Expanding Threat Intelligence in IBM X-Force Exchange

Like a journalist, a security analyst must check multiple sources for additional information to verify or invalidate an assumption. Until recently, this was a rather tedious task. An analyst would have to reference various threat intelligence sites, enter the observable information in question and merge that data back into the main view.

According to our research, analysts often do this with scrap paper and text files. Now researchers can compile this data into a collection on IBM X-Force Exchange to share findings with colleagues and the security community at large.

Simplify Threat Intelligence in X-Force Exchange

The newly introduced Threat Feed Manager simplifies the task of getting data out of various sources and into one view. You can enable those threat intelligence sources directly on the X-Force Exchange by providing the credentials of those providers. The platform will then integrate the data into X-Force Exchange directly without the need to access additional sources one by one.

As of now, the following third-party threat intelligence feeds are available in the Threat Feed Manager:

VirusTotal;
CrowdStrike;
BotScout;
PhishTank;
RiskIQ;
ReversingLabs; and
RecordedFuture.

How the Threat Feed Manager Works

To take advantage of this capability, IT professionals should first open the Settings page by opening the user side panel on the top right and clicking the link at the bottom. From there, navigate to the Integrations section and input the credentials of the third-party sources you want to access. The authentication required can vary from a simple token to an application program interface (API) key and password. Next, switch the Enabled button on to enable the source and find the report page you want to research, such as an IP address or URL. The platform will present data from the applicable configured sources.

To see for yourself how easy it is to integrate threat intelligence data in X-Force Exchange, check out this 30-second video:

You can also register for a webinar titled “Transform Threat Intelligence Into Prevention in Minutes” to learn more about using threat intelligence in your security program.

Security Intelligence Staff

ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware

11 min read - As of December 2023, IBM X-Force has uncovered multiple lure documents that predominately feature the ongoing Israel-Hamas war to facilitate the delivery of the ITG05 exclusive Headlace backdoor. The newly discovered campaign is directed against targets based in at least 13 nations worldwide and leverages authentic documents created by academic, finance and diplomatic centers. ITG05’s infrastructure ensures only targets from a single specific country can receive the malware, indicating the highly targeted nature of the campaign.X-Force tracks ITG05 as a…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

GootBot – Gootloader’s new approach to post-exploitation

8 min read - IBM X-Force discovered a new variant of Gootloader — the "GootBot" implant — which facilitates stealthy lateral movement and makes detection and blocking of Gootloader campaigns more difficult within enterprise environments. X-Force observed these campaigns leveraging SEO poisoning, wagering on unsuspecting victims' search activity, which we analyze further in the blog. The Gootloader group’s introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using off-the-shelf tools for C2…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

Simplify Threat Intelligence in X-Force Exchange

How the Threat Feed Manager Works

More from Threat Intelligence

ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware

IBM identifies zero-day vulnerability in Zyxel NAS devices

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

GootBot – Gootloader’s new approach to post-exploitation

Topic updates