0x622 - Teknik - CTI

Item: 0x622 - Teknik - CTI
Rating: 4
Author: PostSingularity Institute

Humanities, Social Sciences & Thought Computing & Cybersecurity UComputing and Information Technology URComputer security

🎙 Jordan Theodore 👥 540 📅 September 2, 2025 ⏱ 32 min 👁 33 📄 expert opinion 🧭 2026-08-17

Available in: English (current) Français

Keywords

CTIOSINTThreat IntelligenceInformation QualityTTP

Summary

In this episode of PolySécure Podcast, Jordan Theodore discusses the current challenges facing Cyber Threat Intelligence (CTI) analysts, particularly the degradation of open-source information quality. He defines CTI as actionable knowledge about adversaries and their malicious activities, including context and TTPs. The work of an analyst is organized around four types of intelligence: strategic, operational, technical, and tactical. The core issue is the proliferation of low-quality articles, exemplified by the Wine Grape Loader campaign (APT29) in April 2025, which generated over a hundred articles, most of which were copy-pastes of two primary sources (Checkpoint and Google). This ‘Russian doll’ effect makes it difficult to identify the original source. These publications lack technical indicators, operational details, and original analysis. This phenomenon even affects influential LinkedIn pages with over 30,000 followers. To cope, organizations are turning to paid CTI feeds (Intel 471, Sekoia, Mandiant) for quality, with only about 10% of public articles considered mature enough. The role of AI is ambivalent: it facilitates mass production of low-quality content but can also help filter noise when used properly. Nomenclature and attribution issues are also discussed, such as the use of fancy names like ‘Midnight Blizzard’ for APT29, which introduces geographic biases. Rapid and often erroneous attribution is a major problem, as seen with Lockbit, where the tool may have been purchased by actors unrelated to the original group. Jordan emphasizes the importance of focusing on TTPs rather than simple IOCs, as IPs have a short lifespan while techniques are more durable. The crisis is transforming the CTI analyst role, confirming that human expertise remains essential to distinguish signal from noise.

268 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information is high, providing a clear and structured overview of the current state of CTI, with a concrete case study (Wine Grape Loader) illustrating the problem of information quality. The argumentation is solid, based on the speaker’s professional experience and references to established frameworks like MITRE ATT&CK and the Pyramid of Pain. The discussion on the ambivalent role of AI and the shift towards paid feeds is well-reasoned. However, some claims are anecdotal and lack empirical evidence, such as the ‘10% maturity’ statistic.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate: the speaker cites specific sources (Checkpoint, Google, Intel 471, Sekoia, Mandiant) and mentions frameworks (MITRE ATT&CK, STIX/TAXII), but does not provide formal citations or links. The title ‘0x622 - Teknik - CTI’ is somewhat cryptic but accurately indicates a technical discussion on CTI. The content aligns well with the title, focusing on technical aspects of CTI analysis.

164 words

Title / Content Match

The title '0x622 - Teknik - CTI' is somewhat cryptic but accurately indicates a technical discussion on Cyber Threat Intelligence.

Quality & Reliability

7/10

The speaker is a CTI analyst with practical experience, providing a well-structured and insightful analysis of the current challenges in open-source intelligence. The discussion is grounded in a specific case study (Wine Grape Loader) and references established frameworks (MITRE ATT&CK, Pyramid of Pain). However, the lack of formal citations and the anecdotal nature of some claims limit the overall reliability.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Checkpoint Research — Mentioned as one of the primary sources for the Wine Grape Loader campaign.
Google Threat Analysis Group — Mentioned as another primary source for the campaign.
Intel 471 — Cited as a paid CTI feed provider.
Sekoia — Cited as a paid CTI feed provider.
Mandiant — Cited as a paid CTI feed provider.

Concurring Sources

SANS CTI Summit — The speaker mentions attending a SANS CTI course, which aligns with his expertise.

Contribution & Novelties

The video provides a timely and practical perspective on the degradation of open-source intelligence quality, a topic that is often discussed but rarely with concrete examples and professional insights. It highlights the ‘Russian doll’ effect in information recycling and the shift towards paid feeds, which is a significant trend. The discussion on the ambivalent role of AI is also valuable, offering both a warning and a potential solution.

Pour aller plus loin :

Pyramid of Pain — A framework for understanding the difficulty of changing different types of indicators.
MITRE ATT&CK — A knowledge base of adversary tactics and techniques.
STIX/TAXII — Standards for sharing threat intelligence.

107 words

Radar Profile

The radar profile shows high scores in information quality and technical level, reflecting the speaker's expertise and the depth of the discussion. The lower score in reliability is due to the lack of formal citations and anecdotal evidence. Overall, the profile indicates a valuable but not fully rigorous source.

Reliability 6/10