Unlocking Insights: The Role of TI in Modern DFIR Operations

Unlocking Insights: The Role of TI in Modern DFIR Operations

Speakers: Efstratios Lontzetidis (Senior Threat Intelligence Consultant, NVISO), Stef Collart (Principal Threat Hunting and Threat Intelligence Consultant, NVISO)

Conference: FIRST CTI Conference

YouTube: https://www.youtube.com/watch?v=t-UNY-j8FbQ

Overview

This talk, "Unlocking Insights: The Role of TI in Modern DFIR Operations," delivered by Stef Collart and Efstratios Lontzetidis of NVISO, addresses a critical challenge in cybersecurity: effectively integrating Threat Intelligence (TI) into ongoing Digital Forensics and Incident Response (DFIR) operations. While TI is often discussed in the context of proactive defense and prevention, this presentation shifts focus to its reactive application – how TI can be leveraged after an incident has occurred to enhance investigation, accelerate resolution, and provide deeper insights for both the response team and the affected customer. The speakers demonstrate that even with limited budgets and resources, significant value can be derived from TI, primarily through the use of free or easily accessible tools and methodologies.

The core premise of the talk revolves around overcoming common hurdles faced by DFIR teams, such as time constraints, context switching, and the difficulty in attributing attacks or understanding their broader scope. By showcasing practical use cases with real-world examples, Collart and Lontzetidis illustrate how a dedicated TI function can complement traditional DFIR activities, leading to a more comprehensive understanding of the threat, identifying additional compromised assets, and ultimately delivering a more valuable outcome to the customer. Their approach emphasizes collaboration between TI and DFIR teams, aiming to prove TI's tangible worth without significantly increasing the incident's overall cost or timeline.

Background

▶ Watch: Challenges integrating TI into incident response (3:00)

The integration of Threat Intelligence into incident response workflows often faces significant practical hurdles. As Stef Collart highlights, DFIR teams typically operate under severe time constraints, with customers often allocating a fixed, limited number of hours (e.g., 60 hours) for an entire incident. Within this timeframe, responders must manage case intake, extensive log analysis, disk and memory forensics, and exhaustive report writing—each a time-consuming task requiring specialized expertise. The demand for responders to perform a wide array of tasks inevitably leads to context switching, where analysts bounce between different tools and data sources (e.g., from log analysis to VirusTotal). This constant switching introduces cognitive load, slows down the investigation, can lead to overlooked details, and ultimately consumes more of the precious allocated hours.

From the Threat Intelligence team's perspective, challenges also exist. TI professionals are often engaged in proactive work streams such as creating threat landscapes, profiling threat actors, and running monitoring services for breached accounts or data leaks. The unpredictable nature of incidents—ranging from zero to ten per week—makes it difficult for TI teams to consistently drop their planned projects to immediately assist every incident. This means TI resources cannot always be fully dedicated to researching every minute detail of an ongoing incident. The ultimate goal for the TI team is to prove tangible value to both the incident response team and the customer. Customers are often reluctant to pay for "extra" TI hours, making it incumbent upon the TI team to demonstrate that their contributions directly accelerate the investigation, broaden its scope, and provide insights that traditional DFIR alone might miss, all while minimizing the time commitment from the overall incident budget.

Without Threat Intelligence, an incident response often concludes with a report detailing what happened, what was impacted, and how to recover. While satisfactory, this approach can leave critical questions unanswered: Was the incident part of a larger campaign? Was it a targeted attack? Which specific threat actor was responsible? What malware family was involved, and what are its full capabilities (e.g., infostealer component, data exfiltration)? Does the threat actor possess additional malicious infrastructure beyond the initial Command and Control (C2) domains or IPs identified? Answering these questions through TI enriches the incident report, allows for proactive hunting for related indicators across the customer's environment and other clients, and provides the customer with a much deeper understanding of the threat they faced, enabling more informed strategic defenses.

