cyber.hendryadrian.com
Interesting Stuff · recordedfuture.com

How Recorded Future’s Insikt Group Combines Analyst Expertise and Automation for Threat Intelligence

· Original article ↗

Summary

Recorded Future describes how Insikt Group analysts combine specialist knowledge, multilingual expertise, and automated network and multi-source analysis to identify threats, validate intelligence, and support customer and public research.

Key points

  • Insikt Group pairs analysts’ expertise with automated data indexing and analysis to contextualize threat activity.
  • Its methods include tracking adversary infrastructure, correlating network traffic and exfiltration events, and validating findings across multiple sources.
  • The team says its analysis can identify targeted organizations and detect ongoing intrusions in near real time.
  • Examples cited include Blind Eagle activity targeting Colombian government institutions and victims targeted through compromised WordPress sites.
  • Multilingual and regional expertise helps analysts interpret activity and context that automated systems may miss.
  • Research is delivered through Recorded Future’s platform and published reports, including threat analyses, actor profiles, and actionable detections.

Article Details

Topic
How Insikt Group combines analyst expertise and automated data analysis to produce and validate threat intelligence.

Threat Actors

Blind EagleNamed as an alternate name for TAG-144, which the article says targeted Colombian government institutions.TAG-144Identified as targeting Colombian government institutions; the article also names this activity cluster Blind Eagle.

Vendors

Recorded FutureIn the previous article in our series on Recorded Future’s unique data sourcing model, we detailed the four types of data we analyze and how, together, they provide unprecedented visibility into each of our customers’

Products

Recorded Future PlatformAnalysts integrate data from over 1 million sources in the Intelligence Graph®, including the Recorded Future Platform, open web, dark web, technical feeds, malware intelligence, customer telemetry, and more.

Countries

ChinaThis human layer of analysis is particularly critical when monitoring threat actors operating across China, Russia, Iran, and North Korea, where understanding cultural context, geopolitical motivations, and regionalColombiaRecent research includes identifying five distinct activity clusters by TAG-144 (Blind Eagle) targeting Colombia government institutions.Iranlayer of analysis is particularly critical when monitoring threat actors operating across China, Russia, Iran, and North Korea, where understanding cultural context, geopolitical motivations, and regional dynamics isNorth Koreais particularly critical when monitoring threat actors operating across China, Russia, Iran, and North Korea, where understanding cultural context, geopolitical motivations, and regional dynamics is essential toRussiahuman layer of analysis is particularly critical when monitoring threat actors operating across China, Russia, Iran, and North Korea, where understanding cultural context, geopolitical motivations, and regional

Related Articles