Overview

Group-IB Threat Intelligence & Attribution provides security teams with the latest information about the tactics, techniques and procedures being used by threat actors targeting their organization, industry, partners and customers. These insights are used to improve security posture, enabling teams to make data driven decisions.

Better strategic decisions are made by using the information to assess risk and decide where to allocate budget to achieve a strong, cost effective security. Improvements can be made to operational security practices with insight into attacker behaviours and infrastructure, for example teams can improve vulnerability management by prioritizing patching with intel about common exploits. Tactical decision making is improved with tailored data about more informed alert triage and incident analysis.

Intelligence is filtered for each customer, providing comprehensive visibility of their unique threat landscape. Group-IB works with stakeholder groups within the organization to establish priority intelligence requirements, which are continuously refined, to ensure that their threat intelligence is relevant and actionable.

To understand threat actor activities Group-IB uses a range of sources:
Human Intelligence – Undercover agents in underground forums on the dark web
Malware Intelligence – Advanced malware detonation platform & malware configuration files extraction, public sandboxes, honeypot networks, malware reverse engineering
Data intelligence – C&C-server analysis (botnet and phishing), C&C-servers of JS-sniffers, phishing data collection points and cardshops
Open source intelligence – Paste sites like Pastebin, code repositories like GitHub, messengers, social networks, vulnerabilities and exploits, and URL sharing services
Telemetry – ISP-level sensors, botnet data extractors, IP scanners and web crawlers, passive DNS and SSL collection
Investigations – Collaboration with law enforcement around the world including Interpol and Europol

Teams can consume intelligence in a number formats to suit their needs. Analyst written reports can be downloaded and shared with executives, the online portal allows teams to conduct research, and machine-to-machine intelligence sharing automates workflows.