Threat Intelligence Discord Bot

The vx-underground Threat Intelligence Discord Bot gets updates from various clearnet domains, ransomware threat actor domains, and Telegram channels. This bot will check for updates in intervals of 1800 seconds (omit Telegram bot, this is gotten in real time).

• Don't want to set it up? This Threat Intelligence bot is live on Discord now.
• Written in Python 3.10 64bit
• Can run on Windows or Linux
• Requires Discord Webhook
• Easily add or remove domains wanting to be monitored
• Written by a C++ Windows programmer, variable and function naming convention will probably make you puke
  • Refactored by hRun, code is less ugly to Python programmers
• 2 Scripts are present in the /Source/ directory
  • DiscordIntelBot.py: responsible for ransomware groups and clearnet domains
  • TelegramIntelBot.py: responsible for handling Telegram channels

Getting Started

• Step 1. Make a web hook. Not sure how to make a webhook? Discord makes it easy!
• Step 2. Create the Config.txt file. This Config.txt stores when data was recently updated. If a value has a "?" this means it has never received an update and/or is a new entry. By default the file is expected in the same path as the scripts. Change configuration_file_path in DiscordIntelBot.py if you'd like to keep it somewhere else.
  • If you'd like to monitor Telegram channels, you will need a Telegram API Key
• Step 3. Have internet connection
  • If you're running the Telegram channel monitor, please note it downloads images from the Telegram channel. Sufficient hard disk space will be required to store images. By default downloaded images are stored in the TelegramImages subfolder. Change download_path in TelegramIntelBot.py if you'd like to store them somewhere else.
• Step 4. Run the scripts. They'll run indefinitely, so feel free to run them as services, but not as scheduled tasks.

Known issues

• Known issues occur when attempting to import RequestsWebhookAdapter from Discord, users noted a fix by doing either

python3 -m pip install --force-reinstall "discord.py<=1.0.0"

OR

pip install -Iv discord.py==1.7.3

Other notes

• By default this script requires 4 discord web hooks (5 in total if you decide to use the Telegram bot). It pipes output for private sector updates, governments updates, ransomware group updates, and log output to indicate whether or not it is running. Feel free to remove whatever, or add whatever
• Some Rss Feeds (such as Cybersecurity AT&T) have non-default RSS field keys. Some may require debugging to determine which fields are labeled as such. We simply removed these domains from the configuration file. We were too lazy to resolve this.
• There is no way to ensure what images are being posted to the Telegram channels. Proceed with caution
• This bot does not download file attachments (i.e. binaries, zip files, etc.) from Telegram channels. There is no way to determine what it is (reliably).
• On initial run the Telegram bot will send a 2FA message. This script handles this appropriately and will ask you to verify your identity by entering the code generated by Telegram
• This bot will not send re-join requests on each run. When the script runs a session file is created in the directory it is operating out of. This will save its current state within the specified Telegram channels

Adding or removing RSS Feeds to monitor

All monitored RSS feeds are in the rss_feed_list object. To add a new RSS feed simply append a new entry and assign it a Config.txt file entry name. e.g.

In the Python script:

    rss_feed_list = [["https://grahamcluley.com/feed/", "Graham Cluley"],
                     ["https://1337WebsiteIWannaFollow.com/feed/", "1337Website"]]

In the config file:

1337Website = ?

The "?" indicates it has never received an update.

Adding or removing Telegram channels to monitor

• NOTE: The Telegram API is an ugly monster and does not make determining what is being filtered an easy task. This script contains A LOT of repetitive code. Perhaps clean it up and send a merge request? =D
• Step 1. Add an entry to the telegram_feed_list dict.
• Step 3. Set the Telegram async filter via

##****NewTelegramChannelName handler****
@TelegramClientObject.on(events.NewMessage(incoming=True,chats=NewTelegramChannelName))
async def EventHandler(EventObject):

    if EventObject.photo:
        ImageData = await EventObject.download_media(DownloadPath)
        UploadFile = discord.File(open(ImageData, 'rb'))
        TelegramFeed.send(file=UploadFile)
        
    CreateTelegramMessageOutput("NewTelegramChannelName", EventObject.message.message)

Credit

• Original commit, code base, proof-of-concept by smelly__vx
• General quality of life improvements and debugging by Julien Mousqueton
• Feature enhancement, standardization, etc. by hRun