Corporate OSINT Tradecraft

Public methodology of leading OSINT / threat intelligence companies. Each section below distils the publicly documented methodology from vendor blogs, reports and academic case studies. Marketing claims are flagged explicitly. Workflows are descriptive of what the company publishes — they are not leaks of internal SOPs.

47.1 Tier 1 Vendors

Bellingcat (Investigative Journalism NGO)

Briefing: Independent, Netherlands-based investigative journalism NGO founded 2014 by Eliot Higgins. Uses open-source and social-media content (photos, videos, satellite imagery, leaked databases, flight records, court filings) to investigate armed conflicts, human-rights abuses, state-sponsored assassinations and environmental crimes. Operates a small staff plus a global network of volunteer researchers; publishes its tools and methods openly. Combines geolocation, chronolocation, content verification and structured cross-referencing of leaked or paid-data sources.

Landmark public cases (with verifiable URLs):

1. MH17 downing (2014-2017) — linked the Buk missile launcher to the Russian 53rd Anti-Aircraft Missile Brigade.
   • Report: https://www.bellingcat.com/app/uploads/2015/10/MH17-The-Open-Source-Evidence-EN.pdf
   • Three-year update: https://www.bellingcat.com/news/europe/2017/07/17/mh17-open-source-investigation-three-years-later/
2. Skripal poisoning (2018) — identified Salisbury suspects as GRU officers Chepiga and Mishkin.
   • https://www.bellingcat.com/news/europe/2018/10/09/full-report-skripal-poisoning-suspect-dr-alexander-mishkin-hero-russia/
3. Navalny poisoning (2020) — identified the FSB chemical-weapons team.
   • https://www.bellingcat.com/news/2020/12/14/fsb-team-of-chemical-weapon-experts-implicated-in-alexey-navalny-novichok-poisoning/
   • Methodology: https://www.bellingcat.com/resources/2020/12/14/navalny-fsb-methodology/
4. Bucha/Ukraine monitoring (2022-) — real-time verification of civilian casualties.
   • https://www.bellingcat.com/news/2022/02/27/follow-the-russia-ukraine-monitor-map/

Reproducible 12-step methodology (as published):

1. Define the question and the verifiable hypothesis.
2. Collect primary open sources — Telegram, VK, X, passenger manifests, leaked phone-call metadata, satellite imagery, court records. Bellingcat explicitly relies on the Russian "probiv" data market (Telegram bots returning passport/phone/vehicle records).
3. Cross-reference every single data point against a second source.
4. Use leaked databases as anchor sources — they are immutable snapshots that cannot be retroactively edited.
5. Pivot on travel records — examine passenger manifests of parallel flights (one day earlier/later).
6. Pivot on phone records — list every number called; reverse-lookup each (GetContact, Telegram bots).
7. Use address and vehicle registration to identify employer — when an FSB/GRU officer registers a vehicle at a government facility, enumerate every other vehicle at that address (Bellingcat found 191).
8. Use parking-payment databases for geolocation.
9. Reverse-engineer alias-generation patterns — FSB/GRU algorithm: same first name, same day/month of birth (year shifted ±1), last name = wife's/girlfriend's maiden name.
10. Geolocate imagery when needed — Yandex Images, Google Lens, SunCalc, Google Earth, Mapillary.
11. Cluster suspects by repeated co-travel and communication — graph of who communicated with whom, who flew with whom, who shared addresses.
12. Publish the full evidence chain — methodology, screenshots, redacted raw data, names — alongside partner outlets (The Insider, CNN, Der Spiegel) for auditability.

Tools Bellingcat publicly mentions:

• Bellingcat Online Investigation Toolkit (https://bellingcat.gitbook.io/toolkit)
• Telegram probiv bots (paid, grey-market)
• GetContact, Yandex Maps/Images, Google Earth Pro, Sentinel Hub, Copernicus EMS, NASA FIRMS, SunCalc, FlightRadar24, ADS-B Exchange, OpenSky Network, OpenCorporates, Wayback Machine, archive.today, Hunchly, InVID-WeVerify, FotoForensics, Forensically, Maltego, Spiderfoot, theHarvester.

