Group-IB unveils its Graph

This article outlines Group‑IB’s network graph analysis capability integrated into its products, detailing how comprehensive data collection (domains, passive DNS/SSL, DNS records, open ports/services, file-linkages) and automated graph construction with refinement heuristics help investigators link malicious infrastructure, enrich indicators, correlate events, and identify patterns. It explains handling of historical records and ownership “possession intervals,” reducing irrelevant results from shared infrastructure, and demonstrates use cases—expanding Buhtrap-related infrastructure, mapping crypto-fraud ecosystems, uncovering bank phishing domains, and scoping a Cobalt-linked incident—to show rapid, scalable attribution and threat hunting.