Threat Intelligence Discord Bot

The vx-underground Threat Intelligence Discord Bot gets updates from various clearnet domains, ransomware threat actor domains, and Telegram channels. This bot will check for updates in intervals of 1800 seconds (omit Telegram bot, this is gotten in real time).

• Don't want to set it up? This Threat Intelligence bot is live on Discord now.
• Written in Python 3.10 64bit
• Can run on Windows or Linux
• Requires Discord Webhook
• Easily add or remove domains wanting to be monitored
• 2 Scripts are present in the /Source/ directory
  • RSS.py: responsible for ransomware groups and clearnet domains
  • Telegram.py: responsible for handling Telegram channels

Getting Started

• Step 1. Make a web hook. Not sure how to make a webhook? Discord makes it easy!
• Step 2. Update the config.ini file. This should be filled out with the webhooks you created in the previous step, and in case you'd like to monitor Telegram channels, also some Telegram API details
• Step 3. Have internet connection
  • If you're running the Telegram channel monitor, please note it downloads images from the Telegram channel. Sufficient hard disk space will be required to store images. By default downloaded images are stored in the TelegramImages subfolder. Change the ImageDownloadFolder property in the config.ini file if you'd like to store them somewhere else.
• Step 4. Run the scripts. This is done using the following command, with bot_type have the value of either "telegram" or "rss", depending on what bot you want to run:

python -m Source [bot_type]

Known issues

• Known issues occur when attempting to import RequestsWebhookAdapter from Discord, users noted a fix by doing either

python3 -m pip install --force-reinstall "discord.py<=1.0.0"

OR

pip install -Iv discord.py==1.7.3

Other notes

• By default this script requires 5 discord web hooks. It pipes output for private sector updates, governments updates, ransomware group updates, and log output to indicate whether or not it is running. Feel free to remove whatever, or add whatever, but if you remove a webhook from the config file (like if you don't want to monitor the Telegram feeds) remove the entire line in the config.ini file, instead of leaving the file blank, as this will cause the program to fail.
• There is no way to ensure what images are being posted to the Telegram channels. Proceed with caution
• This bot does not download file attachments (i.e. binaries, zip files, etc.) from Telegram channels. There is no way to determine what it is (reliably).
• On initial run the Telegram bot will send a 2FA message. This script handles this appropriately and will ask you to verify your identity by entering the code generated by Telegram
• This bot will not send re-join requests on each run. When the script runs a session file is created in the directory it is operating out of. This will save its current state within the specified Telegram channels

Adding or removing RSS Feeds to monitor

All monitored RSS feeds are in the rss_feed_list object. To add a new RSS feed simply append a new entry and assign it a RSSLog.txt file entry name. e.g.

In the Python script:

    rss_feed_list = [["https://grahamcluley.com/feed/", "Graham Cluley"],
                     ["https://1337WebsiteIWannaFollow.com/feed/", "1337Website"]]

Credit

• Original commit, code base, proof-of-concept by smelly__vx
• General quality of life improvements and debugging by Julien Mousqueton
• Feature enhancement, standardization, etc. by hRun
• Feature enhancement, standardization, etc. by come2darkside