Limitations & ethics:

• Reliance on Russian grey-market data. Bellingcat explicitly acknowledges the privacy and ethics concerns of buying leaked phone records and passport files; the practice would be illegal in most Western jurisdictions (GDPR).
• Geographic bias. Strongest cases involve Russia, Syria, Ukraine — regions with porous data protection and active conflicts. China, North Korea and Iran are far harder.
• NGO, not forensic lab. Their findings are journalistic conclusions, not chain-of-custody evidence admissible in court without corroboration.
• Volunteer model means variable quality control; the editorial team applies the same 12-step cross-referencing standard before publication.

Mandiant (Google Cloud)

Briefing: Mandiant was acquired by Google in September 2022 for $5.4B and is now part of Google Threat Intelligence (GTI). Its methodology is incident-response-led threat-actor clustering using the UNC (UNCategorized) taxonomy. Novel malicious activity is grouped into a temporary UNC#### cluster; when enough TTP, infrastructure and code overlap accumulates, the cluster is merged into an existing named group (APT## for state-sponsored, FIN## for financially motivated).

Landmark public cases (with verifiable URLs):

1. SolarWinds / UNC2452 → APT29 (2020-2021). https://cloud.google.com/blog/topics/threat-intelligence/unc2452-merged-into-apt29
2. M-Trends 2025 annual report — Mandiant tracked 302 different threat groups in 2024. PDF: https://services.google.com/fh/files/misc/m-trends-2025-en.pdf
3. APT groups catalogue: https://cloud.google.com/security/resources/insights/apt-groups
4. Trade-Offs of Cyber Attribution (methodology paper): https://cloud.google.com/blog/topics/threat-intelligence/trade-offs-attribution

Public 12-step workflow (reconstructed from public blog posts):

1. Triage an incident / sample submission. A new artefact enters via Mandiant Consulting IR engagements, the VirusTotal corpus, or Google telemetry. Compute hashes, extract strings, run YARA rules.
2. Pivot through VirusTotal Graph. Walk from the artefact to related files, URLs, contact domains and IPs that share behaviour, submission timing or first-seen dates.
3. Cluster the activity into a UNC. If the TTPs do not match an existing named group, a new UNC#### designator is created.
4. Accumulate evidence over time. Overlap dimensions: code sharing, infrastructure reuse (registrant info, SSL certs, ASN patterns), victimology, attack lifecycle, timing.
5. Apply the Suspected/Possible confidence scale. Analysts score overlaps as Possible Association (weak) or Suspected Association (strong). https://gtidocs.virustotal.com/docs/suspected-attribution
6. Test the merge hypothesis. Compare the UNC against every named APT## / FIN## in the catalogue.
7. Peer-review within Mandiant Intelligence. Other analysts challenge the merge — looking for counter-evidence (tool sharing between unrelated groups, false-flag indicators).
8. Publish attribution with confidence label. Mandiant reports use "assessed with high/moderate/low confidence" language aligned with ICD-203.
9. Public merge announcement. When attribution is final, Mandiant publishes a blog post announcing the merge.
10. Update YARA rules and detection content. IOCs, YARA, STIX/TAXII feeds updated.
11. Brief IR consultants and customers.
12. Re-evaluate periodically. If new evidence contradicts the merge, Mandiant can split the cluster again.

Tools Mandiant publicly mentions:

• VirusTotal (public + Enterprise), VirusTotal Graph, Mandiant Advantage, Google Chronicle / Google Security Operations, YARA, FLARE-VM, capa, Google telemetry (Gmail, Chrome Safe Browsing, Android Play Protect).

