Censys Announces AI-Powered Threat Investigation Tool in Closed Beta
Summary
Censys announced Investigator, a closed-beta tool that automates threat-intelligence pivots and infrastructure analysis, returning ranked, evidence-backed findings. It uses AI for orchestration while keeping verdicts deterministic.
Key points
- Investigator accepts a single network observable, a bulk list, or a raw intelligence report, then checks history, related infrastructure, and host profiles in parallel.
- Results include ranked findings with evidence, source queries, confidence scores, an investigation log, and a relationship diagram.
- Censys says large language models handle orchestration and task decomposition, while the pipeline keeps verdicts deterministic where possible.
- The tool is built on Censys’ Internet Map and draws on research processes developed by its ARC team.
- Example investigations included mapping 682 hostnames in a USPS smishing cluster and linking a sibling UPS campaign through a shared HTTP banner hash.
- ARC also mapped roughly 40 AsyncRAT variants and confirmed live command-and-control for 13, identifying inherited TLS certificate structure as a useful family-wide pivot.
- The article says beta access is available to organizations on the Adversary Investigation plan, with general availability targeted for September 30, 2026.
Article Details
- Event Type
- Censys announced Censys Investigator, an AI-powered threat investigation feature entering closed beta.
- Impact
- The feature automates parallel infrastructure pivots, history checks, and host profiling, returning ranked findings with evidence. Censys says it has supported investigations into smishing infrastructure and malware variants; the article does not report a new breach or victim impact.
People
Threat Actors
Malware
AsyncRATRecent investigation: AsyncRAT forks into dozens of variantsDCRatA single certificate pattern carried down from DCRAT identifies the malware across the entire tree, regardless of which variant is deployed.PhantomVAIIn one investigation, that method narrowed the entire web down to 42 actionable results on a live ClickFix campaign delivering XWorm through the PhantomVAI loader.XWormIn one investigation, that method narrowed the entire web down to 42 actionable results on a live ClickFix campaign delivering XWorm through the PhantomVAI loader.