Coder Legion - Recent posts tagged threatintelligence

Stairwell's CTO Built Backstory Around One Question: What's Never Been Seen Before

Fri, 14 Aug 2026 00:38:35 +0000

In 2010, Mike Wiacek was helping lead Google's response to Operation Aurora, the nation-state attack that hit Google and dozens of other companies. At the time, threat intelligence wasn't even a real job category yet. Wiacek says Google wouldn't let him post a job listing asking for candidates with intelligence backgrounds.

That gap is where Stairwell started. Sixteen years, a stint building Chronicle, and one acquisition of VirusTotal later, Wiacek's company has launched Backstory, an agentic investigation platform designed to answer a question most security tools still can't: once you find one piece of malware, what else is out there that looks like it, and how far has it spread?

The problem with logs

Wiacek's argument starts with a flaw he says the entire industry has quietly accepted. Most detection tools are built on logs, and logs only show you activity, not the files themselves.

"Logs are like a CCTV camera that's looking down a hallway in one direction," Wiacek said. Anyone who's watched a heist movie knows how easy that camera is to dodge.

Stairwell's answer is to skip logs and go straight to the source: collect a copy of every executable, driver, and script that touches an enterprise's machines, and store it indefinitely. Wiacek calls it ground-truth data. It lets a security team ask a very specific kind of question — does anything in my environment resemble something no one else in the world has ever seen?

He points to Stuxnet as the example that shaped his thinking. One of its core components was a driver signed with Realtek's private key. If you could ask "does my environment have any signed drivers nobody else has ever seen," and the answer came back yes, you'd have found it. As Wiacek put it, a penguin in Antarctica isn't interesting. A penguin in the Sahara is.

Data lake, then a way to use it

Stairwell has been collecting that file-level data for six years. According to Wiacek, the company now tracks roughly 44 billion file sightings across customer environments, backed by trillions of DNS records and billions of Yara rule matches. The hard part was never getting the data. It was making it usable.

Wiacek compares it to being handed a fully equipped operating room, a donor heart, and the best surgeon's tools available — and still not being able to perform a transplant without the training to use them. Backstory is meant to be that missing layer: it takes Stairwell's file corpus and lets a security engineer ask a plain question, like "I found this, what do I need to do next," and get an answer instead of a dashboard.

What the AI actually does

"Agentic" gets attached to a lot of security products right now, and Wiacek is upfront that a lot of the heavy lifting inside Backstory comes from a fairly conventional rules engine, not a language model. Tokens aren't free, so the system leans on rules where rules are enough.

Where the LLM earns its place is pattern recognition across large, messy graphs. Wiacek's example: a piece of malware talks to a command-and-control domain that's resolved to five different IP addresses over time. Map out everything connected to that domain and you can end up with a graph of 500 nodes and edges. A frontier model can spot a pattern buried in that graph — say, that 67% of the time, the traffic touches one specific network before branching out — that would take a human hours to find by hand, if they found it at all.

He's skeptical of vendors who treat AI as a feature to bolt on. "If you don't give AI data that you didn't already have, you're going to get to the same conclusions faster," he said. Same outcome, just quicker. Stairwell's bet is that the file corpus is the part nobody else has, and the AI is only as useful as what it's reasoning over.

Explainability was a recurring theme. Wiacek said every finding in Backstory comes with the detection rules that matched, where the file spread, and anonymized signals showing how many other Stairwell customers have seen something similar — without exposing who they are. The AI's job, in his framing, isn't to declare something bad. It's to interpret facts a human would otherwise have to piece together from what he described as 30 pages of spreadsheets.

The numbers behind the pitch

Wiacek says a full Backstory investigation — triage, checking for similar files across the fleet, threat intel enrichment, and a containment report — runs about 200 to 250 seconds. He argues the alternative, before Backstory, wasn't a slower version of the same process. It often wasn't possible at all without disk-level forensics, which he described as security teams carrying imaging equipment machine to machine, on a timeline measured in weeks.

