Requirements

Underground Monitoring & Collection

• Identify and infiltrate dark web marketplaces, forums, and closed channels (Telegram, IRC, Discord, etc.).
• Track threat actors’ chatter related to exploits, malware, credentials, and attack tools.
• Conduct HUMINT-style engagement when permissible and safe.

Threat Data Harvesting

• Extract and validate IOCs (hashes, domains, wallet addresses, C2 servers).
• Correlate underground findings with OSINT, malware telemetry, and CTI feeds.
• Provide early warning on data leaks, ransomware negotiations, and credential dumps.

Collaboration with CTI & AI Teams

• Feed structured underground intelligence into the CTI platform for enrichment and scoring.
• Partner with ML engineers to train NLP models for dark web text mining.
• Work with TI analysts to transform raw chatter into tactical and ...