Behind the Curtain of Open-Source Intelligence (OSINT)

This report examines limitations of open-source intelligence for detecting malicious infrastructure, illustrating how threat actors use seemingly benign IPs, domains, and services to evade detection through two cases: an IP tied to exploitation of Citrix NetScaler (CVE-2023-3519) and a legitimate travel domain used for Gootloader staging; it concludes with recommendations to enhance IoC detection and prioritized emergency detection rules.