Limitations:

• Product-vs-research blur. Public reports mix commercial positioning with actual methodology.
• Confidence is explicitly graded. Mandiant does not claim 100% attribution.
• VirusTotal dataset bias. VT submissions skew Western; actors who avoid AV and submission to VT are under-represented.
• Acquisition friction. Pre-2022 Mandiant publications (Equation Group, APT1, FIN7) were produced when Mandiant was independent; post-acquisition work is integrated with Google telemetry.

CrowdStrike

Briefing: Endpoint protection + threat intelligence company famous for the adversary naming convention where every tracked actor gets a name composed of an animal + a weather/event term: BEAR (Russia), PANDA (China), SPIDER (eCrime), KITTEN (Iran), CHOLLIMA (North Korea), HAWK (India). CrowdStrike's methodology is centred on Falcon endpoint telemetry + analyst cells.

Landmark public cases:

1. DNC hack (2016). CrowdStrike attributed the breach to FANCY BEAR (APT28) and COZY BEAR (APT29).
2. Fancy Bear Ukrainian artillery (2016). https://www.crowdstrike.com/blog/bears-midst-intrusion-disclosure/
3. Global Threat Report (annual). https://www.crowdstrike.com/en-us/global-threat-report/

Public 10-step attribution methodology:

1. Falcon telemetry ingestion — endpoint sensors collect process, network, file, registry events.
2. ML + analyst cells triage — machine learning flags suspicious patterns; human analysts review.
3. Activity clustering — group observed activity into clusters based on shared TTPs.
4. Geopolitical overlay — apply country attribution based on victimology, language indicators, working hours.
5. Adversary naming — assign a new name (BEAR/PANDA/SPIDER/KITTEN/CHOLLIMA/HAWK + suffix).
6. Peer review — other analysts challenge the attribution.
7. Independent verification policy — CrowdStrike publishes enough detail for independent verification.
8. Publish adversary profile — full TTPs, IOCs, MITRE ATT&CK mapping.
9. Update detection content — Falcon platform updated to detect the new adversary.
10. Adversary Universe — public web page documenting all tracked adversaries. https://www.crowdstrike.com/en-us/adversaries/

Limitations:

• Endpoint bias — CrowdStrike's visibility is endpoint-centric; network-only attacks may be missed.
• Marketing of "Adversary Universe" — branding on real process; the methodology is real but the public site is partly marketing.
• Naming complexity — same actor = FANCY BEAR / APT28 / Forest Blizzard / Strontium / Sofacy / Pawn Storm / Sednit. The 2025 Microsoft-CrowdStrike shared glossary (https://www.crowdstrike.com/blog/crowdstrike-microsoft-naming-glossary/) is an attempt to harmonise.

Recorded Future

Briefing: Threat intelligence platform using NLP + machine learning over OSINT masivo. The Insikt Group is the research arm. Markets the "centaur model" (human + AI) and the "Intelligence Graph®" (trademarked marketing terms wrapping real methodology).

Landmark public cases:

1. Insikt Group research portal — https://www.recordedfuture.com/research
2. Iran AI report — Recorded Future's research on Iranian AI capabilities.
3. CopyCop disinformation — analysis of an AI-generated disinformation network.

Public 4-pillar methodology (per Insikt Group's published description):

1. Infrastructure detection and pivoting — auto-detection of malicious infrastructure, pivot to related domains/IPs.
2. Victim identification — automatic identification of victims from breach reports, dark web posts.
3. Network traffic analysis — analyse C2 traffic patterns.
4. Multi-source validation — the centaur model: AI proposes, human analyst verifies.

Output formats: 7 standard formats — Intelligence Brief, Full Report, Flash Report, Special Report, Cyber Daily newsletter, Weekly Cyber Exploits, Monthly Threat Forecast.

Limitations:

• Enterprise pricing ($$$) — Recorded Future platform is enterprise-priced. Recommend the free Community Edition only as a teaser, not a working tool.
• "Centaur model" and "Intelligence Graph®" are trademarked marketing terms wrapping real methodology.
• AI bias — NLP models can amplify biased sources if training data skews Western.

