Cybercrime Atlas membership: what it means for threat intelligence sharing

TL;DR: Joining the World Economic Forum-hosted Cybercrime Atlas as a community member reflects a wider shift toward shared threat intelligence, joint hunts, and coordinated disruption across borders, sectors, and jurisdictions, according to DNSFilter. For identity and security teams, the practical lesson is that isolated telemetry no longer matches organised criminal infrastructure.

Editorial analysis by NHI Mgmt Group, based on content published by DNSFilter: “DNSFilter Joins the World Economic Forum-hosted Cybercrime Atlas as a Community Member”.

Key questions

Q: How should security teams use shared threat intelligence to disrupt cybercrime networks?

A: They should use it to correlate infrastructure, actors, and campaign patterns across organisations, then feed the resulting insight into takedowns, detection tuning, and investigation prioritisation.

Q: Why do attackers keep abusing Microsoft SharePoint for phishing and credential theft?

A: Attackers prefer SharePoint because it combines legitimate authentication, trusted user relationships, and widely recognized URLs and templates.

Q: What breaks when cybercrime intelligence stays siloed?

A: Siloed intelligence leaves teams seeing only local indicators, so the same criminal infrastructure can appear unrelated across victims, geographies, or sectors.

Practitioner guidance

• Build DNS intelligence into threat correlation Correlate malicious domains, resolution patterns, and command-and-control callbacks with endpoint and proxy telemetry so campaign reuse is visible across control layers.
• Feed phishing indicators into identity controls Use newly observed malicious infrastructure to tune MFA prompts, help-desk verification, and account recovery checks for likely credential-theft campaigns.
• Join cross-sector sharing workflows Establish a repeatable process for contributing indicators, campaign notes, and infrastructure overlaps to trusted external intelligence communities.

Bottom line: Cybercrime Atlas-style collaboration reflects a practical shift from isolated detection to shared disruption of transnational attacker infrastructure.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →