Cyber Threat Intelligence (CTI) has always played a pivotal role in proactive cybersecurity. However, with the emergence of Large Language Models (LLMs), generating and disseminating false or misleading CTI has never been easier. Existing research has found that fabricated CTIs could successfully evade cybersecurity professionals, but there is a notable gap in detecting fabricated CTIs. This paper addresses how LLM-based approaches can serve as a powerful tool for validating the authenticity of reported threats. We propose a framework for evaluating text-based intelligence through a structured ranking of sources, automated keyword extraction, and a final AIbased analysis that yields a probability score to identify potential misinformation. Our evaluation using 150 CTI reports (authentic, LLM-generated, and hybrid) demonstrates strong classification performance with an overall F1-score of 0.88, achieving particularly high accuracy for completely fabricated reports while identifying partially manipulated content with moderate success. Beyond technical validation, VeraCTI serves as an educational platform for cybersecurity practitioners through its transparent, step-by-step analysis process, which can be deployed in Security Operations Centres (SOCs) to simultaneously enhance threat verification capabilities and develop analysts' critical assessment skills. By operating on the principle that ”all information is false until proven”, VeraCTI addresses a critical gap in current CTI validation approaches and demonstrates how AI systems can be leveraged responsibly to counter AI-generated misinformation.
Cyber Threat Intelligence (CTI) plays an increasingly pivotal role in modern cybersecurity, providing the
necessary foresight for organisations to anticipate, identify, and mitigate sophisticated cyber threats [
The core problem this paper addresses is the capability of LLMs to generate convincing, yet potentially
fabricated or misleading CTI [
This challenge necessitates robust validation mechanisms capable of discerning authentic intelligence from LLM-generated fabrications. While traditional methods of CTI validation often rely on structured
Indicators of Compromise (IoCs) and cross-referencing with established repositories, they struggle
with the nuance and volume of unstructured, text-based intelligence, especially when its authenticity
is questionable from the start [
In this paper, we propose that LLMs themselves, when guided appropriately, can be instrumental in validating CTI. By leveraging their advanced natural language understanding and reasoning capabilities, LLMs can assist practitioners in assessing the credibility of threat reports, identifying inconsistencies, and flagging potential misinformation. This requires a structured approach. Simply asking an LLM whether a report is "true" is insuficient. Our work introduces VeraCTI (the name stems from a combination of two words, veracity and CTI), a framework, an educational tool, and a methodology designed to systematically evaluate text-based CTI. It employs a methodology incorporating source reliability ranking, targeted keyword extraction for semantic analysis, and an LLM-based reasoning component to produce a probabilistic score indicating the likelihood of a report being fallacious or trustworthy. This approach assumes "all information is false until proven," promoting a critical mindset essential in the current threat landscape.
Addressing the challenge of fabricated CTI also requires an educational dimension. Cybersecurity
practitioners, from novices to experienced analysts, must be trained to critically evaluate AI-driven
intelligence, understand the limitations of LLMs, and efectively utilise validation tools [
The remainder of this paper is organised as follows. Section 2 reviews the existing work on LLMs in CTI and on validation approaches. Section 3 details the proposed VeraCTI framework for LLM-driven verification of CTI. Section 4 describes the implementation details. Section 5 presents preliminary results of the testing and evaluation. In Section 6, we discuss the way this tool can be integrated in education and organisations. Finally, Section 7 concludes the paper and outlines avenues for future research.
