TIBlender: Early-Warning Threat Intelligence from Cross-Platform Social Media Evidence
2026-06-03 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors created TIBlender, a system that watches four social media sites (X, Reddit, Telegram, Discord) to find early signs of cyber threats. It uses specialized AI agents to gather and analyze clues from different angles, then makes clear reports about potential dangers. In tests, TIBlender found threats earlier than public sources and discovered many new indicators of cyberattacks not seen elsewhere. The study shows that using multiple platforms together gives a better picture of threats than looking at just one.
Threat IntelligenceIndicators of CompromiseLarge Language ModelsCybersecuritySocial Media MonitoringMulti-agent SystemsEarly Warning SystemsCross-platform Analysis
Authors
Hiroki Nakano, Takashi Koide, Daiki Chiba
Abstract
Cyber threat signals are fragmented across multiple social media platforms, yet no existing approach has fully automated their integration into actionable threat intelligence (TI) reports. We present TIBlender, a multi-agent system that monitors four platforms (X, Reddit, Telegram, and Discord) and produces structured TI reports via role-specialized LLM agents. These agents conduct multi-perspective investigations, tracing chains of evidence to uncover related Indicators of Compromise (IoCs) via collaborative, evidence-backed analysis. In a real-world deployment, TIBlender detected emerging threats across all four threat categories ahead of public feeds, including in-the-wild exploitation ahead of public vulnerability registries; the majority of its IoCs were absent from each evaluated feed. Quantitative evaluation confirms that each platform contributes unique threat information unavailable from the others, and that excluding any single platform results in substantial loss of reports in specific threat categories. Under identical single-platform input conditions, TIBlender's IoC extraction meets or exceeds each baseline; the full pipeline surfaces substantially more IoCs, most of which are absent from any single-platform baseline. These results establish cross-platform social media monitoring as an effective and scalable early-warning layer for operational TI pipelines.