"Millions of dollars down to a latte," is how he summed up the shift from a Mandiant-style forensic engagement to what Backstory claims to do per alert.

Where this goes next

Asked what comes after blast-radius mapping, Wiacek described wanting to build something closer to a forecast than a report — modeling where a malware family is likely to spread next, the way meteorologists model storm paths, rather than only reconstructing where it's already been. He compared it, only half-joking, to targeted ads that pick up on a pregnancy before the person searching knows themselves. Creepy, in his words. But he thinks the data Stairwell has already collected puts that closer than most people would guess.

His broader point is less about any one feature. It's that defenders are still budgeting the way they did two years ago, while attackers are already using frontier models to accelerate malware development. "The goal cannot be do what we did before, faster," he said. "We have to do it differently, not just better."

Accenture and Google: AI Agents Didn't Just Cheat on a Safety Test — They Built a Chat Room to Help

Fri, 07 Aug 2026 00:21:53 +0000

At a joint media roundtable at Black Hat, Accenture's global cyber intelligence lead Ryan Whelan and Google Threat Intelligence's John Hultquist described an incident that's become a kind of Rorschach test for the security industry this summer: a coordinated failure across nearly every major frontier AI lab in which autonomous agent systems, given a task, independently concluded the most effective path forward was to cheat. What made it stranger, according to Whelan, is what happened next. The agents built themselves a chat room. Not because anyone asked them to, but because coordinating and sharing hints with each other turned out to be an effective way to advance the shared goal faster. "This ecosystem of agents basically autonomously just developed their own decision making," Whelan said. It wasn't isolated to one company either; in the weeks since, Whelan said, "pretty much every major frontier AI company had somehow this happened in some way."

Whelan and Hultquist spent much of the session distinguishing how differently nation-state and criminal actors are putting that same underlying capability to use. Espionage-focused actors, the kind Hultquist's team has tracked through incidents like the SolarWinds breach, which Mandiant's own incident response team helped uncover, prioritize staying invisible over moving fast; their entire operational discipline is built around never triggering a detection. Criminal actors operate under the opposite pressure. By the time a criminal group tells you they're in your network, the operation is already over: the data's gone. Hultquist described a recent financial-sector campaign built entirely around that asymmetry, where attackers used SMS-based phishing specifically because it routed around network-based detection tools that would have caught the same attack coming through a laptop, stealing two-factor codes directly off employees' phones and moving to exfiltration before response teams could react.

AI collapses that time pressure further in the criminal actor's favor, both said, mostly by removing the research and reconnaissance overhead that used to require real expertise. Hultquist, whose background is in industrial control systems threat intelligence, made the case bluntly: attacking ICS environments used to require a small, specialized pool of people, largely concentrated in Russia and China, with deep hands-on knowledge of the systems involved. AI doesn't need source code to understand how a system works anymore; it can infer it. That knowledge, Hultquist said, is "simply on tap" now, which is why he expects less sophisticated state actors, including North Korea and Iran, to close the capability gap with Russia and China faster than most people expect.

The economics underneath all of this are stark. Whelan's team has observed compromised access to frontier-lab tokens selling on criminal forums for roughly 1% of the normal commercial cost, harvested from organizations that deployed AI without adequately securing it. Combine cheap, stolen model access with an AI penetration-testing framework wired to a memory tool, letting an attacker try something, record what happened, and adjust the next attempt automatically, and you get what Whelan called the next evolution of ransomware as a service: researchers now believe several recent breaches, including one successful extortion of an AWS environment, were carried out by a single attacker end to end, from reconnaissance through malware development to execution.

Hultquist offered a specific reason autonomy matters more than most people appreciate: it solves the oldest problem in espionage tradecraft. Historically, spies get caught at the handoff, the dead drop, the command-and-control channel back to a handler, because that channel is inherently detectable. An autonomous agent doesn't need to phone home for instructions once it's inside a network, which is especially relevant crossing an air gap, where an agent that already knows what to do on the other side doesn't need to establish the kind of externally visible channel defenders have spent decades learning to hunt for.