The integration of AI, particularly LLMs, into cybersecurity represents a rapidly evolving research
frontier [
CTI is fundamental to proactive cybersecurity, involving the collection, analysis, and dissemination
of information about cyber threats [
Several studies have focused on leveraging LLMs for extracting structured information from
unstructured CTI sources. For instance, LLMs have been employed to identify and extract Tactics, Techniques,
and Procedures (TTPs) and other cyber-related entities [
Domain-specific models like SecureBERT [
While the ability of LLMs to process and generate CTI ofers significant advantages, it concurrently
introduces a critical vulnerability: the potential for generating and disseminating fake or misleading
intelligence [21]. Malicious actors can exploit the same generative capabilities to craft convincing but
false threat reports, aiming to poison datasets used for training AI-based defence systems or to mislead
human analysts and automated tools [
The generation of fake CTI using fine-tuned transformer models like GPT-2 has already been
demonstrated, with studies showing that such fabricated intel can be highly convincing, even to experienced
cybersecurity professionals [
Given the risks associated with fake CTI, validating the authenticity and credibility of intelligence is
paramount. Traditional CTI quality assessment has often focused on the reputation or trustworthiness
of the source [24], or on the consistency of structured data [
Existing work on CTI credibility often relies on metadata or simple examining. For example, Tundis
et al. [24] proposed a feature-driven method to assess OSINT source relevance on Twitter but did not
focus on content veracity. Yang et al. [
Start
Text Input File Input URL Input
AbuseIPDP
VeraCTI is structured as a modular, event-driven pipeline that processes diverse inputs (text, files, URLs), enriches them with external threat intelligence, and generates a quantitative assessment of the likelihood that the provided CTI is misleading or potentially inaccurate (rather than purely false). Figure 1 provides an overview of the entire pipeline, beginning with front-end collection and culminating in a comprehensive threat intelligence report.
The architecture is divided into three main layers: • First, the data ingestion layer receives raw CTI from various sources and ensures input quality. • Second, the analysis and correlation layer employs natural language processing (NLP) for keyphrase extraction, identifying potential IoCs and Common Vulnerabilities and Exposures (CVEs), and correlating the claims with external threat feeds. • Third, the aggregation and reporting layer computes a final probability score, indicating the rationale behind that score, and generates a user-friendly, structured report.
Internally, VeraCTI uses a combination of synchronous and asynchronous pipelines. Certain tasks, such as normalising textual data, must be performed in a strictly ordered manner. Other operations, such as IoC enrichment from external APIs, can run in parallel, improving eficiency when dealing with multiple indicators. Each module is designed to be stateless: after receiving normalised inputs and performing its assigned task, it outputs well-defined data structures to the subsequent module.
Data Ingestion Layer
Analysis & Correlation Layer
VeraCTI enforces a rigorous input validation process to ensure that any data entering the system is both properly formatted and has passed an initial credibility check. For textual submissions, VeraCTI imposes token limits that keep LLM-driven analysis computationally feasible. Files, most commonly PDFs, are parsed using extraction libraries (pdfminer.six)[? ] to convert them into plain text. If the parser detects incomplete or corrupted content, the system flags the submission for additional scrutiny.
Key Phrase Extraction
Semantic Query for Related Sources
Extract Article
Content
Corelation Analysis IoCs & CVEs Extraction
IoCs & CVEs
Enrichment
Aggregation and Reporting Layer Source Credibility
Assessment
Fallacious Probability
Assessment
Threat Report Generation
End Threat Intelligence Enrichment Sources
Search Function
Data Analysis Frameworks
URLs undergo a separate validation process wherein VeraCTI queries domain-reputation services such as urlscan.io[? ]. If the domain is assessed as malicious or high-risk, the system includes this low-trust signal in subsequent correlation tasks. VeraCTI then fetches the HTML content of the URL, stripping it to text via BeautifulSoup[? ], and incorporating relevant metadata such as HTTP response codes. Through each of these methods, the data ingestion layer produces a coherent block of text accompanied by metadata (including source reputation, domain trust scores, and file integrity checks) for downstream analysis.
Key Phrase Extraction Once data is validated and the text is normalised, VeraCTI applies NLP techniques to identify key concepts within the report. This involves an LLM or a transformer-based pipeline that scans for domain names, threat actor handles, and references to known vulnerabilities or malicious campaigns. By extracting not only direct IoCs but also contextual entities (e.g. mention of a campaign name or a technique like "credential stufing"), the system builds a richer picture of the underlying intelligence.
Semantic Query for Related Sources VeraCTI performs a semantic query of external articles or threat feeds that might corroborate or contradict the extracted key phrases. This step helps the system compare the CTI content against existing records, increasing confidence in valid claims and reducing the risk of overlooked inconsistencies.