To address these challenges, NVISO has experimented with different collaboration models. Initially, they relied on Requests for Information (RFIs), where the DFIR team or customer would explicitly ask the TI team for specific data (e.g., "search for leaked credentials for this user," or "provide a threat actor profile for Violet Typhoon"). While effective for targeted queries, this reactive model placed the initiative solely on the DFIR team. A more prolific method, which they now combine with RFIs, is the Evidence Follow-up approach. Here, the DFIR team conducts its investigation independently, then shares key evidence and timelines with the TI team. The TI team, in turn, actively correlates these findings with external intelligence, proactively seeking relevant connections. This method allows the TI team to take a more active role, unlocking deeper insights by not waiting to be triggered but rather continuously looking for opportunities to add value, as demonstrated through the practical success stories.

Key Findings

▶ Watch: Prolific "Evidence Follow-up" collaboration method (10:30)

The talk highlights several crucial findings regarding the effective integration of Threat Intelligence into DFIR operations:

1. TI Provides Actionable Insights Without Extensive Resources: The most significant finding is that TI can deliver substantial, actionable insights to both incident response teams and customers, even when operating with limited budgets and using predominantly free or easily accessible tools. The presented use cases explicitly demonstrated how techniques like Google dorking, leveraging public malware repositories (e.g., Malware Bazaar), sandbox analysis platforms (e.g., Hatching Triage), passive DNS tools (e.g., Validin), and URL scanning services (e.g., URLScan) can uncover critical information that significantly enhances an investigation.
2. The "Evidence Follow-up" Method Enhances Collaboration and Value: NVISO's experience shows that while traditional RFI models are useful for specific queries, the Evidence Follow-up method is far more prolific in uncovering deeper insights. By empowering the TI team to proactively correlate DFIR findings with external intelligence, rather than waiting for specific requests, the TI team can play a more active role, broaden the scope of the investigation, and identify previously unknown aspects of an attack. This active correlation minimizes context switching for DFIR analysts and ensures TI is integrated consistently.
3. TI Broadens Incident Scope and Accelerates Discovery: Through the practical examples, it was repeatedly shown that TI helps incident responders broaden the scope of their investigation. This includes identifying additional compromised servers, uncovering previously unknown malicious infrastructure, attributing incidents to specific threat actors or malware families, and even discovering new initial access vectors. This broadening of scope not only provides a more complete picture of the incident but also accelerates the discovery of related artifacts, leading to a net positive effect on the overall investigation timeline despite the TI team's involvement.
4. Attribution and Campaign Identification Are Achievable: The talk demonstrated that with careful pivoting on indicators, it is possible to attribute an incident to a known malware family (e.g., Antidot, GoTo Rat) or even a specific threat actor (e.g., Gallium APT, Winnti APT). Furthermore, TI can reveal if an incident is part of a larger, ongoing campaign, identifying other impersonated brands or targeting methodologies, which is invaluable for both the affected customer and for cross-customer defensive efforts.
5. Community Sharing is Essential: Many of the "success stories" relied heavily on intelligence previously shared by other researchers, vendors (e.g., Palo Alto, Kaspersky, Prodaft), or uploaded samples to public platforms. This underscores the critical finding that the collective knowledge and shared research within the cybersecurity community form the bedrock upon which effective reactive threat intelligence operations are built. Without this communal contribution, many of the insights presented would not have been possible.

Technical Deep Dive

▶ Watch: Gallium APT: Simple Google dork for attribution (19:20)

The core of the talk's technical deep dive is presented through three distinct use cases, each demonstrating how free or low-cost TI tools and methodologies can significantly enhance a DFIR investigation.

Use Case 1: Antidot Android Trojan

The first case involved a malicious Android Application Package (APK) impersonating the Belgian ISP Proximus, distributed via WhatsApp and unofficial sites to perform fraudulent transfers and access mobile banking. The DFIR team had already analyzed the APK, extracted a C2 domain (sunnydoscloudnet.xyz), and identified WebSocket communication.

