An essential element for the effectiveness of modern ethical hacking is threat intelligence. It is a set of detailed and contextualized knowledge about cyber threats, their authors, their motivations, and their operational methods.

This article explores the vital role of threat intelligence in contemporary ethical hacking practices. We will see how it is essential for creating realistic attack scenarios, enhancing reconnaissance activities, and sharing valuable information with internal teams. The ultimate goal is to strengthen corporate security.

Definition of Threat Intelligence and its importance in cybersecurity

Threat intelligence is the set of information collected, transformed, analyzed, interpreted, or enriched to provide the context necessary for decision-making and to enable relevant and sufficient understanding. The goal is to mitigate the impact of an ICT-related incident or a cyber threat. Threat intelligence goes beyond the simple collection of data on threats, focusing on their analysis and contextualization to make them truly useful and actionable.

Its importance in cybersecurity lies in the ability to transform a predominantly reactive approach to security into a proactive and even predictive one. Instead of just responding to incidents when they occur, threat intelligence allows organizations to better understand the threat landscape specific to their sector and infrastructure, anticipating potential attacks and preparing more effective defenses.

The unbreakable bond between Threat Intelligence and Ethical Hacking

Threat intelligence integrates perfectly with ethical hacking, providing security experts with the crucial information needed to conduct more targeted and realistic assessments. Relying on a structured ethical hacking service guided by threat intelligence allows for the simulation of attack scenarios that reflect the concrete threats to which the organization is actually exposed. In particular:

• Creation of realistic attack scenarios: It allows ethical hackers to base their attack scenarios on concrete and current threats. Understanding the TTPs used by specific threat groups or in certain contexts allows for the simulation of attacks that the organization could actually suffer, making the tests much more relevant, realistic, and useful.

For example, knowing the “lateral movement” techniques typical of an Advanced Persistent Threat (APT) (a type of attack) allows for specifically testing the organization’s ability to detect and contain such movements within the network. To delve into the technical terminology of this field, it is useful to consult the glossary of the main ethical hacking terms.

• Improvement of reconnaissance activities: the reconnaissance phase is fundamental in ethical hacking, as it precedes any exploitation attempt. Threat intelligence enriches this phase by providing detailed information on potential targets, known vulnerabilities associated with certain technologies, and information gathering techniques (OSINT, HUMINT) used by real attackers. Recognizing an attack already in this phase is crucial to timely limit its impact and contain the damage.

Knowing what information an attacker might look for publicly about an organization (via OSINT) or which social engineering techniques (based on HUMINT) might be effective guides the ethical hacker in simulating these preliminary phases.

• Sharing valuable information with internal teams: the results of an ethical hacking exercise, if contextualized with the threat intelligence that guided the simulation, become a powerful tool for raising awareness and training internal security teams.

Understanding how specific actors threaten the organization and which vulnerabilities were exploited helps the security team focus their remediation and defense efforts. Furthermore, shared threat intelligence can improve incident response processes, providing a broader context for the analysis and management of real incidents. On this point, it is worth exploring how ethical hacking contributes to ICT incident management.

Types of Threat Intelligence and their relevance to Ethical Hacking

Threat intelligence can be classified into different categories based on the level of detail, its purpose, and the audience for which it is intended:

• Strategic Threat Intelligence: provides a high-level view of the threat landscape, analyzing trends, attacker motivations, and potential risks for the organization and its sector.

This type is useful for defining the overall security strategy and for understanding the context in which threats operate. In ethical hacking, strategic threat intelligence helps identify the most likely types of threats for an organization, guiding the choice of attack scenarios to simulate.

• Operational Threat Intelligence: focuses on attacker capabilities, their TTPs, and past attack campaigns. Fundamental for understanding how, when, and where an attack could occur and what technical skills the aggressors possess.

For ethical hackers, operational threat intelligence is crucial for emulating the specific actions of attackers, using their own techniques and procedures during tests. Frameworks like MITRE ATT&CK provide a vast library of TTPs used by real actors, allowing ethical hackers to simulate advanced attacks such as “privilege escalation” and “lateral movement.”

• Tactical Threat Intelligence: provides specific technical details on tools, malware, infrastructure, and indicators of compromise (IOCs) used by attackers. This intelligence is immediately actionable and can be used to improve detection and prevention systems.

In ethical hacking, tactical threat intelligence allows for simulating the use of specific exploits or malware, testing the effectiveness of the organization’s technical defenses.
For example, knowing the IOCs associated with a particular phishing campaign allows for simulating the arrival of malicious emails and verifying if security systems detect them correctly.

The lifecycle

The main phases include:

1. Planning: clear definition of objectives and the information needed to achieve them. In an ethical hacking context, this phase translates into defining the test objectives and identifying threat information relevant to those objectives.
   
2. Collection: acquisition of data from various sources, both internal (logs, audits, firewalls) and external (OSINT, dark web, threat intelligence feeds). During the preparation of an ethical hacking exercise, this phase involves collecting information on the target (via OSINT) and on probable threats (based on threat intelligence feeds, security reports, etc.)
   
