Blog

<p><span class="citation-1247 citation-end-1247">Companies are attacked every day by increasingly sophisticated and targeted cyber threats, to the point where anticipating adversaries&#8217; moves is no longer a differentiator—it has become a requirement for corporate survival</span>.</p>
<p><span class="citation-1246 citation-end-1246">In this context, one of the most strategic disciplines in cybersecurity comes into play: Cyber Threat Intelligence (CTI)</span>. <span class="citation-1245 citation-end-1245">But what exactly is CTI? </span> How does it apply to your organization&#8217;s daily routine? And why is this topic so urgent today? <span class="citation-1244 citation-end-1244">In this article, I aim to answer these questions and show how to turn noise into data, data into information, information into intelligence, and how that intelligence can resonate into protection—before an attack happens</span>.</p>
<div class="source-inline-chip-container ng-star-inserted"></div>
<p><b>What is Cyber Threat Intelligence?</b></p>
<p><span class="citation-1243 citation-end-1243">Cyber Threat Intelligence is the structured process of collecting, analyzing, and disseminating information about digital threats, with the goal of supporting tactical, operational, and strategic decisions in cyber defense</span>.</p>
<p><span class="citation-1242 citation-end-1242">Contrary to what many believe, CTI is not limited to feeds of Indicators of Compromise (IoCs) like malicious IPs or domains</span>. <span class="citation-1241 citation-end-1241">It is about understanding the behavior, motivations, and capabilities of adversaries, creating a solid foundation for smarter, more proactive security decisions</span>. <span class="citation-1240 citation-end-1240">In this sense, the concept of &#8220;capability&#8221; is very important, as it translates to the adversary&#8217;s skills combined with their &#8220;firepower,&#8221; something that can change over time</span>. <span class="citation-1239 citation-end-1239">Thus, a key competency of CTI is to map and monitor the evolution of groups&#8217; capabilities to issue alerts about changes in their behavior and identify trends in their operations</span>.</p>
<p><span class="citation-1238 citation-end-1238">According to the <a href="https://www.mitre.org/">MITRE Corporation</a>, a non-profit organization that operates U.S. government-funded research and development centers, threat intelligence allows for an understanding of the TTPs (tactics, techniques, and procedures) used by malicious actors, which enables the construction of more effective defenses aligned with the real risks faced by the organization</span>.</p>
<ul>
<li><b><span class="citation-1237">Tactics</span></b><span class="citation-1237 citation-end-1237"> are an attacker&#8217;s strategic goals in each phase of the attack</span>. <span class="citation-1236 citation-end-1236">For example, breaching a network, which we document as &#8220;initial access,&#8221; or ensuring the attacker&#8217;s access remains active even if the victim turns the affected device off and on, which we call &#8220;achieving persistence&#8221;</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b><span class="citation-1235">Techniques</span></b><span class="citation-1235 citation-end-1235"> are the means used to achieve the objectives of a tactic</span>. <span class="citation-1234 citation-end-1234">For example, to achieve persistence, an intruder might use the Windows Task Scheduler feature to reactivate the malware every hour</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b><span class="citation-1233">Procedures</span></b><span class="citation-1233 citation-end-1233"> are the specific details of how a technique is executed by a group</span>. <span class="citation-1232 citation-end-1232">They include tools, commands, scripts, or infrastructure resources</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
</ul>
<p><b>The Four Levels of Intelligence</b></p>
<p><span class="citation-1231 citation-end-1231">The CTI discipline can be structured into four levels, each with a distinct target audience and purpose</span>:</p>
<ul>
<li><b><span class="citation-1230">Technical</span></b><span class="citation-1230 citation-end-1230">: Specific, granular data like malicious IPs, file hashes, and malware strings</span>. <span class="citation-1229 citation-end-1229">Useful for automation in tools like EDR and firewalls</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b><span class="citation-1228">Operational</span></b><span class="citation-1228 citation-end-1228">: Information about ongoing attacks, infrastructure used, and malware delivery methods</span>. <span class="citation-1227 citation-end-1227">It supports incident response and threat hunting activities</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b>Tactical</b>: Focuses on the TTPs of threat groups. <span class="citation-1226 citation-end-1226">It allows for mapping attacks according to frameworks like <a href="https://attack.mitre.org/">MITRE ATT&amp;CK</a> and adjusting defenses more strategically</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b><span class="citation-1225">Strategic</span></b><span class="citation-1225 citation-end-1225">: Macro-level risk analysis, such as geopolitical trends, nation-state-sponsored actors, and regulatory risks</span>. <span class="citation-1224 citation-end-1224">It directs security plans and investments</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
</ul>
<p><b>Why Does Your Company Need CTI Now?</b></p>
<p><span class="citation-1223 citation-end-1223">The reasons are many—and urgent</span>:</p>
