In recent years, the field of Cyber Threat Intelligence (CTI) has gained significant relevance due to the exponential growth of cyber threats affecting different sectors and organizations. The collection of IOCs, malware analysis, and the study of Advanced Persistent Threats (APTs) have become essential CTI activities — and that is exactly what we will discuss today.
APT Research plays a fundamental role in long-term mapping of TTPs, collecting IOCs, and performing both static and dynamic analysis of the malware that composes a threat group’s toolkit. It also helps document additional artifacts and trace the evolutionary line of a group’s capabilities, technologies, and relationships between victim and attacker over a defined time period, enabling analysts to understand why a campaign happened and its motivation against a specific sector.
&nbsp;
<a href="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined.png"><img fetchpriority="high" decoding="async" class="alignnone wp-image-7832" src="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-300x169.png" alt="" width="469" height="264" srcset="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-300x169.png 300w, https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-768x431.png 768w, https://blog.it-eam.com/wp-content/uploads/2025/11/undefined.png 849w" sizes="(max-width: 469px) 100vw, 469px" /></a>
To support this, the Extended Diamond Model, a CTI framework, emerges from the need to contextualize why attacks happen — not only how they occur. It brings concepts that are essential to APT Research, which we will break down below.
At the vertices of the Extended Diamond Model, we have:
<ul>
<li>Adversary &#8211; The actor or group (APT, threat actor) coordinating the attack.</li>
<li>Infrastructure &#8211; Technical means used (C2 servers, domains, proxies, etc.).</li>
<li>Capability &#8211; Tools, exploits, malware or techniques (e.g., exploit for CVE-2025-31324 used by UNC6040).</li>
<li>Victim &#8211; The targeted entity or organization.</li>
</ul>
As Meta-features, the model includes: 
<ul>
<li>TimeStamp &#8211; Date and time of the intrusion, helping compare TTPs over time.</li>
<li>Phase &#8211; Position within the Cyber Kill Chain and related MITRE ATT&amp;CK® TTP.</li>
<li>Result &#8211; Outcome of the action (exfiltration, persistence, etc.).</li>
<li>Direction &#8211; Who initiated the attack and who was victimized.</li>
<li>Methodology &#8211; Modus operandi (reconnaissance, phishing, etc.).</li>
<li>Resources &#8211; Infrastructure or artifacts used.</li>
</ul>
Finally, the model includes two axes:
<ul>
<li data-start="2390" data-end="2505">Technical Axis – Represents the relationship between an adversary’s capabilities and the infrastructure used.</li>
<li data-start="2508" data-end="2909">Sociopolitical Axis – May be directly linked to geopolitical factors, such as conflicts in Eastern Europe or nation-state espionage targeting foreign public services. It also describes the relationship between attacker and victim, explaining the motivation behind the attack. Not all cases involve an APT or ransomware group — sometimes the attacker may be a former employee seeking retaliation.</li>
</ul>
Using this framework together with MITRE ATT&amp;CK® and the Cyber Kill Chain, iT.eam’s Threat Intelligence team performs concrete APT Research activities. We analyze not only the technical tools used by APT groups, but also their relationships and motivations, collected over time through real infiltration into threat actor communication channels — whether on Telegram, underground forums, or the DarkWeb. These channels host the main hubs for announcements, sales, recruitment, and data-dumping operations, enabling full correlation of intelligence that informs Threat Hunting and Detection Engineering activities, strengthening both our environment and that of our clients.
Our internal team has mapped several APTs, including cases related to the Akira ransomware group (which demonstrates multiple APT-like capabilities such as defense evasion, lateral movement, and silent exfiltration) as well as clusters <a href="https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree">UNC6040, UNC6395</a>, and the rise of financial APT-like groups emerging in Brazil.
As a real example of iT.eam’s Threat Intelligence activities, we highlight analyses conducted between April and October 2025 of the group <a href="https://attack.mitre.org/groups/G1015/">Scattered LAPSUS$ Hunters</a>. Due to worldwide impact, the group became a target of international agencies such as the FBI and French Police. They were responsible for incidents affecting companies such as Salesforce, Google, Jaguar Land Rover, European Airlines, Gucci, Vivara, and other luxury brands — and they even mapped attack opportunities against Brazilian telecommunications companies.
<a href="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined.jpeg"><img decoding="async" class="alignnone size-medium wp-image-7833" src="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-297x300.jpeg" alt="" width="297" height="300" srcset="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-297x300.jpeg 297w, https://blog.it-eam.com/wp-content/uploads/2025/11/undefined.jpeg 609w" sizes="(max-width: 297px) 100vw, 297px" /></a>
“We are recruiting employees/insiders from the following: Any telecommunications provider (Claro, Telefonica, ATT, etc.) Large software/gaming companies (Microsoft, Apple, EA, IBM) Call center/BPM… Server providers… Note: we are not looking for data, but for employees who can give us access to VPN or CITRIX networks or anydesk [&#8230;]”
A temporal analysis of their TTPs shows that, in 2024, the group used vishing campaigns targeting non-technical employees, impersonating technical support, along with <a href="https://attack.mitre.org/techniques/T1451/">SIM swapping (Technique T1451 – Mobile, MITRE ATT&amp;CK®)</a>. By 2025, during attacks against Salesforce, the group’s behavior evolved. They still used phishing, but now relied on AI voice agents, powered by VoIP services such as Twilio, Google Voice, and 3CX. These agents used AI voice models like Vapi and Bland, configured with customized gender and regional accents.