The TI team's approach, using the Evidence Follow-up method, began with simple yet effective pivoting:

1. Initial C2 Lookup: A search for sunnydoscloudnet.xyz on reputation services like VirusTotal initially yielded no useful information.
2. Google Dorking for Context: Recognizing the distribution method and lure, the TI team performed a simple Google search for "Proximus APK malware." This immediately returned relevant results, including warnings on SafeOnWeb, malware detonation reports on Hybrid Analysis, and a sample on Malware Bazaar.
3. Pivoting on Malware Bazaar: The Malware Bazaar sample led to a Hatching Triage sandbox analysis report from Recorded Future. Although the hash didn't match the customer's sample, the report classified the malware as Sandiot. Crucially, the reporter's comment mentioned a payload download domain: proximus.cloud.com.
4. Verifying C2 and Attribution: By examining the full Hatching Triage report, the TI team found that the reported sample also communicated with sunnydoscloudnet.xyz via WebSockets, confirming the connection to the customer's incident. This allowed confident attribution of the customer's sample to the Antidot malware family (often interchangeably referred to as Sandiot).
5. Malware Family Deep Dive: A search for "Antidot malware" quickly led to a comprehensive report by Prodaft. This report detailed Antidot's capabilities as a Malware-as-a-Service (MaaS), sold on underground forums, featuring its own packer, loader, and botnet infrastructure, along with capabilities like SMS interception and script recording. This information greatly assisted the DFIR team in confirming their own malware analysis findings.
6. Infrastructure Expansion with URLScan: Focusing on the infrastructure vertex of the Diamond Model, the TI team used URLScan to investigate proximus.justcloud.com (from the Malware Bazaar comment). URLScan revealed a simple UI with a Proximus logo, Dutch text ("commercial" and "consumer"), and a download button with an emoji. This unique string pattern was then used to craft a more specific URLScan query: page.body:"download" AND page.body:"emoji".
7. Campaign Discovery: This advanced URLScan query revealed a broader campaign:

• Timeline: Activity dating back to at least September 2025 (note: transcript states 2025, likely a typo for an earlier year or future projection).
• Additional Impersonations: More Proximus impersonating domains (e.g., proximus.simcard.com, proximus.verificatie.com) and impersonations of other ISPs like Orange, Vodafone, and Telenet.

These findings provided the customer with a comprehensive understanding of the threat's scope and the actors' operational scale.

Use Case 2: Gallium APT Intrusion

This case involved a likely Gallium APT intrusion, a Chinese nation-state actor known for stealthy tactics targeting various sectors. The incident included zero-day exploitation of an internet-facing device, lateral movement, and payload execution. The DFIR team identified multiple web shells (including reGeorg), privilege escalation tools (e.g., Got Potato from the potato suite), and network scanners (e.g., Netscan). A suspicious file path, wmipd.dll in system32, was found, associated with a Windows service named "WMI provider" that executed the DLL. Malware analysis revealed a configuration looking for inbound connections matching specific patterns.

The TI team's contribution was remarkably simple yet powerful:

1. Google Dorking for Specific Artifacts: A literal Google search for the unique file path wmipd.dll (enclosed in quotes) was performed.
2. Report Match: The top result was a detailed report from Palo Alto Networks published a few years prior, discussing a likely Gelsemium APT intrusion (the speakers clarify this as likely Gallium APT, a known alias or related actor).
3. Corroboration: A quick scan of the Palo Alto report revealed significant similarities: multiple web shells (including reGeorg), network scanners, and potato-suite privilege escalation tools. A deeper dive into the report confirmed even more matches, including details about the Owl proxy backdoor and its exact same configuration patterns as those extracted during the customer's malware analysis.
4. Broadening Scope: This direct match allowed the IR team to immediately broaden their scope beyond the initially alerted server. By hunting for these specific artifacts and TTPs across all front-end servers, they quickly discovered web shells on multiple additional machines, demonstrating a net positive impact on the investigation's speed and thoroughness.

Use Case 3: Winnti APT (GoTo Rat)

The final case involved an unauthorized transaction from an AWS workspace in China, with TI alerting to malware presence. The IR team provided key indicators: a malware hash, a C2 domain, and a crypto wallet address.

