Overview#
A financial institution's threat intelligence team receives an indicator from an ISAC partner: a specific domain linked to a banking trojan campaign. Within Argus, the domain resolves to an autonomous system associated with a known bullet-proof hosting provider. Passive DNS shows that the same IP hosted six other domains in the previous 90 days, three of which appeared in MWDB samples attributed to the same threat actor. Blockchain tracing from a previous ransomware case links a wallet address in the threat actor's infrastructure to mixing services known to process proceeds from compromised business accounts. What started as a single domain indicator becomes a multi-layer threat actor profile connecting technical infrastructure to financial tradecraft to previous criminal operations.
Cyber Threat Intelligence and Digital Crime Analysis provides a platform for monitoring, analysing, and acting on cyber threats across the global digital ecosystem. By aggregating data from dark web sources, cryptocurrency blockchains, malware repositories, and threat intelligence feeds, the platform enables teams to build profiles of threat actors, track indicators of compromise, and attribute attacks to specific criminal groups or nation-state actors. It integrates financial crime analysis, dark web monitoring, and behavioural profiling to provide complete visibility into threat actor operations.
Open Standards#
- OASIS STIX 2.1 / TAXII 2.1: Indicators of compromise, threat actor profiles, and intelligence bundles are ingested, stored, and exported as STIX 2.1 Structured Threat Information Expression objects; automated feed polling uses the TAXII 2.1 transport protocol.
- MITRE ATT&CK: Threat actor TTPs are mapped directly to the ATT&CK framework taxonomy, enabling technique-level attribution, tactic searches, and structured intelligence products aligned with the enterprise knowledge base.
- OASIS CACAO v2.0: Response playbooks are imported, validated, and exported using the Collaborative Automated Course of Action Operations v2.0 schema, with execution co-ordinated via OpenC2 commands.
- OpenC2: Playbook step execution is dispatched through the OASIS OpenC2 command language, providing a vendor-neutral interface for triggering automated defensive actions from intelligence findings.
- Sigma: Detection rules derived from threat intelligence are stored and translated using the Sigma open detection format, enabling distribution of indicators as SIEM-ready queries across multiple backend targets.
- YARA: Malware-derived pattern rules are persisted and matched via the YARA rule language, connecting threat actor infrastructure intelligence to binary and memory-based detection artefacts.
- CVE / CVSS: Vulnerability indicators are identified by CVE identifiers and scored using the Common Vulnerability Scoring System, linking technical exploitation intelligence to advisory and patch management workflows.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14
Key Features#
Threat Actor Profiling#
Build comprehensive profiles of cybercriminal organisations, ransomware groups, and nation-state threat actors. Track evolving tactics, techniques, and procedures across campaigns and attribute new activity to known groups using MITRE ATT&CK mapping and behavioural analysis.
Indicator Correlation#
Advanced correlation engines connect disparate indicators, linking malware samples to infrastructure, infrastructure to cryptocurrency wallets, and wallets to real-world identities. The holistic analysis reveals the complete operational picture of threat actor campaigns rather than individual disconnected data points.
Dark Web Intelligence#
Monitor dark web sources for emerging threats, stolen data offerings, exploit sales, and criminal services. Track marketplace evolution, vendor migration, and emerging criminal business models that will generate operational threat intelligence before attacks materialize.
Financial Crime Integration#
Trace cryptocurrency flows associated with cybercrime, correlate financial patterns with technical indicators, and identify money laundering networks supporting cybercriminal operations. Blockchain forensics and cyber investigation inform each other throughout the analysis.
Automated Threat Hunting#
Machine learning algorithms identify behavioural patterns signaling emerging threat campaigns before they reach maturity. Continuous hunting for new indicators related to active investigations reduces dwell time and accelerates response.
Strategic and Tactical Intelligence#
Support both long-term tracking of advanced persistent threat groups and immediate response to zero-day exploits. Produce intelligence products ranging from executive threat briefings to technical indicator reports, covering the full intelligence cycle from collection through dissemination.
Case Management Integration#
Intelligence flows into investigative workflows, enabling rapid response to emerging threats. Evidence packaging ensures intelligence products support prosecution and regulatory action. Connects with TheHive for incident response coordination and MISP for community sharing.
Use Cases#
- Ransomware Disruption: Track ransomware groups from initial access vectors through payment infrastructure, enabling coordinated disruption of operations and financial networks.
- Business Email Compromise: Investigate sophisticated BEC rings through email infrastructure analysis, financial flow tracing, and criminal network mapping.
- Critical Infrastructure Protection: Monitor nation-state activity targeting critical infrastructure sectors, providing early warning and defensive intelligence to operators and government partners.
- Financial Sector Threat Intelligence: Real-time alerts when monitored systems interact with known malicious infrastructure, supporting proactive threat detection and customer protection.
Integration#
Connects with SIEM systems, incident response platforms, financial intelligence tools, and law enforcement case management. Supports STIX/TAXII intelligence sharing standards. Integrates with MISP and MISP Modules for indicator distribution, CAPE Sandbox and MWDB for malware intelligence, Sigma rules and YARA for detection engineering, and CyberChef for data transformation across analysis workflows.