Connecting the Dots to GTI (Part 2/4)

This is Part 2 of the Connecting the Dots to GTI series. In Part 1, we traced the 15-year timeline from Operation Aurora and TAG (2010), VirusTotal (2012), and Mandiant (2022) to today's three unified pillars: GTIG, GTI, and Mandiant Services. In this post, we'll look at how the intelligence loop between GTIG and GTI works under the hood.

Disclaimer: This series is built entirely on publicly available material. All views, war stories, and opinions here are strictly my own—not Google speaking officially.

GTIG and GTI Magic

With its unified structure, Google created a tight intelligence cycle between its human analysts (GTIG) and its platform (GTI).

Community users (who know the free public surface as VirusTotal) and enterprise customers (who use the paid GTI platform) continuously submit raw observables—files, URLs, domains, and IPs—and pivot across infrastructure. At the same time, GTIG analysts use GTI as their own analytical workbench: correlating that crowdsourced corpus with Google's internal telemetry and Mandiant's frontline engagements, then publishing finished intelligence straight back into GTI. Customers can operationalize that output immediately—enabling GTIG's Curated YARA Rules directly inside Livehunt and Retrohunt, subscribing to Threat Profiles, and streaming indicators into their SIEM via IOC Stream. And when enterprise customers need to detonate sensitive internal artifacts without exposing them to that shared loop, they use Private Scanning, which runs in isolated buckets and auto-deletes without ever entering the public corpus.

Free VirusTotal vs. Google Threat Intelligence (GTI): What's Inside the Platform?

While free users interact with the public VirusTotal scanner, enterprise customers on GTI get a consolidated suite spanning tactical, operational, and strategic intelligence:

• Crowdsourced Observables & Pivoting: Full search and infrastructure pivoting across the global VirusTotal dataset of files, URLs, domains, IPs, and passive DNS.
• Finished Threat Intelligence & Threat Profiles: GTIG's strategic and operational reporting, Threat Actor profiles, UNC intrusion sets, Malware profiles, and vulnerability intelligence.
• Curated YARA Rules, Livehunt & Retrohunt: Running custom or GTIG-curated YARA rules against the live stream of incoming global uploads (Livehunt) or scanning backwards across petabyte-scale historical samples (Retrohunt).
• Threat Graph & Collections: Visual link-analysis graphs and shareable, curated indicator collections for specific campaigns.
• IOC Stream: A real-time tactical feed of evaluated indicators matching your subscribed Collections, Livehunt rules, and Threat Profiles, ready to ingest into a SIEM.
• Digital Threat Monitoring (DTM): Continuous collection across the deep and dark web, Telegram channels, paste sites, and infostealer logs for compromised credentials and brand exposure.
• Attack Surface Management (ASM): Outside-in discovery of an organization's external assets, shadow IT, and exploitable vulnerabilities.
• Private Scanning: Isolated, ephemeral file and URL sandboxing that never shares artifacts with the public community.
• Gemini in GTI: Conversational AI for summarizing finished intelligence, translating underground chatter, and building hunting queries.

A natural question here is: if a competitor or customer also has access to the VirusTotal dataset, does a GTIG analyst have any real collection advantage? Yes—three big ones that external users cannot query directly:

1. Mandiant Frontline IR & MDR Telemetry: Raw forensic artifacts, hands-on-keyboard attacker commands, and internal lateral-movement tradecraft gathered directly from active breach investigations worldwide—much of which never touches public VirusTotal.
2. Google Product Telemetry: Aggregated security signals from billions of Gmail accounts, Chrome Safe Browsing blocks, Android Play Protect, and Google Cloud.
3. FLARE Reverse Engineering & Unpublished UNC Tracking: Automated malware configuration extractors and internal intrusion-set tracking before a campaign ever goes public.

The Diamond Model and UNC Clusters

To turn millions of raw observables into tracked threat actors, GTIG analysts structure their clustering and attribution methodology around the Diamond Model of Intrusion Analysis. That word—intrusion—is the core of Mandiant's modus operandi: unlike vendors that build intelligence primarily by scraping dark web forums or underground chatrooms, Mandiant starts from real intrusion data, which is why the Diamond Model fits so naturally:

CTI 101: The Diamond Model

Formulated by Caltagirone, Pendergast, and Betz, the Diamond Model maps every cyber intrusion across four connected vertices:

• Adversary: The threat actor or operator behind the intrusion.
• Capability: The malware families, custom tools, exploits, or living-off-the-land binaries (LOLBins) used.
• Infrastructure: The domains, IPs, C2 servers, SSL certificates, or RMM relays supporting the operation.
• Victim: The target organization, sector, tech stack, or geography (victimology).

When an investigation begins, the Adversary vertex is unknown. Analysts start pivoting—taking a single indicator (say, a phishing domain) and pivoting across shared infrastructure—for example, uncovering dozens of related domains that reuse the same SSL certificate serial pattern, JARM fingerprint, or C2 configuration.

When two or more vertices of the Diamond align across separate intrusions, GTIG groups that activity into an intrusion set (or activity cluster) and assigns an UNC (Uncategorized) designation, like UNC5669.

GTIG doesn't rush to assign formal attribution on Day 1, because early in an investigation you can't tell if UNC5669 is a net-new group, an Initial Access Broker (IAB) handing off access to multiple ransomware affiliates, or a known actor testing new tradecraft. Instead, analysts gather longitudinal data—information collected about the same group repeatedly over an extended period of time—tracking how that intrusion set behaves across months and multiple campaigns. Crucially, GTI customers don't wait for a public report to operationalize this: as soon as an UNC cluster is cataloged, its indicators, TTPs, and hunting rules are live inside GTI.

Once longitudinal tracking confirms that an UNC cluster is a distinct, persistent group with consistent motivation and victimology, it graduates to a named Threat Actor under GTIG's two-word naming convention. For example, UNC5669 graduated into Breeze Comet: the first word (Breeze) is the unique identifier assigned to that specific group, while the second word (COMET) is the category suffix designating financially motivated eCrime.

Up Next in Part 3: We'll move from attribution to daily SOC operations—how Digital Threat Monitoring (DTM) cuts credential-leak alert fatigue, why global platforms don't miss regional actors, and a personal detection engineering war story on leaked credentials.