Towards Automated Cyber Threat Intelligence Elicitation in Underground Forums
2026-08-24 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors developed DarkBot, a system using many specialized AI agents to actively gather cyber threat intelligence from underground forums where users try to avoid being tracked. Unlike past methods that only listen without interacting, DarkBot asks questions in a style similar to real users to get better information about cyberattacks. In tests, it found a large portion of known attack techniques just by looking at the initial posts and did better than simpler systems. The system also safely handled attempts to trick it and worked well in real forums without causing problems like getting banned.
Cyber Threat IntelligenceUnderground ForumsLarge Language ModelsActive ElicitationMITRE ATT&CKMulti-agent SystemsContext-aware Question GenerationSafety FilteringCybersecurity
Authors
Lorenzo Bossi, Federico Saccani, Francesco Panebianco, Antonio Maci, Stefano Zanero, Stefano Longari, Michele Carminati
Abstract
Cyber threat intelligence from underground forums has traditionally relied on passive monitoring. However, as users have become more aware of large-scale data collection, valuable intelligence has become increasingly rare in open forums, often migrating instead to private or harder-to-reach spaces, making passive approaches inadequate. Building on the intuition that relevant information can be obtained through active elicitation, this paper presents DarkBot, to the best of our knowledge, the first multi-agent LLM-based system for active CTI elicitation in underground forums. DarkBot decomposes the interaction task across eleven specialized agents organized into three functional blocks: engagement gating for relevance and safety filtering, context-aware question generation driven by MITRE ATT&CK tactics, and linguistic style adaptation to better align with real forum users. In a controlled evaluation across 100 CrimeBB conversations, the system recovered 72.8% of the validated MITRE ATT&CK techniques present in the original discussions by observing only the initial post at the start of each interaction, and it consistently outperformed a monolithic baseline. The proposed layered safety design contained all injected jailbreak attempts at the pipeline level. These results were further supported by real-world experiments: in a prospective matched deployment, threads assigned to DarkBot accumulated an average of 3.85 more CTI entities than their controls over seven days, and across 104 live forum conversations, the system elicited CTI-relevant disclosures without observed account suspensions, moderator interventions, or explicit accusations of automated participation.