<div class="source-inline-chip-container ng-star-inserted"></div>
<ol start="1">
<li><b>Customized Attacks are on the Rise</b> <span class="citation-1222 citation-end-1222">Groups like <a href="https://attack.mitre.org/groups/G0032/">Lazarus</a>, <a href="https://attack.mitre.org/groups/G0046/">FIN7</a>, and <a href="https://attack.mitre.org/groups/G0007/">APT28</a> are using increasingly targeted techniques, such as sophisticated social engineering approaches and malware families injected into companies or technology products present in the supply chain of various businesses</span>. <span class="citation-1221 citation-end-1221">Intelligence is essential to identify these patterns before they affect your environment</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b>Cybercrime Has Become a Service</b> <span class="citation-1220 citation-end-1220">With the Cybercrime-as-a-Service (CaaS) model, you can buy credentials, attack tools, and even technical support for ransomware on the dark web</span>. <span class="citation-1219 citation-end-1219">Without CTI, your company might not even realize it&#8217;s a target before the attack begins</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b>Adversaries Are More Organized Than Ever</b> <span class="citation-1218 citation-end-1218">While your security team juggles multiple tasks, attackers are focused, often with a division of labor, global infrastructure, and funding from state-sponsored groups</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b>Decisions Without Context Lead to Waste</b> <span class="citation-1217 citation-end-1217">Without intelligence, companies spend on tools and projects that are misaligned with real risks</span>. <span class="citation-1216 citation-end-1216">CTI allows you to prioritize defenses based on threats relevant to your industry, geography, and digital profile</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
</ol>
<p><b>CTI in Practice: How Does It Work?</b></p>
<ul>
<li><b><span class="citation-1215">Collection</span></b><span class="citation-1215 citation-end-1215">: Involves data from public sources (OSINT), closed channels (dark web, Telegram, etc.), partners, and internal sensors</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b><span class="citation-1214">Analysis</span></b><span class="citation-1214 citation-end-1214">: Uses internationally recognized methodologies like the <a href="https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf">Diamond Model</a>, <a href="https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf">Cyber Kill Chain</a>, and <a href="https://attack.mitre.org/docs/ATTACK_Design_and_Philosophy_March_2020.pdf">MITRE ATT&amp;CK</a> to transform data into actionable knowledge</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b><span class="citation-1213">Dissemination</span></b><span class="citation-1213 citation-end-1213">: Generates reports, alerts, dashboards, and data feeds that cater to different audiences (from the SOC to the executive board)</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b><span class="citation-1212">Feedback</span></b><span class="citation-1212 citation-end-1212">: Analysis is constantly adjusted based on new incidents and collected indicators, forming a continuous cycle of learning and adaptation</span>.
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
</ul>
<p><b>How Could CTI Prevent an Attack?</b></p>
<p><span class="citation-1211 citation-end-1211">Imagine the following scenario: an employee receives a seemingly legitimate email, with their manager&#8217;s correct name and title, asking them to update a spreadsheet</span>. <span class="citation-1210 citation-end-1210">Upon clicking, they execute malware that communicates with a remote server</span>. <span class="citation-1209 citation-end-1209">Days later, the company&#8217;s systems are encrypted with ransomware</span>.</p>
<p><span class="citation-1208 citation-end-1208">If the CTI team had been monitoring forums frequented by <a href="/from-the-dark-web-to-your-endpoint-how-leaked-data-fuels-new-threats">IABs</a>, it could have previously identified that the company&#8217;s credentials were for sale</span>. <span class="citation-1207 citation-end-1207">If it had been analyzing active campaigns, it could have correlated the infrastructure used in the attack with known threats</span>. <span class="citation-1206 citation-end-1206">If communication with the response team were mature, mitigation could have occurred before the ransomware was executed</span>.</p>
<div class="source-inline-chip-container ng-star-inserted"></div>
<p><b>Is CTI an Oracle?</b></p>
<p><span class="citation-1205 citation-end-1205">Cyber Threat Intelligence isn&#8217;t about predicting the future with a crystal ball, but rather about seeing the present through better, constantly polished lenses</span>. <span class="citation-1204 citation-end-1204">In an ecosystem where every click can open a breach, intelligence is what allows you to conduct your business more securely</span>. <span class="citation-1203 citation-end-1203">It empowers your company to identify risks before they become crises, aligns security decisions with external reality, and anticipates the adversary&#8217;s next move</span>.</p>
<p>Does your company already have a structured CTI program? <span class="citation-1202 citation-end-1202">If not, the best time to start is now</span>.</p>
<p><span class="citation-1201 citation-end-1201">Want to know how Resonant&#8217;s CTI can protect your business?  </span><span class="citation-1200 citation-end-1200">Talk to our team and receive a personalized analysis</span>.</p>
<div class="source-inline-chip-container ng-star-inserted"></div>