IoC & CVE Extraction and Enrichment After key phrase extraction, the system specifically focuses on identifying Indicators of Compromise (IoCs) such as IP addresses, URLs, file hashes, and CVE identifiers. VeraCTI re-fangs obfuscated addresses (e.g. hxxp:// to http://), ensuring the extracted IoCs are in a standard format. It then queries external threat intelligence feeds, including VirusTotal[? ] or AbuseIPDB[? ], to gather reputation data and historical activity. If the text claims an IP address is part of a widespread phishing campaign and VirusTotal corroborates it with multiple malicious detections, VeraCTI increases its confidence in that portion of the intelligence.
Conversely, if external databases record an IoC as benign or do not recognise it at all, the system raises a flag indicating a possible inconsistency. Multiple signals from distinct sources reinforce or dispute the authenticity of the reported IoC. In this way, VeraCTI combines textual coherence with real-world data about previously observed malicious or benign activity, lending a structured perspective to each piece of intelligence provided.
VeraCTI concludes its analysis by computing a probability score that represents the likelihood a CTI report is misleading, partially false, or entirely fabricated. Each factor—including source credibility, IoC reputation, external corroboration, and text consistency—contributes to this final score through a weighted scheme. The weighting can be adapted to suit specific organisational needs, such as prioritising the trust signals from certain authoritative repositories.
The system outputs these results in a structured JSON object, providing both a numeric estimate (e.g. 0–100% fallaciousness probability) and an explanatory breakdown. This transparency benefits both automated workflows, which can quickly parse numeric thresholds, and human analysts, who can review the salient points leading to VeraCTI’s classification. By separating the final score from the evidence, the system also facilitates educational use, illustrating exactly which elements are suspicious or well-supported.
An automated pipeline is implemented within the VeraCTI application to analyse CTI inputs, assess their potential fallaciousness, and generate a comprehensive analysis report. The system processes CTI provided via direct text entry, file upload, or URL submission, employing a multi-stage approach involving AI-driven analysis, external data enrichment, and structured reporting.
Leave it to VeraCTI VeraCTI is an AI agent that helps detect fabricated or misleading cyber threat inteligence. It doesn't just think, it delivers results. Veraciti excels at analyzing and verifying cyber threats, keeping your systems secure while you rest.
Analyze Cyber Threat Intelligence
Text File URL "
Paste your threat inteligence text here...
FromVeraCTI
Analyze
How does Veraciti detect fake threat intelligence? The pipeline initiates by receiving CTI through one of the designated frontend channels. Pre-processing
What file formats does Veraciti support? steps normalise the input for consistent analysis:
How accurate is Veraciti's analysis? Text Input: User-submitted raw text (up to a practical limit, e.g. ~65,000 tokens, with a maximum of
Can Veraciti integrate with my existing security tools? 1 million tokens) is directly relayed to the primary text analysis engine. No significant pre-processing occurs at this stage beyond basic validation in the API route.
File Input: The file is validated and temporarily saved, using a UUIDv4-based filename. The script then uses the pdfminer.six library’s extract_text() function to retrieve the full text content. Error whaitnhdilnintgheisApPreIsreonuttefoarffilteerI/pOroacnetV©Vdhseae2rta0srhc2eeiat5ilip,cVxdsnieedtrraeiitvgcteeirtcditAfafrIcaokmceo'cvtyebmrieacroitthypr'nematelianeniteinsltgigtseeruntcushe,.iseoansAr.IagfTenathiles.tFCCeeooenmdmtabpcaatcnukpysoraPTRererirvsmaoycsuyorpcfoesifllesicervyiceis deleted in a finally block
URL Input: Basic validation (for instance, requiring the scheme be http:// or https://) occurs ifrst. The script then orchestrates source credibility check and content extraction. In source credibility check, the connector module’s url_scan_details() function queries the urlscan.io API for domain reputation, scan results, and potential malicious verdicts. This provides an initial trust assessment of the source URL itself. In content extraction the connector’s extract_text_from_url() function fetches the URL’s HTML content using requests[? ] and parses the main textual body via BeautifulSoup, stripping HTML tags to provide clean text for analysis. Timeout and connection error handling are included.