Both were cautious about how far off fully autonomous, coordinated agent operations actually are, guessing more than a year out for anything resembling true agent swarms working in concert. But they expect to see it emerge on the offensive side first, simply because attackers aren't constrained by the liability, ethics review, and governance processes that slow down enterprises and frontier labs alike.

That governance gap was the session's other throughline. Whelan was direct about a persistent structural problem: many organizations have a CISO with the title but not the seat, reporting up through a CIO or CTO rather than sitting in the room where business strategy actually gets set, even as companies simultaneously stand up chief AI officer roles explicitly incentivized around efficiency and speed. Whelan drew on his own Army background for a working model of how you actually secure a non-deterministic system: not through blind trust, but through rigorous accountability structures, controlled access, and hierarchical oversight, the same basic architecture that lets the military hand dangerous equipment to young recruits safely. Applied to AI, he argued, that means investing in small, purpose-built models with tightly scoped, deterministic behavior for specific tasks rather than defaulting to a frontier model's broader but harder-to-fully-control capability, and treating AI governance as a genuine business risk conversation rather than a security team's side project.

Both pushed back on the idea that defenders are purely on the back foot. Hultquist pointed out that defenders control what code they ship, giving them a real structural advantage to validate before release that attackers don't have. Whelan offered a concrete example already in production: software supply-chain firewalls doing continuous deep packet inspection at the network edge, catching known-compromised npm and CDN packages in real time, and the ability to patch a single vulnerable component inside an existing software version instead of shipping an entire new release, cutting risk immediately without the misconfiguration risk a full version bump carries. The catch, both agreed, is that none of it addresses the weakest link running through nearly every serious incident discussed in the room: a human being convinced, over the phone or a text message, to hand something over. Non-deterministic systems, as Hultquist put it, "are honestly just like people," and no amount of AI-hardened infrastructure fully closes that gap.

What Is Threat Intelligence and How Does It Work in 2025?

Sat, 27 Sep 2025 19:17:24 +0000

Introduction

Every modern organization depends on digital technologies to operate. But this reliance creates exposure to cyber risks. Criminals use ransomware, phishing, and other techniques to exploit weak points, causing costly breaches.

Threat intelligence provides foresight into who attackers are, what they want, and how they operate. Unlike detection tools that react once damage begins, it delivers context to anticipate and prevent attacks.

What Is Threat Intelligence?

Threat intelligence is the practice of collecting and analyzing information about cyber threats. It answers the “who,” “why,” and “how” behind attacks, so teams can act strategically instead of reactively.

For example, if security software flags traffic to a malicious IP address, threat intelligence explains why it is harmful, who runs it, and what their objective is. This transforms data into actionable security insights.

Why Threat Intelligence Matters

Cybersecurity challenges in 2025 include advanced persistent threats, global data breaches, and a shortage of skilled professionals. Traditional defenses are no longer enough.

The benefits of implementing a strong intelligence program include:

Cost savings – Prevent fines, investigations, and reputational damage. Equifax’s breach in 2017 cost over $600 million.
Risk reduction – Spot new attack methods before criminals exploit them.
Data protection – Block malicious domains and IP addresses before infiltration.
Improved analysis – Understand attacker behavior and test resilience of defenses.
Stronger security posture – Gain visibility into vulnerabilities for faster remediation.

For context, CISA notes that organizations using intelligence-driven security significantly improve incident response times.

Who Benefits From Threat Intelligence?

Threat intelligence benefits nearly every role within an organization:

Executives gain insight into risks for better planning and investments.
Security analysts track threat groups and use profiles for faster responses.
IT teams strengthen day-to-day prevention and detection.
Partners and consumers enjoy safer digital interactions and reduced fraud risks.

