Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces DarkBot, a pioneering multi-agent LLM-based system designed for active cyber threat intelligence (CTI) elicitation from underground forums, addressing the limitations of passive monitoring in an environment where valuable information is increasingly hidden. By utilizing eleven specialized agents for engagement gating, context-aware question generation, and linguistic style adaptation, DarkBot successfully recovered 72.8% of validated MITRE ATT&CK techniques from initial posts in controlled evaluations. Furthermore, real-world deployment demonstrated that DarkBot significantly outperformed traditional methods, accumulating more CTI entities without triggering account suspensions or moderator interventions.
DarkBot can extract nearly 73% of critical cyber threat techniques from just the first post in underground forums, revolutionizing how we gather intelligence in increasingly guarded online spaces.
Cyber threat intelligence from underground forums has traditionally relied on passive monitoring. However, as users have become more aware of large-scale data collection, valuable intelligence has become increasingly rare in open forums, often migrating instead to private or harder-to-reach spaces, making passive approaches inadequate. Building on the intuition that relevant information can be obtained through active elicitation, this paper presents DarkBot, to the best of our knowledge, the first multi-agent LLM-based system for active CTI elicitation in underground forums. DarkBot decomposes the interaction task across eleven specialized agents organized into three functional blocks: engagement gating for relevance and safety filtering, context-aware question generation driven by MITRE ATT&CK tactics, and linguistic style adaptation to better align with real forum users. In a controlled evaluation across 100 CrimeBB conversations, the system recovered 72.8% of the validated MITRE ATT&CK techniques present in the original discussions by observing only the initial post at the start of each interaction, and it consistently outperformed a monolithic baseline. The proposed layered safety design contained all injected jailbreak attempts at the pipeline level. These results were further supported by real-world experiments: in a prospective matched deployment, threads assigned to DarkBot accumulated an average of 3.85 more CTI entities than their controls over seven days, and across 104 live forum conversations, the system elicited CTI-relevant disclosures without observed account suspensions, moderator interventions, or explicit accusations of automated participation.