Shared threat intelligence is becoming central to cybercrime disruption

At a glance

What this is: DNSFilter's announcement frames Cybercrime Atlas membership as a move toward shared intelligence and coordinated disruption of transnational cybercrime networks.

Why it matters: It matters because defenders increasingly need cross-sector visibility into infrastructure, phishing, and command-and-control patterns that individual teams cannot map alone.

Context

Cybercrime disruption depends on visibility across infrastructure, actors, and campaigns, not just inside a single organisation's telemetry. When criminal networks move domains, rotate hosting, and reuse playbooks across regions, siloed monitoring leaves defenders seeing fragments rather than the full operating pattern.

This article sits in the overlap between cyber threat intelligence and identity security because phishing, credential theft, and command-and-control infrastructure frequently target the systems that authenticate users and workloads. The governance gap is not only detection capacity but coordinated attribution, shared context, and faster disruption across the ecosystem.

Key questions

Q: How should security teams use shared threat intelligence to disrupt cybercrime networks?

A: They should use it to correlate infrastructure, actors, and campaign patterns across organisations, then feed the resulting insight into takedowns, detection tuning, and investigation prioritisation. The goal is not a larger feed list. It is faster recognition of repeated infrastructure use and more coordinated disruption of criminal operations.

Q: Why do attackers keep abusing Microsoft SharePoint for phishing and credential theft?

A: Attackers prefer SharePoint because it combines legitimate authentication, trusted user relationships, and widely recognized URLs and templates. That makes malicious messages harder to spot and easier to trust. Once a user authenticates, the attacker can steal credentials, access documents, and potentially move laterally. The platform’s legitimacy becomes part of the attack path.

Q: What breaks when cybercrime intelligence stays siloed?

A: Siloed intelligence leaves teams seeing only local indicators, so the same criminal infrastructure can appear unrelated across victims, geographies, or sectors. That slows attribution, delays coordinated disruption, and makes it easier for attackers to rotate domains, reuse playbooks, and extend campaigns before defenders connect the dots.

Q: What should IAM teams do when phishing infrastructure is being tracked more aggressively?

A: They should tighten account recovery checks, review step-up authentication paths, and treat lookalike domains as upstream signals for credential compromise. Identity controls work better when they ingest external infrastructure intelligence instead of waiting for a confirmed login anomaly or support ticket.

Technical breakdown

Why shared threat intelligence improves cybercrime disruption

Cybercrime Atlas is built around a collaborative intelligence model rather than a single-vendor detection stack. The technical value is not one more alert feed. It is the ability to correlate domains, infrastructure, actors, and campaign patterns across participants so that the same malicious infrastructure can be tracked through multiple investigations. That matters because threat actors fragment their operations across registrars, hosting providers, and geographies to reduce visibility. Shared analysis turns scattered observations into a reusable picture of infrastructure reuse, rotation, and campaign lineage.

Practical implication: security teams should treat external intelligence sharing as an operational capability, not a reputational add-on.

How DNS-layer telemetry helps expose malicious infrastructure

DNS is one of the earliest control points in the internet path, which makes it useful for spotting staging activity, phishing domains, and command-and-control callbacks before later-stage payloads fully emerge. DNS-layer telemetry is especially valuable because attackers often need DNS resolution even when they change hosting, evade endpoint detection, or shift malware delivery paths. The technical signal is not perfect attribution, but pattern visibility: domains, resolution behaviour, and infrastructure churn that can be linked to broader campaigns. That gives investigators a lead before the incident is fully mature.

Practical implication: defenders should correlate DNS telemetry with endpoint, proxy, and identity signals to identify campaign overlap earlier.

Why identity and access teams should care about campaign mapping

Phishing domains, malware delivery, and credential theft are not separate problems from IAM. They are common entry mechanisms for account takeover, token abuse, and downstream privilege misuse. When intelligence platforms connect infrastructure to actor behaviour, identity teams get earlier warning that a campaign is targeting authentication flows, session tokens, or help-desk impersonation paths. That linkage matters because many identity failures begin before a password is stolen, with infrastructure that supports lures, lookalike domains, and replay of trust relationships.

Practical implication: IAM and SOC teams should feed domain intelligence into authentication, help-desk verification, and account recovery controls.

Threat narrative

Attacker objective: The objective is to scale profitable compromise by reusing infrastructure, evading detection, and turning one campaign into many victims across borders.