What is Cyber Threat Intelligence (CTI) and why your company needs it now

Illustration of Cyber Threat Intelligence showing a digital padlock and corporate defense against cyber threats.

Cyber Threat Intelligence: Proactive Cyber Defense

<p><span class="citation-930 citation-end-930">The last few decades have seen a significant increase in the operational complexity of cybercrime gangs. </span><span class="citation-929 citation-end-929">This has created something akin to an industry, where each group specializes in a specific part of the attacks: some only breach networks, others focus on malware development, and some deal exclusively in data trading, among other roles.</span></p>
<p><span class="citation-928 citation-end-928">Amidst so many modes of operation, forums on the deep and dark web have become true marketplaces for leaked data, where corporate credentials, personal information, and sensitive assets are traded like commodities. </span><span class="citation-927 citation-end-927">And what starts as a simple leak can quickly escalate into an attack on your infrastructure. </span></p>
<p>&nbsp;</p>
<p><b><span class="citation-926">From Theft to Sale: The Leaked Data Cycle</span></b></p>
<div class="source-inline-chip-container ng-star-inserted"></div>
<p>Every leak begins with an extraction. <span class="citation-925 citation-end-925">This can happen through phishing or other social engineering techniques, through malware like <a href="https://cidadaonarede.nic.br/pt/videos/o-que-e-infostealer">infostealers</a>, or even via insiders. </span><span class="citation-924 citation-end-924">Sensitive data is then extracted from organizations and published or sold on closed channels. </span><span class="citation-923 citation-end-923">Platforms like Telegram, forums like the now-defunct BreachForums, and clandestine marketplaces are the main stage for these negotiations.</span></p>
<p><span class="citation-922 citation-end-922">A central role in this cycle is played by Initial Access Brokers (IABs)—operators specialized in breaching companies and selling access to their networks. </span><span class="citation-921 citation-end-921">They have specialized in opening the door and leaving a crack available for the highest bidder, whether they are ransomware groups, <a href="https://en.wikipedia.org/wiki/Advanced_persistent_threat">APTs</a>, or other malicious operations.</span></p>
<p><span class="citation-920 citation-end-920">The connection between leaked data and targeted attacks is not hypothetical—it is an operational reality for cybercriminal groups, manifesting in various ways, such as: </span></p>
<ul>
<li><b><span class="citation-919">Credential-Based Ransomware</span></b><span class="citation-919 citation-end-919">: In campaigns like those from <a href="https://www.scworld.com/news/an-identity-defenders-worst-nightmare-initial-access-brokers-and-here-is-why">8Base</a> or <a href="https://www.bleepingcomputer.com/news/security/new-ransomhouse-group-sets-up-extortion-market-adds-first-victims/">RansomHouse</a>, many infections started with VPN or RDP credentials obtained from dark web forums. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b><span class="citation-918">Business Email Compromise (<a href="https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-frauds-and-scams/business-email-compromise">BEC</a>)</span></b><span class="citation-918 citation-end-918">: Corporate fraud attacks often start with complete email inbox databases, which reveal internal communications and transaction patterns. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><b><span class="citation-917">Social Engineering and Spear Phishing</span></b><span class="citation-917 citation-end-917">: HR information, organizational charts, and personal data allow for the creation of highly convincing messages, often using specific employee names and internal details to appear more credible. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
</ul>
<p><span class="citation-916 citation-end-916">Today&#8217;s leaks are not like those of previous years. </span><span class="citation-915 citation-end-915">Criminal groups are automating data exploitation, using generative AI to produce social engineering content at scale, and creating tools to structure and enrich stolen data, facilitating direct integration into attack tools. </span><span class="citation-914 citation-end-914">Furthermore, leaks are being used not only for financial gain but also as instruments of political influence and disinformation.</span></p>