The TI team employed a multi-faceted approach:

1. VirusTotal and Report Pivoting: Analyzing the malware hash on VirusTotal quickly showed an association with a Kaspersky Securelist report about a GoTo Rat infection targeting financial organizations.
2. Campaign Details: The Kaspersky report detailed a campaign using malicious screensavers and program information files (PIFs) disguised as financial documents, distributed via Skype. It also hinted at potential attribution to Winnti APT (a Chinese state-sponsored group) due to code and distribution similarities with another GoTo Rat payload, Awesome Puppet. This report was immediately shared with the DFIR team.
3. Infrastructure Analysis with Validin: To analyze the C2 domain, the TI team used Validin, a passive DNS tool. They performed a resolution step to find recent IP addresses associated with the C2. Pivoting on these IPs, they discovered other domains resolving to them, including fxud.com (likely related to "foreign exchange," common in financial trading) and a typo-squatting domain mimicking the customer's brand. This aligned with known Winnti TTPs of registering C2 domains that mimic target sites. These indicators were shared with DFIR for C2 communication checks.
4. Content Analysis with URLScan: URLScan was used to inspect the content hosted on these domains. A hit confirmed Kaspersky's report: a PDF document disguised as a PIF, branded with the customer's logo, and containing fxuot.com in its HTML, confirming its relevance to the campaign.
5. Further Initial Access Vector Discovery: A Google dork for the identified malicious domains led to a cached Google search result (now deleted) of a LinkedIn post from the customer promoting a job role. Threat actors had inserted comments with their malicious domains into this post, suggesting another initial access vector used to target the customer.
6. Crypto Wallet Analysis with TronScan: The involved crypto wallet was identified as a Tron wallet, a popular choice for money launderers in Asia. TronScan was used to trace transactions. The initial wallet received a high volume of funds, which were then diverted through multiple intermediary wallets to other operational wallets. The final exit nodes were high-risk services and smart contracts prevalent in the Asian cybercrime ecosystem, such as gas-free transfer solutions and decentralized gambling platforms. This detailed financial trail provided crucial insights into the illicit proceeds laundering.

These three use cases powerfully illustrate how a combination of open-source intelligence, specialized tools, and strategic pivoting can uncover a wealth of information, turning a basic incident report into a comprehensive analysis of the threat, its actors, and its full scope.

Demo / Proof of Concept

▶ Watch: Winnti APT: Analyzing crypto wallet transactions (26:00)

While the presentation did not feature a live, interactive "demo" in the traditional sense, the entire "Technical Deep Dive" section serves as a proof of concept for the NVISO team's methodology. Each of the three detailed use cases—the Antidot Android Trojan, the Gallium APT intrusion, and the Winnti APT (GoTo Rat) campaign—functions as a practical demonstration of how Threat Intelligence can be applied reactively during DFIR operations.

The speakers meticulously walked through the exact steps, tools, and thought processes employed by their TI team. For instance, they showed how a simple Google dork for "Proximus APK malware" led to Malware Bazaar, and how pivoting from there to Hatching Triage reports confirmed the Antidot malware family and its C2 infrastructure. Similarly, the Gallium APT case demonstrated the power of searching for a unique file path (wmipd.dll) to uncover a matching Palo Alto Networks report, instantly providing attribution and expanding the incident's scope. The Winnti APT example showcased a more complex chain of investigation, from VirusTotal to Kaspersky reports, then to Validin for passive DNS, URLScan for content analysis, and finally TronScan for cryptocurrency tracing—all described with enough detail for an attentive audience to understand and potentially replicate the process.

This approach effectively validated their core premise: that TI can provide significant value in reactive scenarios, without requiring large budgets or proprietary tools. The "how it worked" was conveyed by illustrating the sequential, logical steps taken in each real-world scenario, thereby serving as compelling evidence of the methodology's efficacy.

