Actively Understanding the Dynamics and Risks of the Threat Intelligence Ecosystem

Despite the billions of dollars invested in the threat intelligence (TI) ecosystem-a globally distributed network of security vendors and altruists who drive critical cybersecurity operations-we lack an understanding of how it functions, including its dynamics and vulnerabilities. To fill that void, we propose a novel measurement framework that tracks binaries as they traverse the ecosystem by monitoring for watermarked network Indicators of Compromise (IoCs). By analyzing each stage of the propagation chain of submitted TI (submission, extraction, sharing, and disruption), we uncover an ecosystem where dissemination almost always leads to the disruption of threats, but vendors who selectively share the TI they extract limit the ecosystem's utility. Further, we find that attempts to curtail threats are often slowed by 'bottleneck' vendors delaying the sharing of TI by hours to days. Critically, we identify several threats to the ecosystem's supply chain, some of which are presently exploited in the wild. Unnecessary active probing by vendors, shallow extraction of dropped files, and easy-to-predict sandbox environment fingerprints all threaten the health of the ecosystem. To address these issues, we provide actionable recommendations for vendors and practitioners that improve the safety of the TI supply chain, including detection signatures for known abuse patterns. We collaborated with vendors through a responsible disclosure process, gaining insight into the operational constraints underlying these weaknesses. Finally, we provide a set of ethical best practices for researchers actively measuring the threat intelligence ecosystem. • RQ1 [Propagation]: How do security vendors differ in their ability to analyze malware and share extracted indicators of compromise (IoCs) across the ecosystem? • RQ2 [Disruption]: How do differences in analysis and sharing affect the speed and effectiveness with which vendors block IoCs or take down (or suspend) infrastructure? • RQ3 [Evasion]: How are adversaries exploiting gaps in analysis, sharing, or disruption, and what strategies can improve the ecosystem's resilience against such evasions? Our study reveals a stratified structure in the TI ecosystem that directly impacts IoC sharing and response times. While sandbox analysis occurs rapidly and is widespread (performed