With the CTI text extracted, a sequence of approximately 4–5 distinct Declarative Self-improving Python DSPy [? ] agents perform deeper analysis. These agents leverage an LLM configured within the programme (e.g., Gemini[? ], temperature=1.0, max_tokens=65536, cache=true), utilising dspy.ChainOfThought() for reasoning.
Key Phrase Identification: The CategoriesKeywords() agent identifies and extracts up to 10 core thematic sentences or key phrases from the input CTI text. It uses the KeywordCategories Pydantic model for structured output ({"extracted_categories": ["sentence1", ...]}).
External Corroboration: The extracted key phrases serve as queries for the connector’s search_web_for_related() function. This function (leveraging the configured dedicated search API) seeks external articles or reports online that could corroborate or contradict the input CTI. It returns a list of relevant URLs.
Relevance Evaluation: For each relevant external URL found, its content is extracted (similar to URL input processing). The RelevanceCheck() agent then compares the original CTI text against the external article’s content. It outputs a structured dictionary (Result Pydantic model) detailing matches in IoCs/CVEs, contextual text similarity, reasoning for the match, and an overall relevance score (e.g., on a 1–10 scale).
Extraction: The IOCExtraction() agent parses the input CTI text, specifically targeting IoC patterns. It aims to extract only indicators deemed relevant within the threat intelligence context, avoiding generic examples. Output uses the Extract_IoCs Pydantic model ({"ip_addresses": [...], "urls": [...], ...}). Defanged indicators (e.g., hxxp:// or 1.1.1[.]1) are re-fanged by the agent based on instructions.
Enrichment: The extracted IoCs are systematically queried against multiple external Threat Intelligence platforms using the Connector and API keys configured. Approximately five external services are potentially queried per relevant IoC type: • IPs: VirusTotal (Reputation, Votes, WHOIS), AbuseIPDB (Confidence Score, History). • Domains: VirusTotal (Reputation, Votes, WHOIS). • URLs: VirusTotal (Submission for Scan, Analysis Stats). • Hashes (SHA256, MD5, SHA1): Hybrid Analysis[? ] (Verdict, Threat Score, Associated Reports). • CVEs: National Vulnerability Database[? ] (Common Vulnerability Scoring System (CVSS) Score,
Description, References).
Each query returns structured data about the indicator’s reputation, known associations, and analysis results from the respective platform. Error handling for API requests (timeouts, connection errors, HTTP errors) is implemented.
The culmination of the pipeline involves aggregating all findings and generating a final assessment:
Data Aggregation: All intermediate results—initial source credibility checks (for URLs), web corroboration findings (relevance scores, summaries), and detailed IoC enrichment data—are collected.
Structured Report Generation: The Threat Intel Report() agent receives this aggregated data and synthesises the diverse inputs into a single, structured JSON output conforming to the pre-defined scheme. It populates fields for metadata, executive summary, source analysis, content corroboration, detailed enrichment analysis per IoC type, and crucially, the fallacious probability assessment.
Fallacious Probability Assessment: A dedicated section in the final report represents the system’s core judgement on the likelihood of the input CTI being misleading or fake. Conceptually, it follows: ︁( Fallacious Probability ≈ · SourceCredibility + · ContentCorroboration + · IoC Validity + · InternalConsistency ︁) (1) where the function maps these weighted factors to a final probability score ( e.g., “Low,” “Medium,” “High,” or 0–100) and explanatory reasoning, based on the following variables.
• SourceCredibility: Derived from urlscan.io results and domain reputation (0.0–1.0). • ContentCorroboration: Based on the number and relevance scores (e.g., avg. score 1–10) of external matching articles found. • IoC Validity: Reflects the proportion and severity of IoCs flagged as malicious by enrichment services (e.g., VirusTotal malicious votes > 5, AbuseIPDB score > 75). • InternalConsistency: Assessed by the LLM for logical coherence within the CTI text itself. • , , ,
: Weighting factors implicitly determined by the LLM based on the specified instructions.