3. Processing: organizing and structuring the raw data collected to make it analyzable. In this phase, the collected information is filtered and correlated to eliminate “noise” and identify data of value for attack simulation.
   
4. Analysis: in-depth examination of the processed data to identify patterns, trends, specific threats, and indicators of compromise. This is the crucial phase where threat intelligence experts contextualize the information and transform it into useful knowledge for ethical hacking, identifying the most likely TTPs and potential attack vectors.
   
5. Dissemination: sharing the analyzed information with stakeholders (ethical hacking team, internal security team). The processed threat intelligence is provided to the ethical hacking team to guide the creation of attack scenarios and is subsequently shared with the security team to improve threat understanding and defense capabilities.
   
6. Feedback: reviewing the lifecycle and the results obtained to improve future threat intelligence and ethical hacking activities. After the test, the results are analyzed in light of the threat intelligence used, identifying what worked and what can be improved in the process.
   
7. At this point, the cycle does not end: threat intelligence is a continuous process. Once the last phase is completed, it starts over from the beginning, constantly updating the analysis based on emerging threats.

Application in Ethical Hacking: the TIBER-EU example

A concrete example of how threat intelligence is applied in a structured ethical hacking framework is TIBER-EU (Threat Intelligence-Based Ethical Red Teaming). TIBER-EU is a European framework for conducting “red teaming” tests based on real threat intelligence, specifically designed for the financial sector.

In the TIBER-EU context:

• A Threat Intelligence Provider (TIP) collects and analyzes threat intelligence specific to the target financial entity, taking into account its business, its operating environment, and the relevant threat landscape (this includes the use of OSINT and potentially HUMINT).
  
• The TIP produces a Targeted Threat Intelligence Report (TTIR) that outlines realistic attack scenarios based on the TTPs of threat actors that could actually target the organization and its critical or important functions (CIF).
  
• A Red Team uses the TTIR as a basis to plan and execute the advanced penetration test, simulating the attacks described in the threat scenarios against the live production systems that support the CIFs.
  
• The entire process is managed by a Control Team (CT) and supervised by a Test Manager (TM).

TIBER-EU emphasizes the close correlation between threat intelligence and testing activities, ensuring that ethical hacking exercises are truly threat-led and provide an accurate assessment of the organization’s resilience in the face of advanced cyber threats.

Use of OSINT and other intelligence sources

As mentioned, information gathering is a crucial phase of the threat intelligence lifecycle and a fundamental element for effective ethical hacking. Among the various intelligence sources, Open Source Intelligence (OSINT) plays a primary role.

OSINT refers to information derived openly from publicly available sources, such as:

• dark web forums
• social media
• cybersecurity blogs
• public security reports
• vulnerability databases
• GitHub repositories
• indicator of compromise (IOC) feeds and industry news

All are useful sources for identifying threats, malicious actors, and emerging trends in the cyber landscape.

Ethical hackers use OSINT to gather information on the target during the reconnaissance phase, such as:

• Organization information: corporate structure, key employees, technologies used, network infrastructure (often deducible from job offers, LinkedIn profiles, etc.).
• Digital attack surface: websites, web applications, public IP addresses, mail servers, any publicly disclosed vulnerabilities.
• Potential attack vectors: online habits of employees, sensitive information accidentally exposed, any past security incidents.

Other sources

In addition to OSINT, ethical hackers and threat intelligence experts make use of other information sources:

• HUMINT (Human Intelligence): information obtained from human sources, useful for understanding internal organizational dynamics, vulnerabilities related to social engineering, and potential “insider” threats.
• CCI (Cyber Counter-Intelligence): study of tools and techniques used by attackers in cyberspace.
• Indicators of Compromise (IOCs): digital traces of past malicious activity, such as malicious IP addresses, malicious domain names, hashes of files known as malware.
• Malware analysis: technical analysis of the behavior and structure of malicious software to understand its functionality and potential implications.
• Threat Intelligence feeds and platforms: commercial and open-source services that provide curated and updated information on cyber threats, often enriched by analysis and context.
• Information sharing arrangements: agreements for sharing threat information between organizations, sectors, or with government entities. The exchange of threat intelligence allows for expanding collective knowledge of threats and improving the defense capabilities of all participants.

What is the future of threat intelligence?

According to a report by Grand View Research, Inc., the cyber threat intelligence market will reach $12.6 billion by 2025, demonstrating a growing demand for experts in this sector. The future of threat intelligence services is promising, as companies, despite heavy investments in cybersecurity, remain vulnerable to cyberattacks. This scenario highlights the need to abandon traditional approaches and adopt more effective solutions, such as cyber threat intelligence, which offers proactive and predictive risk analysis.

In conclusion, threat intelligence represents an essential element for the modern practice of ethical hacking. Investing in the understanding and application of threat intelligence within ethical hacking practices is fundamental to enabling organizations to anticipate the moves of attackers, proactively identify their own weaknesses, and build a solid security foundation in the dynamic and complex cyber threat landscape.