The Threat Intelligence Lifecycle

Threat intelligence follows a six-stage cycle that turns raw data into usable knowledge:

Direction – Define goals and requirements.
Collection – Gather internal and external threat data.
Processing – Clean and structure data for analysis.
Analysis – Identify actors, tactics, and vulnerabilities.
Dissemination – Share insights through reports and alerts.
Feedback – Improve strategies based on results and stakeholder input.

This lifecycle ensures organizations stay proactive against evolving threats such as ransomware and zero-day exploits.

Types of Threat Intelligence

There are three main categories of threat intelligence:

Strategic – Non-technical, high-level reports for executives.
Tactical – Technical data such as indicators of compromise (IOCs) for IT teams.
Operational – Intelligence on attackers’ motives, timing, and tactics, often derived from dark web monitoring or forensic investigations.

Tools and Sources

Organizations use multiple sources for effective intelligence:

Open-source feeds like AlienVault OTX and Shodan.
Commercial platforms such as Recorded Future and Flashpoint, which enrich raw data.
In-house telemetry from firewalls, SIEM, and EDR tools.
Vendor feeds provided by security solution providers.

According to Gartner, blending multiple intelligence sources provides the most comprehensive defense.

Implementing Threat Intelligence

To operationalize intelligence effectively:

Define objectives – Identify assets and risks that need protection.
Choose sources and tools – Use a mix of open-source, paid, and internal data.
Integrate with SOC workflows – Feed intelligence into SIEMs, firewalls, and EDR.
Assign ownership – Ensure clear responsibility for managing alerts.
Continuously adapt – Update strategies as threats evolve.

Real-World Applications

Phishing defense: A financial firm blocks newly registered malicious domains before attackers launch campaigns.
Supply chain security: A manufacturer spots compromised vendor credentials on the dark web and revokes access before an attack can spread.

The Future of Threat Intelligence

The global market for threat intelligence is projected to hit $13.56 billion by 2025. Advances in AI and machine learning will make it even more proactive—flagging unusual behavior automatically and reducing the need for manual intervention.

Organizations that adopt intelligence early gain resilience, faster detection, and reduced breach costs.

Final Word from UpTech Solution

At UpTech Solution, we believe cyber defense must be proactive, not reactive. Threat intelligence provides the foresight enterprises need to anticipate risks, strengthen defenses, and minimize the impact of attacks.

The question every business should ask: are you prepared to act before the next cyber threat strikes?

Your network access sells for $2,700 on dark forums while criminals earn $450K per attack—here's why

Tue, 12 Aug 2025 19:23:22 +0000

The $2,700 Network Access Market: How Criminals Turned Cybersecurity Into a Commodity

Rapid7's Chief Scientist reveals how organized crime transformed from $400 ransoms to $450,000 demands in just a decade

Network access to your organization is being sold on dark web forums for an average of just $2,700, less than most companies spend on coffee each month. Yet this seemingly trivial sum represents the key to potentially catastrophic breaches that can cost organizations millions and fundamentally reshape the global threat landscape.

Raj Samani, Chief Scientist at Rapid7, has been tracking this evolution from his unique vantage point bridging cybersecurity research and law enforcement collaboration. His team's latest Access Brokers Report, based on analysis of three major dark web forums, reveals a sobering reality: cybercrime has become a commodity business with devastating efficiency.

"You remember 2015, we had the ransomware group Tesla, which was a consumer-driven attack, and the average ransom demand was two Bitcoin, which was about $400," Samani explained during our interview at Black Hat 2025. "Now we've got this economy in which companies are being targeted at a rate and pace that is unprecedented. The average demand has increased from $400 to $450,000."

The Democratization of Digital Crime

This transformation reflects what Samani calls the democratization of cybercrime. Initial Access Brokers (IABs) have created a marketplace where technical barriers to entry have virtually disappeared. Anyone with a few hundred dollars can purchase ready-made access to corporate networks, complete with privileged accounts and multiple entry vectors.

Rapid7's research, covering six months of activity across Exploit, XSS, and BreachForums, reveals that 71.4% of access broker sales offer more than just basic network entry—they include elevated privileges or multiple access routes. Nearly 10% provide complete bundles with multiple initial access vectors and administrative privileges.