To evaluate VeraCTI’s efectiveness, we constructed a balanced dataset comprising three distinct categories of CTI reports:
Authentic CTI (n=50): We collected genuine threat intelligence reports from authoritative sources including oficial Computer Emergency Response Team (CERT) advisories, vendor security bulletins, and established threat intelligence platforms. These reports were manually verified to ensure accuracy and relevance.
LLM-Generated Synthetic CTI (n=50): Using both GPT-4 and Gemini-Pro models, we generated fabricated threat intelligence reports. These were crafted with varying levels of sophistication, from simple fabrications to complex reports incorporating legitimate IoCs in misleading contexts. We used prompts designed to create plausible but false narratives about non-existent threats, vulnerability exploitation, or threat actor campaigns.
Hybrid CTI (n=50): We created partially modified authentic reports by manually altering key details while maintaining overall structure and context. Modifications included replacing legitimate IoCs with benign ones, exaggerating severity levels, or introducing inconsistencies in technical details while preserving the narrative flow of genuine reports.
Each dataset entry was anonymised and assigned a unique identifier to eliminate bias during evaluation. The distribution of content types (text-only, file, URL) was maintained consistently across all three categories to ensure evaluation fairness.
In this paper, we focus on the evaluation of classification accuracy by precision, recall and F1-Score. Precision measures how many of the items labelled as a certain class are truly in that class. Formally, it is the ratio of correctly predicted positive observations to the total predicted positive observations:
True Positives Precision =
True Positives + False Positives
In the context of this evaluation, True Positives can be defined as CTI reports correctly classified as either factual or fallacious, while False Positives are reports that have been incorrectly classified (e.g., a fabricated report misclassified as factual). The precision value thus represents the reliability of the classifications made by VeraCTI.
Recall is defined as the proportion of items that truly belong to a class and are correctly identified: (2) Recall =
True Positives
True Positives + False Negatives
False Negatives are represented by reports that have not been correctly identified by the system (e.g., a fallacious report not flagged as such). The recall value therefore indicates the comprehensiveness of the system in identifying all instances of a particular class.
The F1-score is calculated as the harmonic mean of precision and recall:
Precision × Recall
F1-Score = 2 × Precision + Recall
It balances precision and recall into a single number, especially useful when both metrics need to be weighed equally. If precision and recall difer significantly, the F1-score provides a combined measure that diminishes the efect of extremely high precision or recall alone. It’s especially insightful in cases where a single metric is needed to convey the overall efectiveness of the model. (3) (4)
Beyond improving defensive capabilities in real-world cybersecurity settings, VeraCTI also serves as an educational platform (see Figure 2 and Figure 3). Universities and training programmes can incorporate VeraCTI into hands-on labs, where students learn how to validate and interpret threat reports generated by LLMs. By examining step-by-step probability scoring, novices gain an appreciation for the complexities of CTI credibility assessment, including the significance of IoC corroboration, domain reputation, and internal consistency. Because the tool’s reasoning engine presents clear explanations for each flagged inconsistency or match, instructors can use these outputs to highlight best practices in threat hunting and intelligence sharing.
In operational settings, Security Operations Centres (SOCs) can integrate VeraCTI into their threat intelligence workflows as a validation layer for incoming CTI. This serves both to verify threats and train analysts through clear explanations of the verification process. SOC teams can tailor the system by adjusting confidence thresholds and adding specialised data feeds relevant to their security concerns. This practical deployment helps develop analysts’ critical thinking skills while strengthening organisational defences against emerging threats. Moreover, VeraCTI can be configured for automated scanning of incoming threat feeds, reducing analyst workload and accelerating response times for validated threats. Organisations also benefit from reduced operational costs by minimising time spent investigating false positives, while the standardised validation methodology improves communication between incident response, threat hunting, and executive teams who rely on consistent CTI evaluation criteria.