Defensive Implications

▶ Watch: Q&A: Keeping TI updated in fast-moving incidents (29:00)

The insights gleaned from this talk offer several critical implications for cybersecurity defenders looking to enhance their incident response capabilities:

1. Integrate Reactive TI into DFIR Workflows: Organizations should formally integrate a reactive threat intelligence function into their DFIR processes. This means establishing clear communication channels between IR and TI teams (e.g., shared chat channels, regular syncs) and adopting methodologies like the "Evidence Follow-up" approach, where TI analysts proactively seek connections from IR findings.
2. Leverage Free and Low-Cost Tools: Defenders do not need massive budgets to start applying reactive TI. Tools like Google dorking, public malware repositories (e.g., Malware Bazaar), free tiers of sandbox analysis platforms (e.g., Hatching Triage), passive DNS services (e.g., Validin), and URL scanning services (e.g., URLScan) are powerful resources that can yield significant intelligence. Focus on mastering these accessible tools.
3. Prioritize Broader Scope and Attribution: Beyond simply containing and eradicating the immediate threat, defenders should strive to understand the broader context. This includes identifying the malware family, attributing the attack to a known threat actor or campaign, and uncovering additional malicious infrastructure. This deeper understanding enables more comprehensive remediation and proactive hunting for related threats.
4. Proactive Hunting Based on TI: Once an incident is enriched with TI (e.g., new C2s, TTPs, malware variants), DFIR teams should use this information to conduct targeted hunts across their entire environment. As demonstrated in the Gallium APT case, this can uncover additional compromised systems that might have been initially overlooked.
5. Monitor for Impersonating Infrastructure: The Antidot case highlights the importance of monitoring for brand impersonation. Organizations should actively search for typo-squatted domains, fake login pages, or malicious applications that mimic their brand or services, especially those distributed via unofficial channels.
6. Understand Threat Actor TTPs: By attributing an incident to a specific APT group (e.g., Gallium, Winnti), defenders gain access to a wealth of public intelligence regarding that group's Tactics, Techniques, and Procedures (TTPs). This information is invaluable for strengthening defenses against future attacks from the same actor.
7. Trace Financial Transactions (if applicable): For financially motivated attacks, understanding the money laundering process (as shown with TronScan in the Winnti case) can provide insights into the actor's operational infrastructure and potentially aid in law enforcement efforts.
8. Contribute to the Community: The talk strongly emphasizes that many successes were built upon information shared by others. Defenders are encouraged to share their own research, indicators, and findings with the broader cybersecurity community (e.g., through public reports, malware repositories) to create a stronger collective defense.
9. Develop TI-Augmented Incident Response Playbooks: Incorporate specific TI steps and tool usage into existing incident response playbooks. This ensures that TI is considered at various stages of an incident, from initial analysis to post-incident review.

Key Takeaways

• Threat Intelligence is invaluable in reactive DFIR operations: It provides context, broadens incident scope, and accelerates discovery beyond traditional IR methods.
• Effective TI doesn't require a large budget: Many powerful tools for reactive TI (Google, Malware Bazaar, Hatching Triage, URLScan, Validin, TronScan) are free or low-cost.
• Proactive "Evidence Follow-up" enhances collaboration: Instead of solely relying on RFIs, TI teams should actively correlate DFIR findings with external intelligence to uncover deeper insights.
• Simple pivoting techniques yield significant results: Google dorking, pivoting on hashes, C2s, and unique strings can quickly lead to crucial reports and campaign details.
• Attribution and campaign identification are achievable: TI can help identify malware families, threat actors (e.g., Gallium, Winnti), and reveal if an incident is part of a larger, ongoing campaign.
• Community sharing is fundamental to success: Leveraging and contributing to public intelligence (malware samples, research reports) is crucial for enriching reactive TI efforts.

About the Speaker(s)

Stef Collart is a Principal Threat Hunting and Threat Intelligence Consultant at NVISO, a European cybersecurity company. Based in Belgium, Stef's recent work in threat intelligence has focused on creating threat landscapes and threat actor profiles for customers, as well as managing NVISO's TI monitoring service which includes tracking breached accounts, credentials, data leaks, and impersonating domains to help prevent incidents.

Efstratios Lontzetidis (Stratos Loukidis) is a Senior Threat Intelligence Consultant at NVISO, hailing from Greece. He is deeply involved in all TI-related activities at NVISO, leading TI projects and producing threat research. Efstratios is particularly passionate about reactive threat intelligence, describing himself as a "Selenium script opening multiple tabs simultaneously" to uncover actionable intelligence from technical indicators like IP addresses during an incident.