<p>Protecting against the impact of leaked data requires more than just resetting passwords. <span class="citation-913 citation-end-913">It demands strategy, visibility, and readiness. </span><span class="citation-912 citation-end-912">Some recommended actions include: </span></p>
<div class="source-inline-chip-container ng-star-inserted"></div>
<ul>
<li><span class="citation-911 citation-end-911">Mapping and classifying the organization&#8217;s most sensitive data. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><span class="citation-910 citation-end-910">Adopting brand and leak monitoring solutions. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><span class="citation-909 citation-end-909">Having a clear leak response policy that covers not only technical mitigation but also communication with stakeholders. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><span class="citation-908 citation-end-908">Establishing partnerships with companies or consultancies specialized in Cyber Threat Intelligence (CTI) for continuous support. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
</ul>
<p><b><span class="citation-907">How Resonant Acts to Mitigate Risk</span></b></p>
<div class="source-inline-chip-container ng-star-inserted"></div>
<p><span class="citation-906 citation-end-906">Resonant&#8217;s Cyber Threat Intelligence (CTI) area plays a fundamental role in the early detection of leaks and in understanding their potential impact. </span><span class="citation-905 citation-end-905">With automated monitoring techniques and human analysis, our CTI can: </span></p>
<div class="source-inline-chip-container ng-star-inserted"></div>
<ul>
<li><span class="citation-904 citation-end-904">Identify relevant leaks in real-time, correlating data with company assets. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><span class="citation-903 citation-end-903">Associate leaks with known TTPs of active groups, anticipating attack vectors. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><span class="citation-902 citation-end-902">Disseminate actionable alerts to areas such as offensive security, SOC, and GRC. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
<li><span class="citation-901 citation-end-901">Integrate this information into the defense ecosystem, enriching SIEMs, EDRs, and response workflows with additional context. </span>
<div class="source-inline-chip-container ng-star-inserted"></div>
</li>
</ul>
<p><span class="citation-900 citation-end-900">This intelligence creates the conditions to react even before an attack materializes. </span><span class="citation-899 citation-end-899">The reality is clear: leaked data isn&#8217;t a distant problem—it&#8217;s the beginning of an increasingly common attack chain. </span><span class="citation-898 citation-end-898">Ignoring its existence is like walking blindfolded through a minefield.</span></p>
<p>Does your organization already monitor leaks in real-time? <span class="citation-897 citation-end-897">Does it correlate data dumps with your digital inventory? </span><span class="citation-896 citation-end-896">If the answer is &#8220;no,&#8221; it might be time to review your strategy.</span></p>
<p><span class="citation-895 citation-end-895">Talk to our team and discover how implementing an intelligence approach centered on leaked data can be the difference between a prevented incident and an irreversible loss.</span></p>


From the Dark Web to Your Endpoint: How Leaked Data Fuels New Threats

Understand how data leaked on the dark web becomes the gateway for cyber attacks and learn how Cyber Threat Intelligence can protect your company.

What is Cyber Threat Intelligence (CTI) and why your company needs it now

What is Cyber Threat Intelligence (CTI) and why your company needs it now

From the Dark Web to Your Endpoint: How Leaked Data Fuels New Threats

From the Dark Web to Your Endpoint: How Leaked Data Fuels New Threats

Latest posts

What is Cyber Threat Intelligence (CTI) and why your company needs it now

From the Dark Web to Your Endpoint: How Leaked Data Fuels New Threats