What is threat intelligence?

In my previous post about how malware sandboxes work, I explained that they produce threat intelligence. But what is that, exactly? And how is it useful? Let’s find out.

From raw information to structured insights

Threat intelligence is essentially raw bits and pieces of information turned into structured, enriched, actionable insights: who are the attackers, what are their capabilities, what techniques do they use, what is their larger purpose, and how do they benefit from it?

It allows building a larger picture of the malware scene beyond individual sample analysis reports.

Think of the information a sandbox analysis can produce: a specific sample’s behavior, associated servers, associated indicators (IOCs), and other technical evidence. But in isolation, it can’t answer questions such as:

• who wrote this sample, and who is distributing it? (attribution)
  • are the programmer and the distributor the same person or group?
  • is it on sale somewhere? (source code or pre-built custom binaries)
  • is it mass market? (e.g. dark web)
  • or private market? (e.g. high-tech organizations selling to state actors)
• how is this sample distributed to potential victims? (campaign tracking)
  • on a technical level (hosting and distribution infrastructure),
  • as well as method of delivery (e.g. spam emails, social engineering, ads)
• who are the target victims of this distribution campaign?
  • is it mass-distribution? (send samples to everyone, hope someone bites)
  • or is it a targeted one? (targeting a specific, high-value victim)
• is it a one-off campaign, or is it a persistent attack?
• what broad capabilities do the threat actors have already? (e.g. do they have a network of infected devices they can use for compute or as attacking exit nodes?)
• what are the broad real-world implications? (is this malware disruptive to the masses? is it disruptive to a specific industry or company? does it have geopolitical functions?)

…and so on.

These insights are built fundamentally from observing malware in the wild and tracking it across time, and sandbox analysis reports are a major source. There are also other significant sources, but I won’t get into them in this post.

Broader purpose

Okay, so we track malware and we have a general view on what’s going on in the threat landscape. What for?

Threat intelligence can answer broader security questions and quantify risk. It informs you of the capabilities and activities of hackers - allowing you to make the right decisions to avoid getting hacked, or to assess and limit damage if it happens anyway. In plain words, it provides a reasonable, risk-informed stance on security.¹

Risk is a spectrum, so proper assessment requires a threat model - that is, defining what is valuable to the business, and what are the potential ways cyber criminals could get to it. To illustrate this, consider the examples below.

Prevention

Company A has a fleet of mostly Windows machines. The CISO receives an email from a colleague linking to an article alerting about a new malware campaign. The article explains that a known threat actor is sending malicious emails containing a link to a ClickFix² page, which then downloads and installs an info stealer³. The emails are being sent to employees whose email address is [email protected], with indications that the names are being scraped from LinkedIn profiles. Several companies have already reported receiving these emails.

The CISO then asks, “how risky is this for my company?”, and runs a basic risk assessment by considering all of these factors:

• the threat actor is known, and has historically targeted companies in the industry in general, not Company A in particular
• this campaign seems to follow that pattern, targeting any company with publicly discoverable employees on LinkedIn rather than Company A in particular
  • employees without public LinkedIn profiles report not receiving the malicious email, further indicating lack of targeting
• the campaign targets Windows machines, which Company A has
• the technique of distribution of the malware, ClickFix, is fairly standard and well known
• Company A’s security measures already defend against this attack:
  • corp email client is configured to block external links by default,
  • links point to a domain that is known to be malicious and thus already DNS sinkholed⁴ (blocked),
  • and the EDR already knows about the malware payload in this specific campaign, so it would block it anyway.

The CISO deems this to be a rather generic and uninteresting campaign, and notes that the company is already well prepared for this kind of attack, therefore asking the security team to only perform basic security hygiene. The team then double-checks to ensure that the relevant network endpoints are blocked (domains, IPs), and they also run a fleet-wide query to find out if anyone downloaded or executed any of the malicious hashes. The security response to this alert is quick and well defined.

For Company A, threat intelligence helped assess the situation and take appropriate, risk-measured actions for prevention - without severely underestimating the threat and without excessively panicking.

Incident response

Company B is developing software for Linux, and has a fleet of only Linux machines. In early December of 2021⁵, they find out that they’ve been compromised and that part of the company’s intellectual property has been stolen. As it turns out, a new critical, remotely exploitable vulnerability was found in log4j, a library that many Java apps use, and attackers used it to take control over some production servers. The security team rushes to find threat intelligence on the case: associated bad hashes, bad domains and IPs, and other IOCs, and the specifics of the attack. Then they run an incident response: first they block the malicious IOCs, then they identify all machines with the affected library, and inspect logs to find if any of the provided IOCs match - and if they do, they immediately reimage the machine.

Unfortunately for Company B, some IP was lost. However, threat intelligence helped manage risk by pinpointing the infected machines and giving the security team IOCs to block, allowing the team to handle the incident without risking further infections.

Detection

Company A is alerted about a new malware campaign. The alert contains a hash for a malicious sample. The CISO asks the security team to perform basic security hygiene checks again - that is, to find out if any machine has downloaded or executed the provided hash. This time, the security team comes back with results: two employees downloaded and executed this hash over a week ago - before the hash was known to be malicious. The security team then launches an investigation to find out the scope of damage. They find out that, despite execution, the malware failed to steal anything of value because it was looking for a type of credential that these machines didn’t have, and thus very little to no damage actually happened.

Unfortunately for Company A, malicious code was executed inside their internal network. However, threat intelligence helped by surfacing infections and scoping the specific potential damage.

---

The provided examples are hypothetical, but drawn from real experiences. As you can see, threat intelligence allows understanding and responding to each situation in an appropriate, measured way.

The agentic AI era

While nobody can predict what the future of cybersecurity will look like in a decade, we can look around and see what’s already happening: LLMs are increasingly capable and they already significantly speed up all of cybersecurity - both defenders and attackers. In my opinion, this will exacerbate the need for high-quality, low-latency threat intelligence: as humans are replaced with swarms of agents, the bar for defense will increase, and the time to respond to threats will collapse.

---

That’s it for this post. I intentionally left a lot of things unexplained to keep it simple; later posts will get into deeper details. Stay tuned!