likely associated with the observed activities.

6.   Do you track card leaks? How are new sources good/validated?

Flare has a built-in capability for tracking card leaks.

At Flare, we review the threat intelligence sources the way a security research team would, by reviewing investigational benefit and value. Some considerations include:

How Flare Can Help

Flare’s Threat Exposure Management (TEM) solution empowers organizations to proactively detect, prioritize, and mitigate the types of exposures commonly exploited by threat actors. The platform automatically scans the clear & dark web and prominent threat actor communities 24/7 to discover unknown events, prioritize risks, and deliver actionable intelligence you can use instantly to improve security.

Flare integrates into your security program in 30 minutes and often replaces several SaaS and open source tools. Learn more by signing up for the free trial.