47.2 Tier 2 Vendors

Google Threat Intelligence (GTI / ex-Mandiant + VirusTotal)

Briefing: Unified commercial brand launched April 2024 after folding together Chronicle (cloud-native SIEM, 2018), VirusTotal (acquired by Google in 2012, >2 billion analysed files/URLs/domains/IPs) and Mandiant (acquired September 2022). GTI's research methodology is essentially Mandiant's methodology — IR-led threat-actor clustering using the UNC taxonomy.

Public emblematic cases:

1. SolarWinds / UNC2452 → APT29 — https://cloud.google.com/blog/topics/threat-intelligence/unc2452-merged-into-apt29
2. M-Trends 2025 — https://services.google.com/fh/files/misc/m-trends-2025-en.pdf
3. APT groups catalogue — https://cloud.google.com/security/resources/insights/apt-groups
4. Suspected Attribution API — https://gtidocs.virustotal.com/docs/suspected-attribution

Methodology: Same as Mandiant (see above) + Google's corpus (VT + Gmail + Chrome + Android telemetry) as the corroborating evidence base.

Useful public resources:

Resource	URL
Google Cloud TI blog	https://cloud.google.com/blog/topics/threat-intelligence
M-Trends 2025 PDF	https://services.google.com/fh/files/misc/m-trends-2025-en.pdf
APT groups catalogue	https://cloud.google.com/security/resources/insights/apt-groups
GTI documentation portal	https://gtidocs.virustotal.com/
VirusTotal (free)	https://www.virustotal.com/
Mandiant GitHub (open-source tools)	https://github.com/mandiant

Microsoft Threat Intelligence (MSTIC)

Briefing: In-house research team that tracks nation-state and criminal actors across Microsoft's vast telemetry surface — Windows, Office 365 email, Azure, Microsoft Defender for Endpoint, LinkedIn, Bing and Xbox. According to the 2024 Microsoft Digital Defense Report, MSTIC observes ~600 million cyberattacks per day.

Adversary naming convention (2 eras):

• 2015-April 2023: Chemical elements (typosquatted) — Strontium (APT28), Nobelium (APT29), Zinc, Chromium, Thallium, Hafnium, Phosphorus, Bismuth. Microsoft deliberately misspelled real chemical element names so they could register matching domains/handles without impersonating the real-element websites.
• April 2023-present: Weather taxonomy — Russian actors = * Blizzard, Chinese = * Typhoon, Iranian = * Sandstorm, Lebanese = * Rain, North Korean = * Sleet, Indian = * Hawk. Replaced the element scheme for clarity.

Public emblematic cases:

1. SolarWinds / NOBELIUM / APT29 (2020-2021) — MSTIC was the first to publicly name the actor.
2. Volt Typhoon (2023) — Chinese critical-infrastructure targeting disclosure.
3. Forest Blizzard / APT28 (2024) — Russian military intelligence.
4. Microsoft Digital Defense Report 2024 — https://www.microsoft.com/en-us/security/business/microsoft-digital-defense-report-2024
5. MS-CrowdStrike shared naming glossary (2025) — https://www.crowdstrike.com/blog/crowdstrike-microsoft-naming-glossary/

Public 12-step workflow (reconstructed from MSTIC blog posts):

1. Telemetry ingestion from Windows, O365, Azure, Defender, LinkedIn, Bing, Xbox.
2. ML + analyst triage — anomaly detection, then human review.
3. MITRE ATT&CK mapping — map observed TTPs to ATT&CK techniques.
4. Country assessment — based on victimology, language, working hours, infrastructure.
5. Weather naming — assign a name based on country of origin + weather phenomenon.
6. Government coordination — MSTIC frequently discloses nation-state activity in coordination with US government (CISA, FBI).
7. Publish technical blog post with IOCs, YARA, detection queries.
8. Update Defender detections — push detection content to Defender for Endpoint customers.
9. Brief government partners — CISA, NSA, FBI.
10. Publish Digital Defense Report — annual public summary.
11. Update threat actor encyclopedia — https://learn.microsoft.com/en-us/defender/threat-intelligence/.
12. Re-evaluate periodically — splits/merges as evidence accumulates.