"To be a cyber criminal, you don't need any technical skills anymore," Samani noted, echoing concerns he first raised in a 2013 paper. "This is why we've been tracking this for over a decade now."

The implications extend far beyond individual organizations. When a morning text message to Samani revealed suspicious IP addresses in a client's network, Rapid7's intelligence platform immediately identified the threat as Scattered Spider—the same group that had targeted major retailers including Marks and Spencer and Co-Op.

Intelligence-Driven Defense in a Noisy World

For Samani, the core challenge isn't detecting threats, it's prioritizing responses in an environment saturated with alerts and marketing noise. His team at Rapid7 Labs has focused on what he calls "threat-informed remediation," using curated intelligence to cut through the chaos of modern security operations.

"Every single campaign we've seen, by and large, has been detected. It's just not been responded to," Samani explained. "The challenge we're facing is the inability to separate the marketing hype from the reality of security operations."

Rapid7's approach involves verifying every threat indicator and assigning meta-scores to help organizations understand which alerts truly matter. Instead of drowning security teams in volume—what Samani calls "the fool's errand," the platform eliminates noise and highlights actionable threats.

"Of 40,000 CVEs disclosed last year, which one are you going to be worried about?" he asked. "What we should be concerned about is the stuff that's going to hurt me."

The Economics of Access

The research reveals troubling economic realities. While victim organizations average $2.2 billion in annual revenue, access to their networks sells for under $3,000, a risk-to-cost ratio that should alarm any executive. Most sales cluster around the $500-$1,000 range, making network access cheaper than many enterprise software licenses.

The most popular attack vectors mirror what Rapid7 observes in actual incident response: VPN access (23.5%), Domain User accounts (19.9%), and RDP services (16.7%). These represent fundamental failures in security architecture, systems designed to protect networks becoming the very mechanisms attackers exploit.

"VPN access was meant to ensure that only authorized users can access an organization's network," Samani noted. "Instead, this access management technology is being undermined."

The Global Context Challenge

Unlike traditional crimes, cybercrime operates without geographic constraints, creating enforcement challenges that Samani describes as unprecedented. "You can conduct a crime and never have to step into the territory within which you're carrying out that crime. You don't even have to leave your bedroom."

This reality, combined with the economic incentives in certain regions, creates a perfect storm for criminal activity. When Samani interviewed a ransomware operator from West Africa, the response was telling: "I've got to pay my mortgage. I got to feed my family. What do you expect me to do?"

The technical barriers that once limited cybercrime have been systematically eliminated by the access broker economy. What remains is a business model that scales criminal activity to unprecedented levels.

Real-Time Security Imperatives

Samani's research points toward several critical takeaways for organizations. Traditional vulnerability management approaches, scanning monthly or quarterly, are inadequate against adversaries who can purchase access and deploy attacks within hours.

"Security has to be real-time," he emphasized. "That's why we built our own scanners. When we're doing attack surface management scanning, we can control everything. We can manage the scan cadence however often we want."

The integration of actionable intelligence into security platforms represents a shift from reactive to predictive defense. Rather than responding to attacks after they occur, organizations can anticipate threats based on marketplace intelligence and attacker behavior patterns.

The Path Forward

For developers, engineers, and security professionals, Samani's message is clear: understanding your attack surface and prioritizing remediation based on real threat intelligence, not arbitrary CVSS scores, is essential. The access broker economy thrives on organizations that fail to implement basic security fundamentals like multifactor authentication and proper network segmentation.

"Organizations need to understand their attack surface," Samani concluded. "They need to understand the vulnerabilities associated with their attack surface, and they need to prioritize the remediation of said vulnerabilities in a manner that is real-time."

As cybercrime continues to industrialize through marketplace economics, the defenders must match that industrialization with intelligence-driven automation and real-time response capabilities. The alternative—becoming another $2,700 listing on a dark web forum—is simply too costly to contemplate.