Actively Understanding the Dynamics and Risks of the Threat Intelligence Ecosystem

Actively Understanding the Dynamics and Risks of the Threat Intelligence Ecosystem

Speakers: Tillson Galloway

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=7dBvj8yge8U

Overview

The threat intelligence (TI) ecosystem is a multi-billion dollar industry where vendors ingest, analyze, and share malware samples and indicators of compromise (IoCs) through complex supply chain relationships. This talk presents a novel active probing methodology that maps these hidden relationships by submitting specially crafted binaries to TI vendors and tracking their propagation through the ecosystem. The binaries contain a replicating provenance mechanism -- each execution generates a child binary that carries the chain of fingerprints from all previous execution environments, creating trails that map vendor-to-vendor sharing relationships. Key findings include: two-thirds of vendors execute submitted binaries in sandboxes, a quarter of executions get shared with other vendors, 4 "nexus" vendors serve as critical sharing hubs, some vendors maintain static fingerprints and IP addresses for 5+ years (enabling adversary evasion), and domain suspension takes up to 10 days despite blocking occurring within 24 hours. The research also reveals cyclic sharing relationships and that downstream vendors often receive only domain indicators without the originating binary, forcing them to trust upstream classifications.

Background

▶ Watch: Research questions: threats, delays, and independence in the TI ecosystem (1:00)

When a binary is uploaded to a platform like VirusTotal, it enters a larger ecosystem of sandboxes, TI platforms, and antivirus vendors. These vendors are organized into a graph of sharing relationships -- some explicitly documented, many hidden. Understanding this supply chain is important because: (1) delays in sharing prolong detection and blocking of malware, (2) sharing relationships can compromise the independence of vendor classifications (relevant for researchers using multi-vendor detection counts), and (3) adversaries who understand the ecosystem can evade detection by fingerprinting and avoiding sandbox environments.

Key Findings

▶ Watch: Provenance trail mechanism: each execution adds an environment fingerprint (5:30)

Ecosystem mapping via active probing: The methodology identifies 20 hand-labeled vendors and 43 external vendors through 1,600 total binary executions and 170 distinct environment fingerprints. Four nexus vendors (TI platforms that ingest and share broadly) serve as critical hubs in the supply chain.

Sharing is stratified: TI platforms share aggressively (heavy red in the sharing matrix), sandboxes share less, and antiviruses primarily consume from other sources rather than sharing. Antiviruses likely obtain data through free APIs or contractual agreements with TI platforms.

Cyclic sharing relationships: Some vendors share back and forth in cycles -- e.g., an internal TI vendor shares with a German vendor, which executes and shares back, continuing until the replication limit is reached.

Blocking is fast, suspension is slow: Domain blocking by popular DNS resolvers occurs within 24 hours, but domain suspension at the registrar level takes up to 10 days. Many malware campaigns have moved on by then.

Domains shared without binaries: In approximately half of cases, downstream vendors receive domain indicators without the originating binary, forcing them to trust the upstream vendor's classification. This enables potential denial-of-service by submitting a malicious binary containing a benign domain -- the domain gets blocked based on the upstream vendor's assessment alone.

Sandbox fingerprinting is a persistent problem: Some vendors have used the same network fingerprints and IP addresses for 5+ years without rotation, enabling adversaries to detect and evade analysis environments.

Technical Deep Dive

▶ Watch: Results: 1,600 executions, 170 fingerprints, 4 nexus vendors identified (8:00)

The probing binary uses a three-stage process: profiling (collecting RAM, OS install date, manufacturer hash), emission (HTTP/DNS requests to attacker-controlled infrastructure with concatenated fingerprint hashes), and replication (dropping a child binary on the desktop that carries the parent's provenance chain). The provenance trail works like a train -- each execution adds a "car" containing the current environment's fingerprint, enabling reconstruction of the full sharing path. Replication is limited to 5 levels to prevent worm-like behavior. The binary is a defanged keylogger -- suspicious enough to trigger analysis but ultimately benign. Attribution uses Boolean signature conjunctions (IP country + system fingerprint + network profile) applied to initial high-confidence executions and then to the long tail of later executions.

Demo / Proof of Concept

▶ Watch: Cyclic sharing and domain suspension taking 10 days vs 24-hour blocking (12:00)

A case study traces a binary submitted to one vendor: within 1 minute, the first internal execution occurs. Within 10 minutes, both the original and dropped binaries are shared with a second internal vendor. This second vendor (identified as a nexus) then shares widely -- executions appear from vendors using network anonymization, vendors in Germany, China, Russia, and others. Blocking occurs within 24 hours on popular resolvers, but domain suspension takes nearly 10 days, traversing multiple vendors before reaching one with a registrar affiliation.

Defensive Implications

▶ Watch: Sandbox fingerprints static for 5+ years enabling adversary evasion (14:00)

For TI vendors, the static fingerprinting finding (same IPs for 5 years) is a significant operational security failure. Adversaries are actively fingerprinting and evading these environments. Network anonymization and environment randomization should be priorities. For security researchers, the sharing relationships between vendors compromise the independence of multi-vendor detection counts on platforms like VirusTotal. Detection agreement may reflect shared data sources rather than independent analysis. For registrars and DNS operators, the 10-day suspension delay vs. 24-hour blocking gap represents a window where adversaries operate with impunity at the domain level despite network-level blocking.

Key Takeaways

• The TI ecosystem is a complex supply chain with hidden vendor-to-vendor sharing relationships
• 4 nexus vendors serve as critical sharing hubs; their compromise would affect the entire ecosystem
• Cyclic sharing relationships and domain-only sharing (without binaries) create trust and independence concerns
• Some vendors maintain static sandbox fingerprints for 5+ years, enabling adversary evasion
• Domain blocking occurs within 24 hours but suspension takes up to 10 days
• Multi-vendor detection counts on VirusTotal may not represent independent analyses
• The active probing methodology with self-replicating provenance trails enables ecosystem mapping

About the Speaker(s)

Tillson Galloway is a researcher at Georgia Tech studying the threat intelligence ecosystem, malware analysis infrastructure, and supply chain security. The research uses novel active measurement techniques to map previously opaque vendor relationships, with responsible disclosure to all 30 affected vendors.