Limitations:

• Naming churn — chemical→weather (April 2023) caused industry confusion.
• US-gov alignment appearance — MSTIC's nation-state disclosures often align with US foreign policy; this is correlation (shared goals) but critics see it as politicisation.
• Marketing vs research blur — Digital Defense Report mixes commercial positioning with actual research.

Useful public resources:

Resource	URL
Microsoft Security blog	https://www.microsoft.com/en-us/security/blog
Digital Defense Report 2024	https://www.microsoft.com/en-us/security/business/microsoft-digital-defense-report-2024
MSTIC threat actor encyclopedia	https://learn.microsoft.com/en-us/defender/threat-intelligence/
MSRC (Microsoft Security Response Center)	https://msrc.microsoft.com/

Cisco Talos

Briefing: Cisco's threat intelligence team. Specialises in malware analysis, threat hunting, and network intelligence. Publishes daily blog posts and an annual Year in Review.

Public emblematic cases:

1. Cisco Talos 2025 Year in Review — https://blog.talosintelligence.com/
2. Threat Hunting programme — public methodology posts.
3. GhIDA — Ghidra + IDA Pro integration tool (open source).
4. LLM-as-RE-sidekick — research on using LLMs in reverse engineering.
5. Cisco Live BRKSEC-2884 — public threat-hunting training.

Public 12-step workflow (reconstructed from Talos blog posts):

1. Sample intake — from Cisco Secure endpoints, customer IR engagements, VirusTotal, spam traps.
2. Static triage — hash check, strings, imports, sections.
3. Sandbox detonation — ThreatGrid (Cisco's sandbox) analysis.
4. Umbrella network pivot — use Cisco Umbrella DNS data to find related domains/IPs.
5. IDA Pro + Ghidra RE — deep reverse engineering with GhIDA integration.
6. Behavioural analysis — dynamic analysis in VM, API call tracing.
7. Snort/ClamAV signature creation — write detection rules.
8. Threat brief publication — blog post at blog.talosintelligence.com.
9. Year in Review — annual summary report.
10. Customer push — push detections to Cisco Secure customers.
11. Open-source tool release — tools like GhIDA published to GitHub.
12. Re-evaluate periodically — track malware family evolution.

Limitations:

• Network-edge bias — Talos visibility is network-centric (Cisco routers, firewalls); endpoint-only attacks may be under-represented.
• Commercial tie-ins — Talos reports often reference Cisco Secure products.

Useful public resources:

Resource	URL
Talos blog	https://blog.talosintelligence.com/
Talos Year in Review	https://blog.talosintelligence.com/year-in-review/
Talos GitHub	https://github.com/Cisco-Talos

Kaspersky GReAT (Global Research & Analysis Team)

Briefing: Kaspersky's elite research team responsible for tracking the most sophisticated APTs (Stuxnet, Flame, Equation Group). Publishes on Securelist (https://securelist.com).

Public emblematic cases:

1. Stuxnet (2010) — analysis of the first cyber-physical weapon. https://securelist.com/stuxnet-and-zero-days/36407/
2. Flame (2012) — discovery of a sophisticated espionage toolkit. https://securelist.com/flame-mystery-auto-update-component/33051/
3. Gauss (2012) — discovery of nation-state banking malware. https://securelist.com/gauss-nation-state-cyber-espionage-banking-trojan/36620/
4. Equation Group (2015) — Q&A PDF documenting the most sophisticated APT group yet discovered. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/Equation_group_questions_and_answers.pdf
5. Securelist RE workshop — public training materials.