Back to Analysis Fal acious Probability: Very Low Confidence: 95%
Executive Summary Investigative Summary Fal acious Probability Detection Analysis - CVE-2023-50164 Apache Struts 2 RCE • 2025-04-10 14:42:24
This report assesses the fal acious probability of threat intel igence regarding CVE-2023-50164, a critical remote code execution (RCE) vulnerability in Apache Struts 2. The analysis indicates a very low probability of the intel igence being fal acious due to strong corroboration from reputable sources and consistent technical details.
Overall Conclusion The threat intel igence regarding CVE-2023-50164 is highly likely to be accurate and should be treated as a legitimate threat.
Fallacious Probability Assessment Analysis of how likely the threat intel igence is to be false or misleading Source Assessment Content Assessment The sources are reputable cybersecurity websites and vulnerability databases.
The content is strongly corroborated by multiple independent sources.
Technical Details Assessment The technical details are consistent with a known vulnerability (CVE-2023-50164).
Motivation Assessment There is no apparent motivation to fabricate this threat intel igence.
Reasoning Source Credibility Analysis Evaluation of the sources reliability Source URL Multiple (see corroborating sources) Source Reputation Conclusion High - Reputable cybersecurity websites and vulnerability databases The sources used for corroboration are highly credible.
Given the high degree of corroboration from reputable sources, the consistency of technical details with known vulnerabilities, and the lack of any apparent motivation to fabricate the information, the overal probability of this threat intel igence being fal acious is extremely low. The threat intel igence is almost certainly legitimate. The reasoning behind the high confidence is as fol ows: 1. **Strong Corroboration:** Multiple reputable sources (Apache, Sonatype, Help Net Security, Openwal , Cybersecurity Dive) independently confirm the existence and nature of the CVE-2023-50164 vulnerability. 2. **Consistent Technical Details:** Al sources provide consistent descriptions of the vulnerability as related to file upload logic, path traversal, and potential RCE in Apache Struts 2. 3. **CVE Enrichment:** The automated CVE enrichment process confirms the validity of CVE-2023-50164, its severity (CRITICAL), and provides links to authoritative references. 4. **Active Exploitation Reports:** Several sources mention active exploitation attempts of the vulnerability, further validating its reality and potential impact. 5. **No Apparent Motive for Fabrication:** There is no indication that the information is being spread with malicious intent, disinformation, or any other agenda. 6. **Source Reputation:** The sources used are wel -established and respected within the cybersecurity community. 7. **Specific Vulnerability Details:** The reports reference specific details such as affected software versions and mitigation recommendations, which contribute to a higher degree of confidence in the intel igence.
Source Domain Multiple (apache.org, sonatype.com, helpnetsecurity.com, openwal .com, cybersecuritydive.com) Hosting Infrastructure Not applicable and detailed cVoerirficratioon bof the intel igence tnhrouagh nothear sloyurcsesis for a given oratio
CTI report.
Core Intel igence Summary Corroborating Sources Apache Struts 2 Wiki (Official Documentation) https://cwiki.apache.org/confluence/display/WW/S2-067 Match score: 9/10
A critical RCE vulnerability (CVE-2023-50164) exists in Apache Struts 2 related to file upload logic and path traversal. 7. ConcluDesscriibeosa fnileuploaad longic fdlaw leaFding uto ptath utravrersealand WRCE(simoilar rto kthe described vulnerability, although referring to S2-067).
This paper
Sonatype Blog (Security Blog) https://www.sonatype.com/blog/cve-2024-53677-a-critical-file-upload-vulnerability-in-apache-struts2 p rMaotch pscoore: s9/1e0d VeraCTI, a framework designed to evaluate the authenticity of CTI reports,
Explicitly discusses 'critical file-upload vulnerability in Apache Struts2', related to CVE-2024-53677 and building upon similar flaws in CVE-2023-50164. especially in light of AI-generated misinformation. By integrating source credibility checks, LLM-based
Help Net Security (Cybersecurity News) semantic analhyttps://www.helpneCtsecurity.ncom/2023/12/0m8/cvee-2n023-5016a4/ nd
sis, Io e rich t, Match score: 10/10
probability scoring, VeraCTI systematically determines whether
Mentions CVE-2023-50164 as a critical RCE vulnerability in Apache Struts 2. a given CTI report is likely to be deceptive or aligned with corroborated intelligence.