1. Entry occurs when attackers use phishing domains, malware distribution sites, or lookalike infrastructure to reach victims through DNS-resolved destinations.
2. Credential harvesting or command-and-control follows when victims interact with malicious infrastructure that captures data, issues callbacks, or supports further payload delivery.
3. Impact is achieved when stolen credentials, malware access, or campaign infrastructure support fraud, ransomware, or broader compromise across multiple organisations.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shared intelligence is now a governance control, not just an investigation aid. The article describes a model where defenders contribute telemetry, correlate infrastructure, and coordinate disruption across organisational boundaries. That is a material shift in how cybercrime is countered because the threat itself is transnational and infrastructure-driven. For practitioners, the lesson is that collaboration quality directly affects how quickly malicious domains, campaign overlap, and actor reuse can be understood.

DNS visibility creates a useful early-warning layer for identity abuse. Malicious domains and C2 behaviour often appear before account takeover becomes visible in identity logs. That means DNS telemetry can surface the infrastructure behind phishing, credential theft, and session-hijack paths before the identity stack records the compromise. Practitioners should treat domain intelligence as upstream context for IAM, not as a separate security silo.

Infrastructure rotation is the named concept that best captures this threat pattern. Cybercriminals do not rely on a single domain or server for long. They continuously rotate infrastructure, which weakens controls that depend on stable indicators and isolated ownership. The practitioner conclusion is clear: security programmes need correlation and disruption logic that tracks campaign behaviour across time, not just point-in-time indicators.

Cross-sector defence becomes more valuable as criminal networks become more modular. The article shows that no single organisation sees enough of the attack surface to map the whole network. The right response is therefore to connect investigative, DNS, financial, and endpoint evidence into shared operational workflows. That gives security teams a better chance of detecting reuse patterns before they become repeated incidents.

Threat intelligence should be measured by disruption outcomes, not collection volume. The value of a shared initiative is not the number of indicators ingested, but whether it helps dismantle infrastructure, shorten dwell time, and reduce repeat abuse. That shifts practitioners toward measuring how intelligence changes action, which is the only standard that matters for cybercrime disruption.

What this signals

Infrastructure rotation is now a core resilience problem for defenders. The same criminal campaign can move through new domains, hosting, and callback paths faster than a single team can validate indicators. That means detection programmes need to focus on correlation and disruption, not only on blocklists and isolated alerts.

Identity teams should treat external infrastructure intelligence as an input to authentication governance. Phishing domains, recovery abuse, and credential capture often begin outside the IAM stack but end inside it. When domain intelligence is missing from access and recovery controls, account takeover becomes easier to stage and harder to distinguish from legitimate user behaviour.

For practitioners

• Build DNS intelligence into threat correlation Correlate malicious domains, resolution patterns, and command-and-control callbacks with endpoint and proxy telemetry so campaign reuse is visible across control layers.
• Feed phishing indicators into identity controls Use newly observed malicious infrastructure to tune MFA prompts, help-desk verification, and account recovery checks for likely credential-theft campaigns.
• Join cross-sector sharing workflows Establish a repeatable process for contributing indicators, campaign notes, and infrastructure overlaps to trusted external intelligence communities.
• Prioritise disruption over indicator collection Track whether shared intelligence leads to domain takedown, infrastructure correlation, or account protection outcomes rather than only increasing feed volume.

Key takeaways

• Cybercrime Atlas-style collaboration reflects a practical shift from isolated detection to shared disruption of transnational attacker infrastructure.
• DNS-layer telemetry is valuable because it can surface malicious domains, staging activity, and command-and-control behaviour early in a campaign.
• Identity and access teams should fold infrastructure intelligence into authentication, recovery, and fraud controls to reduce phishing-driven compromise.

Key terms

• Threat Information Sharing: Threat information sharing is the practice of exchanging observations, indicators, and lessons learned so other defenders can act earlier. It turns one team’s experience into broader defensive value. In mature programmes, sharing supports faster recognition of recurring techniques, better prioritisation, and improved readiness across the community.
• DNS-Layer Threat Intelligence: DNS-layer threat intelligence is security visibility derived from domain resolution activity, malicious hostnames, and callback patterns. It is useful because adversaries often need DNS to stage phishing, malware delivery, or command-and-control communication, making DNS one of the earliest places where campaign behaviour can surface.
• Command-and-control: Command-and-control is the communication channel an attacker uses to issue instructions to malware and receive results back from a compromised host. For XWorm, the channel is encrypted and used for session management, payload delivery, surveillance, and modular expansion of capabilities after compromise.
• Infrastructure Rotation: Infrastructure rotation is the repeated swapping of domains, hosting, or callback endpoints to evade detection and keep campaigns alive. It weakens security programmes that rely on static indicators, and it is one reason why defenders need correlation across time, organisations, and telemetry sources.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity governance with the broader security programmes their organisations rely on.