Technical Summary: TIBlender

Problem Statement

Cyber threat intelligence (TI) collection currently relies heavily on commercial and public threat feeds, which introduce an inevitable time lag between the emergence of a threat and its publication. While social media platforms (e.g., X, Reddit, Telegram, Discord) have been shown to carry Indicators of Compromise (IoCs) and attack campaign details ahead of official feeds, existing approaches fail to fully automate the integration of this fragmented, multilingual data into actionable reports.

Current systems face three fundamental challenges:

1. Fragmented Integration: Threat signals are distributed across heterogeneous platforms with different languages, posting cultures, and granularities. Single-platform monitoring yields structurally incomplete intelligence.
2. Reliability Validation: Social media contains significant noise, misinformation, and exaggeration. Automated extraction relying on a single perspective cannot fully eliminate false positives, and existing methods lack mechanisms for cross-validating evidence from independent perspectives.
3. Noise Filtering and Adaptation: Threat signals are buried under spam and advertisements. Furthermore, static monitoring rules cannot keep pace with the evolving targets, techniques, and platforms used by adversaries.

No existing system simultaneously addresses the integration of multi-platform data, cross-source validation, and adaptive noise filtering to generate end-to-end automated TI reports.

Methodology: TIBlender System Design

TIBlender is an autonomous multi-agent system designed to monitor multiple social media platforms, correlate fragmented signals, and generate structured, evidence-backed TI reports. The system operates in fixed-interval cycles and utilizes a five-step in-cycle pipeline augmented by cross-cycle feedback mechanisms.

1. System Architecture

The system monitors four representative platforms: X (rapid dissemination), Reddit (in-depth technical discussion), Telegram (threat actor activity), and Discord (actor coordination). It employs specialized Large Language Model (LLM) agents for each stage, ranging from data extraction to structured report generation.

2. The Five-Step In-Cycle Pipeline

• Step 1: Adaptive Collection and Post Analysis:
  • Collects posts via predefined multilingual keywords and dynamic keyword augmentation driven by trend detection.
  • Applies Optical Character Recognition (OCR) to images and uses an LLM agent to generate English threat summaries and extract IoCs (URLs, hashes, domains, IPs, CVEs) in parallel.
  • Outputs (threat summary, IoC list) pairs for downstream processing.
• Step 2: Campaign-Level Clustering:
  • Consolidates posts into clusters representing the same threat campaign using a dual-track approach:
    • IoC Track: Merges posts with high IoC overlap (Jaccard similarity) using a union-find algorithm.
    • Non-IoC Track: Uses semantic similarity of threat summaries to attach posts without IoCs to existing clusters or groups them via HDBSCAN.
  • An LLM agent splits clusters into campaign-level units based on target organization and attack vector, assigning severity levels (LOW/MEDIUM/HIGH/CRITICAL).
• Step 3: Multi-Perspective Investigation:
  • Deploys four specialized investigation agents (Infrastructure, Technical, Social, Actor) to collect evidence.
  • Mode Selection: Clusters are processed in either Multi-Perspective mode (for novel threats) or RL-Guided mode (for threats resembling past cases). The RL-Guided mode uses a Reinforcement Learning policy to prioritize investigation focuses based on historical success.
  • Agents use external tools (RDAP/WHOIS, Passive DNS, CVE databases) to pivot from initial IoCs to related infrastructure and actor information.
• Step 4: Adaptive Evaluation Loop:
  • Independent "judge" agents (from different LLM providers to reduce bias) evaluate the investigation context along three axes: Sufficiency (are all required data points collected?), Consistency (are there contradictions?), and Evidence Quality (is high-confidence evidence dominant?).
  • If evidence is insufficient, the system triggers a follow-up investigation in Multi-Perspective mode.
  • A conservative consensus rule is applied: a report proceeds only if all judges agree; otherwise, it is skipped to suppress false positives.
• Step 5: Structured Report Generation:
  • Converts validated investigation contexts into structured TI reports (JSON, PDF, Markdown, STIX 2.1).
  • Reports include explicit justifications, confidence scores, and extraction types (Direct vs. Pivot).

3. Cross-Cycle Feedback

• Trend-Based Query Adaptation: Analyzes cluster trends (volume, propagation, escalation) to generate dynamic search queries for the next cycle, ensuring coverage of emerging threats.
• Online RL Policy Learning: Uses successful investigation trajectories from past cycles to fine-tune the RL policy for Step 3, improving the efficiency of future investigations.

Key Contributions

1. TIBlender Implementation: A multi-agent system that integrates fragmented, multilingual threat signals across multiple platforms and autonomously generates actionable TI reports with verified IoCs and evidence-backed justifications.
2. Quantitative Validation of Cross-Platform Necessity: Demonstrates that each platform contributes unique threat information. Excluding any single platform results in substantial loss of reports in specific threat categories (e.g., excluding Discord eliminates 43% of Vulnerability reports).
3. Operational Early-Warning Capability: Through large-scale deployment, the system captures threats ahead of public feeds and vulnerability registries, including in-the-wild exploitation.

Experimental Results

The system was deployed for 31 days (March 16 – April 16, 2026) across X, Reddit, Telegram, and Discord.

• Scale: Processed 873,973 raw posts, consolidated into 184,240 clusters, and generated 8,288 actionable threat reports.
• Cross-Platform Dependency:
  • X was the primary source for Phishing/Fraud (65%).
  • Reddit dominated Malware/C2 (59%).
  • Discord and X split Vulnerability reports (45% and 46%).
  • APT/Ransomware was the most distributed category, with significant contributions from all four platforms.
  • Excluding a single platform resulted in the loss of up to 50% of reports in specific categories.
• Comparison with Single-Platform Baselines:
  • Under identical input conditions, TIBlender's IoC extraction (Direct + Pivot) exceeded single-platform baselines (Tweezers, DarkGram, Reddit2CTI) by 1.6x to 5.1x in volume.
  • Novelty: TIBlender identified 81.7%–94.0% of IoCs that were absent from the respective single-platform baselines.
  • Quality: TIBlender's IoCs were flagged by 11+ VirusTotal engines in 19.7%–32.3% of cases, significantly outperforming baselines (e.g., DarkGram at 0.4%). The false positive rate for domain IoCs was kept low (1.8%–2.3%) compared to baselines (up to 44.0%).
• Comparison with Public Feeds:
  • Feed-Scoped Absence: 83.0%–99.6% of TIBlender's IoCs were absent from six major public feeds (PhishTank, MalwareBazaar, URLhaus, CISA KEV, OTX Pulses, TweetFeed).
  • Early Detection: TIBlender detected overlapping IoCs ahead of public feeds in 13.7%–31.3% of cases.
  • Lead Time: The system captured in-the-wild exploitation up to 13.4 days before CISA KEV listing and 72 hours ahead of PhishTank.

Significance and Claims

The paper establishes cross-platform social media monitoring as an effective and scalable early-warning layer for operational TI pipelines. It argues that:

• Integration is Critical: No single platform provides a complete view; cross-platform integration is essential for comprehensive coverage.
• Automation is Feasible: Multi-agent systems with role-specialized LLMs can successfully automate the complex tasks of correlating fragmented evidence, validating reliability, and generating structured reports.
• Timeliness: Automated monitoring of social media can significantly reduce the time-to-detection for emerging threats compared to traditional feed-based collection, providing actionable intelligence before vulnerabilities are officially cataloged or widely disseminated.

The authors emphasize that their approach explicitly trades a modest increase in false negatives for a significant suppression of false positives, prioritizing the reliability required for direct integration into Security Operations Centers (SOCs).