How do I find reliable threat intelligence publications for researching malware and intrusion trends?

To find reliable threat intelligence publications for researching malware and intrusion trends, focus on sources that are well-documented, evidence-based, and regularly updated. A good approach is to combine vendor research, public-sector reporting, and community-led analysis.

What to look for in a good source

Prioritize publications that have:

• Clear attribution: who published it, and what their expertise is
• Evidence: hashes, YARA/Sigma rules, IPs/domains, TTPs, screenshots, logs, or sample data
• Methodology: how they collected or analyzed the data
• Timeliness: recent and regularly updated reporting
• Consistency: a track record of accurate reporting over time
• Specificity: focus on tactics, techniques, and procedures (TTPs), not just headlines

Avoid sources that:

• Make claims without evidence
• Rely heavily on sensational language
• Repost other people’s research without adding analysis
• Don’t distinguish between confirmed facts and hypotheses

Reliable publication types and examples

1) Security vendor research blogs

These often provide strong technical analysis and malware writeups.

Examples:

• CrowdStrike blog
• Mandiant / Google Threat Intelligence
• Microsoft Threat Intelligence
• Palo Alto Networks Unit 42
• SentinelOne labs
• Cisco Talos
• ESET research
• Trend Micro research
• Kaspersky Securelist
• Proofpoint threat research
• Sophos X-Ops

2) Public-sector and CERT publications

Useful for broad trend reporting and incident advisories.

Examples:

• CISA alerts and advisories
• US-CERT / CISA Known Exploited Vulnerabilities catalog
• FBI public advisories
• NCSC reports (UK and other national CERTs)
• ENISA threat landscape reports
• CERT-EU reports

3) Threat intel aggregation and analysis platforms

Good for trend discovery and cross-referencing, though you should verify details with primary sources.

Examples:

• VirusTotal blog and threat intelligence features
• MISP communities and feeds
• AlienVault OTX
• MalwareBazaar
• Abuse.ch projects
• Spamhaus research

4) Academic and conference papers

Helpful for deeper methodology and long-term trends.

Look for:

• ACM, IEEE, USENIX, NDSS, RAID, and Black Hat/DEF CON talks
• University-affiliated research groups
• Papers with datasets and reproducible methods

5) Community and independent researchers

Some of the best malware and intrusion research comes from independent analysts.

Best known for:

• Detailed reverse engineering
• Campaign tracking
• Infrastructure mapping
• Open-source tooling

Check whether they:

• Publish under a known identity
• Have a consistent body of work
• Are cited by other reputable researchers

Practical workflow for evaluating a publication

When you find a report, ask:

1. Who wrote it?

   • Is the author/organization known and credible?

2. What is the evidence?

   • Are indicators, samples, or methodology included?

3. Can I verify the claims elsewhere?

   • Compare with other sources or open-source telemetry

4. Is the reporting technical enough for my purpose?

   • Malware research needs more than high-level narrative

5. Does it separate observation from inference?

   • Good reports say what was seen vs. what is suspected

Best ways to discover sources

• Follow reputable researchers on LinkedIn, X/Twitter, and Mastodon
• Subscribe to vendor and CERT RSS feeds/newsletters
• Use Google Scholar, Semantic Scholar, and conference proceedings for academic work
• Search by malware family, actor name, TTP, or CVE plus terms like:
  • “report”
  • “analysis”
  • “threat actor”
  • “TTP”
  • “campaign”
  • “intrusion set”

Good verification habits

Cross-check important findings against:

• Multiple independent reports
• Public sandbox results
• VirusTotal or similar metadata
• MITRE ATT&CK mapping
• IOC enrichment from your internal tooling

A simple rule of thumb

A publication is usually more reliable if it:

• shows evidence,
• explains how it was derived,
• and can be corroborated by other sources.

If you want, I can also give you:

1. a curated list of high-quality threat intel blogs and RSS feeds, or
2. a checklist for evaluating the credibility of a specific report.