From an edhHutetplpsc:/N/awewttwS.eihceoulprninteyts(aeCcyulbriteyrs.csoetmcau/2r0int2y3N/d1e2/w1p4s/)pooc-iexnplotit-,cveV-202e3-r50a164C/TI ofers transparent, step-by-step insights, enabling students,
Match score: 10/10 researchers, aCnondfirmssaecticve uexprloiittatyion apttemrpots fofeCVsEs-20i2o3-n501a64l.s to validation. FutOpuenrwael (MdaielingvLiest)lopment https://www.openwal .com/lists/oss-security/2023/12/07/1
understand both the benefits and limitations of AI-based CTI will explore domain-specific fine-tuning of the LLMs involved, real-time integration wiMtatchhscoare: d10/d10 itional threat intelligence feeds, and further refinements to the probability-scoring
Details CVE-2023-50164 and its impact on Apache Struts 2. methodology. Through these enhancements, we hope to solidify VeraCTI’s role as both a powerful
Cybersecurity Dive (Cybersecurity News) validation enghttipsn://weww.caybnersedcuritaydivne.come/ndewsu/acctivea-etxpilooitatinon-aapalchec-storutsm-2-flapw/7a36n199/ion in the constantly evolving field of cybersecurity.
Match score: 9/10 Reports active exploitation of a critical Apache Struts 2 flaw.
Conclusion The threat intel igence is strongly corroborated by multiple independent and reputable sources.
CVE Analysis CVEs Identified
Conclusion
The author(s) have not employed any Generative AI tools. for cybersecurity, in: F. Li, K. Liang, Z. Lin, S. K. Katsikas (Eds.), Security and Privacy in Communication Networks, Springer Nature Switzerland, Cham, 2023, pp. 39–56. doi:10.1007/ 978-3-031-25538-0_3. [18] M. Bayer, P. Kuehn, R. Shanehsaz, C. Reuter, Cysecbert: A domain-adapted language model for the cybersecurity domain, ACM Trans. Priv. Secur. 27 (2024). doi:10.1145/3652594. [19] S. Mitra, S. Neupane, T. Chakraborty, S. Mittal, A. Piplai, M. Gaur, S. Rahimi, LOCALINTEL: Generating organizational threat intelligence from global and local cyber knowledge, 2025. arXiv:2401.10036. [20] X. Liu, J. Liang, Q. Yan, M. Ye, J. Jia, Z. Xi, Cyber defense reinvented: Large language models as threat intelligence copilots, 2025. arXiv:2502.20791. [21] Y. Yao, J. Duan, K. Xu, Y. Cai, Z. Sun, Y. Zhang, A survey on large language model (LLM) security and privacy: The good, the bad, and the ugly, High-Confidence Computing 4 (2024) 100211. doi:10.1016/j.hcc.2024.100211. [22] N. Khurana, S. Mittal, A. Piplai, A. Joshi, Preventing poisoning attacks on ai based threat intelligence systems, in: 2019 IEEE 29th International Workshop on Machine Learning for Signal Processing (MLSP), 2019, pp. 1–6. doi:10.1109/MLSP.2019.8918803. [23] Z. Song, Y. Tian, J. Zhang, Y. Hao, Generating Fake Cyber Threat Intelligence Using the GPT-Neo Model, in: 2023 8th International Conference on Intelligent Computing and Signal Processing (ICSP), IEEE Computer Society, Los Alamitos, CA, USA, 2023, pp. 920–924. doi:10.1109/ICSP58490.2023.10248596. [24] A. Tundis, S. Ruppert, M. Mühlhäuser, On the automated assessment of open-source cyber threat intelligence sources, in: V. V. Krzhizhanovskaya, G. Závodszky, M. H. Lees, J. J. Dongarra, P. M. A. Sloot, S. Brissos, J. Teixeira (Eds.), Computational Science – ICCS 2020, Springer International Publishing, Cham, 2020, pp. 453–467. doi:10.1007/978-3-030-50417-5_34.