Public 12-step workflow (reconstructed from Securelist publications):

1. KSN (Kaspersky Security Network) telemetry — telemetry from Kaspersky endpoint products worldwide.
2. Victimology analysis — identify targeted victims, geographic and sectoral patterns.
3. Static analysis — hash, strings, imports, sections.
4. Unpacking — multi-stage unpacking for packed malware.
5. Behavioural analysis — dynamic analysis in sandbox.
6. IDA Pro / Binary Ninja / Ghidra RE — deep reverse engineering.
7. Decompilation — high-level reconstruction of malware logic.
8. C2 protocol analysis — reverse-engineer command-and-control protocol.
9. Capability analysis — identify exploit payloads, lateral movement tools, persistence mechanisms.
10. Clustering — group malware samples into families based on code/infrastructure overlap.
11. Cautious attribution — Kaspersky is more conservative than US vendors in naming specific countries; uses "actor X" or "the malware's authors" rather than direct nation-state attribution.
12. Securelist publication — detailed technical blog post with IOCs, YARA, source code samples.

Limitations & controversies:

• US bans (2017 + 2024): DHS banned Kaspersky products from US federal networks in 2017 (BND 2017-138). BIS (Bureau of Industry and Security) extended the ban to all US consumer and commercial sales in 2024. URL: https://www.bis.doc.gov/index.php/documents/bis-newsroom/press-releases/2024-kaspersky-lab-final-determination-62624/file.
• Kaspersky's denial: Company has consistently denied improper ties to Russian intelligence. NPR interview: https://www.npr.org/2024/06/20/nx-s1-5013739/biden-administration-bans-kaspersky-lab-antivirus-software-citing-russian-ties
• Global Transparency Initiative (GTI): Kaspersky launched the GTI in 2018 to address trust concerns: moved data processing to Zurich (2018), opened Transparency Centers in multiple countries (https://gti.kaspersky.com). URL: https://www.kaspersky.com/transparency-center
• Bias check: Despite governance concerns, Kaspersky's technical research quality is widely respected. Mandiant, CrowdStrike and other Western vendors continue to cite Kaspersky research in their own publications. The technical research and the governance/jurisdiction risk are separate issues — investigators should evaluate the technical content on its merits while being aware of the geopolitical context.

Useful public resources:

Resource	URL
Securelist (Kaspersky blog)	https://securelist.com
Kaspersky threat intelligence	https://www.kaspersky.com/enterprise-security/threat-intelligence
Kaspersky GTI	https://gti.kaspersky.com
Kaspersky GitHub (open-source tools)	https://github.com/kaspersky

47.3 Cross-Vendor Comparison

Dimension	Bellingcat	Mandiant/GTI	CrowdStrike	Recorded Future	MSTIC	Talos	Kaspersky
Primary discipline	Visual GEOINT	IR-led threat intel	Endpoint telemetry	NLP on OSINT	Telemetry	Network + malware	RE + malware
Attribution method	Public cross-ref	UNC clustering	Adversary naming	Centaur model	Weather naming	Sample clustering	Cautious, country-agnostic
Naming system	None	APT##/FIN##/UNC##	BEAR/PANDA/SPIDER	None (uses others')	Weather (was chemical)	None	None (uses others')
Reproducibility	High (workflow published)	Low (needs platform)	Low (needs Falcon)	Low (needs platform)	Low (needs telemetry)	Medium	Medium
Geographic bias	Russia/Syria/Ukraine strong; China/NK/Iran weak	Strong Western	Strong Western	Strong Western	Strong Western	Strong Western	Strong Russia/Asia
Free tier	All toolkit free	VirusTotal free	Adversary Hub free	Community Edition (limited)	Threat encyclopedia free	Blog free	Securelist free
Government alignment	None (NGO)	US-aligned (post-acquisition)	US-aligned	US-aligned	US-aligned	US-aligned	Russian (controversial)

---