When separating TTPs, we observe LAPSUS$ performing initial access via vishing, while ShinySpiders focused on lateral movement and exfiltration. Through analysis of messages in their official channels, we identified several members, including ByteToBreach, one of the pentesters responsible for intrusions into airlines and Salesforce.
<a href="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-1.png"><img decoding="async" class="alignnone size-medium wp-image-7834" src="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-1-300x245.png" alt="" width="300" height="245" srcset="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-1-300x245.png 300w, https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-1.png 444w" sizes="(max-width: 300px) 100vw, 300px" /></a>
<a href="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-1.jpeg"><img loading="lazy" decoding="async" class="alignnone size-medium wp-image-7835" src="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-1-300x229.jpeg" alt="" width="300" height="229" srcset="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-1-300x229.jpeg 300w, https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-1.jpeg 447w" sizes="(max-width: 300px) 100vw, 300px" /></a>
One of the group’s last appearances occurred on October 27, 2025, involving a data dump from a Ukrainian company, after several members had already been arrested.
<a href="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-2.png"><img loading="lazy" decoding="async" class="alignnone size-full wp-image-7836" src="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-2.png" alt="" width="240" height="253" /></a>
The actors also cloned legitimate Okta pages for phishing campaigns, allowing IOC pivoting and revealing subtle provocations directed at the FBI when analyzing their requests.
<a href="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-3.png"><img loading="lazy" decoding="async" class="alignnone size-medium wp-image-7838" src="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-3-300x53.png" alt="" width="300" height="53" srcset="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-3-300x53.png 300w, https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-3.png 409w" sizes="(max-width: 300px) 100vw, 300px" /></a><a href="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-4.png"><img loading="lazy" decoding="async" class="alignnone size-medium wp-image-7837" src="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-4-300x245.png" alt="" width="300" height="245" srcset="https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-4-300x245.png 300w, https://blog.it-eam.com/wp-content/uploads/2025/11/undefined-4.png 388w" sizes="(max-width: 300px) 100vw, 300px" /></a>
APT Research remains one of the fundamental pillars of a modern Threat Intelligence team, enabling organizations to understand and anticipate adversary behaviors before they materialize into incidents. Rather than relying solely on vendors or public feeds, iT.eam’s team operates proactively — pivoting IOCs, performing direct analysis in underground and dark web environments, and correlating TTPs in real time using frameworks like MITRE ATT&amp;CK® and the Extended Diamond Model.
This approach ensures that our detections and reports stem from living intelligence, built from real observations infiltrated and analyzed within the adversary ecosystem. Every pivoted IOC, every established relationship, and every mapped vector helps reduce the Time to Intel (TTI) and expands our ability to anticipate emerging threats not yet documented in commercial feeds.
More than reacting, iT.eam invests in understanding the motivation behind each threat, connecting the technical and sociopolitical dimensions to identify origin, intent, and potential impact of malicious operations. This is the &#8220;sixth sense&#8221; that every CTI team must develop, generating insights that act as countermeasures to prevent cyber disasters.
Learn more about the <a href="https://it-eam.com/security/services">work of iT.eam’s CTI team</a>!
Reference: https://www.ic3.gov/CSA/2025/250912.pdf
<a href="https://blog.it-eam.com/wp-content/uploads/2025/11/APT_Capa-de-Autoria_PTBR-copia-scaled.png"><img loading="lazy" decoding="async" class="alignnone size-medium wp-image-7844" src="https://blog.it-eam.com/wp-content/uploads/2025/11/APT_Capa-de-Autoria_PTBR-copia-300x164.png" alt="" width="300" height="164" srcset="https://blog.it-eam.com/wp-content/uploads/2025/11/APT_Capa-de-Autoria_PTBR-copia-300x164.png 300w, https://blog.it-eam.com/wp-content/uploads/2025/11/APT_Capa-de-Autoria_PTBR-copia-1024x559.png 1024w, https://blog.it-eam.com/wp-content/uploads/2025/11/APT_Capa-de-Autoria_PTBR-copia-768x419.png 768w, https://blog.it-eam.com/wp-content/uploads/2025/11/APT_Capa-de-Autoria_PTBR-copia-1536x839.png 1536w, https://blog.it-eam.com/wp-content/uploads/2025/11/APT_Capa-de-Autoria_PTBR-copia-2048x1118.png 2048w, https://blog.it-eam.com/wp-content/uploads/2025/11/APT_Capa-de-Autoria_PTBR-copia-scaled.png 1920w" sizes="(max-width: 300px) 100vw, 300px" /></a>
&nbsp;

Advanced Persistent Threat (APT) Research: an essential pillar of Threat Intelligence. Learn more in the article!

Expert-desk_APT-blog

In recent years, the field of Cyber Threat Intelligence (CTI) has gained significant relevance due to the exponential growth of cyber threats affecting different sectors and organizations. The collection of IOCs, malware analysis, and the study of Advanced Persistent Threats (APTs) have become essential CTI activities — and that is exactly what we will discuss [&hellip;]

APT Research: an essential pillar for Threat Intelligence