Loading story…
Georgia Tech researchers reported that the global threat intelligence (TI) data supply chain has systemic weaknesses that can be exploited or exacerbated by geopolitical pressure, potentially degrading defenders’ ability to detect and respond to threats. Their work, to be presented at the NDSS Symposium, frames the TI ecosystem as an interdependent network of TI platforms (e.g., VirusTotal, MalwareBazaar), antivirus vendors, and malware sandbox services, where inconsistent data quality, uneven participation, and concentrated “nexus” sharing relationships create bottlenecks and delays in intelligence propagation.
In experiments using benign but suspicious binaries shared with 30 security vendors, the researchers found that while many vendors performed sandboxing, far fewer shared resulting intelligence onward (reported as 67% conducting sandbox analysis vs 17% sharing derived TI), contributing to hours-to-days lag in dissemination and uneven coverage. The research also highlights risks from shallow analysis and shared research infrastructure that could aid adversary evasion, and it proposes a secure data provenance approach intended to improve trust and enable TI use regardless of origin country—while noting that the hardest problem is establishing legitimate transnational governance amid conflicting national mandates and rising tech-policy tensions (including reported moves that could restrict foreign security software over data-leakage concerns).
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
On publication of the research coverage, Georgia Tech researchers reported inconsistent data quality, limited sharing beyond IOCs, chokepoints created by a few nexus vendors, and delays of hours to days in threat intelligence dissemination. They also proposed a secure provenance system to improve trust and policy-compliant sharing across borders.
In research for a forthcoming NDSS Symposium paper, Georgia Tech researchers distributed benign but suspicious instrumented binaries to 30 security vendors to measure sandboxing, analysis depth, and how threat intelligence propagates across the ecosystem.
Georgia Tech researchers cite an apparent Chinese ban on certain US- and Israeli-made security software in January 2026 as evidence of growing geopolitical distrust over threat intelligence data leakage.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two SC Media *Perspectives* columns argue that **third-party and software supply-chain exposure** is increasingly driving enterprise risk, citing examples such as Broadcom’s disclosure of **exploited-in-the-wild VMware zero-days** and the **XZ Utils backdoor** as reminders that upstream compromise or latent vulnerabilities can create broad downstream impact. The commentary frames this as an operational asymmetry: patching and validation cycles lag attacker exploitation timelines, making vendor and dependency risk harder to manage than credential- and phishing-driven intrusions. Separately, Dark Reading reports that threat actors—particularly **ransomware groups**—are expanding use of **bring-your-own-vulnerable-driver (BYOVD)** techniques on Windows to gain kernel-level privileges and **terminate security tooling (e.g., EDR processes)** prior to deploying ransomware, infostealers, or backdoors. The article highlights that attackers have even abused a legitimate driver whose certificate was revoked years ago, underscoring persistent gaps in Windows driver trust and enforcement. Another SC Media commentary adds that **mobile apps** represent a structural supply-chain risk because they are publicly distributed and easily reverse engineered, and it flags 2026-era mobile threats such as **AI introduced via third-party SDKs** and growing urgency around **post-quantum cryptography planning** due to “harvest now, decrypt later” collection of encrypted data.
Jun 29, 2026
A recent ISC2 survey of over 1,000 cybersecurity professionals highlights growing concern about the risks introduced by expanding vendor ecosystems and supply chain sprawl. Nearly 70% of organizations are worried about third-party supplier risks, with the highest concern in enterprises and sectors handling sensitive data such as finance and government. Lack of visibility into vendor and subcontractor security practices remains a critical challenge, with many organizations relying on trust rather than verification. One in three respondents reported experiencing a vendor-related security incident in the past two years, yet almost half did not feel a direct impact, raising questions about continuity and the reliability of vendor security claims. Compounding these risks, a Sonatype analysis reveals that the vulnerability scoring infrastructure, particularly the NVD and CVE programs, is failing to keep pace with modern software development practices. In 2025, 64% of open source CVEs lacked a CVSS score in the NVD, forcing security teams to make risk decisions with incomplete data. Discrepancies in severity ratings and significant delays—averaging six weeks between disclosure and scoring—undermine the effectiveness of automated security tools and response cycles. These gaps in both supply chain visibility and vulnerability intelligence are eroding confidence in the data that underpins security programs, increasing the likelihood of both missed threats and wasted resources.
Jun 29, 2026
The United States is facing an escalating threat landscape, with cyberattacks from nation-state adversaries such as China, Russia, North Korea, and Iran becoming more sophisticated and coordinated. These adversaries are not only sharing cyber intelligence and best practices among themselves but are also leveraging advanced tactics, including exploiting third-party vulnerabilities and supply chain weaknesses. Recent high-profile incidents, such as the SolarWinds, MOVEit, and Crowdstrike Linux breaches, have demonstrated the devastating impact that a single compromised vendor can have on thousands of organizations. The traditional approach to third-party risk management, which relies on static checklists and periodic audits, is no longer sufficient, as attackers exploit the gaps between assessments. Intelligence-led, continuous monitoring of vendor ecosystems is now essential to detect and respond to emerging threats in real time. The speed at which attackers weaponize vulnerabilities has dramatically increased, with the average time to exploit (TTE) dropping from 63 days in 2019 to about 5 days in 2023, and even turning negative in 2024. This means attackers are now exploiting vulnerabilities before patches are even available, often by infiltrating disclosure pipelines or accessing leaked code repositories. As a result, organizations can no longer rely solely on timely patching and must instead focus on engineering resilience, rapid detection, containment, and recovery. The need for robust, real-time threat information sharing between the private sector and the federal government is more urgent than ever. Legislative efforts, such as the Protecting America from Cyber Threats Act, aim to reauthorize and expand the Cybersecurity Information Sharing Act of 2015, providing modernized legal protections and clarifying roles to facilitate more effective collaboration. Information sharing not only enhances technical defenses but also supports the mental resilience of CISOs, who benefit from peer collaboration and early warnings about emerging threats. The collective defense enabled by information sharing allows organizations to better understand the scale and scope of threats, prioritize responses, and reduce the cost and impact of breaches. As adversaries continue to innovate and accelerate their attacks, the U.S. must adapt by fostering a culture of proactive intelligence sharing, continuous monitoring, and cyber resilience across both public and private sectors.
Jun 29, 2026