CISA Warns Threat Hunting Staff Of End To Google, Censys Contracts As Agency Cuts Set In

The Cybersecurity and Infrastructure Security Agency (CISA) has alerted its threat-hunting teams about the impending termination of contracts with Google’s VirusTotal and Censys due to budget cuts. These tools are critical for identifying vulnerabilities, analyzing malware, and tracking adversarial infrastructure. Their loss could weaken national cybersecurity defenses, impacting both public and private sectors.

You Should Know:

1. Alternative Threat Intelligence Tools

Since CISA is losing access to VirusTotal and Censys, security teams should consider these alternatives:
– Hybrid Analysis (hybrid-analysis.com) – Free malware analysis sandbox.
– Shodan (shodan.io) – Search engine for exposed devices and services.
– AlienVault OTX (otx.alienvault.com) – Open Threat Intelligence platform.

2. Command-Line Threat Intelligence Gathering

Security analysts can use these Linux commands to gather threat data manually:

 Query threat feeds via CLI using curl 
curl -s "https://otx.alienvault.com/api/v1/indicators/domain/google.com" | jq

Check IP reputation with AbuseIPDB 
curl -s "https://api.abuseipdb.com/api/v2/check?ipAddress=1.1.1.1" -H "Key: YOUR_API_KEY"

Passive DNS lookup via CLI 
dig +short google.com

3. Automating Threat Feeds with Python

Use this script to fetch IOCs (Indicators of Compromise) from open-source feeds:

import requests 
import json

url = "https://feodotracker.abuse.ch/downloads/ipblocklist.json" 
response = requests.get(url) 
data = response.json()

for entry in data: 
print(f"Malicious IP: {entry['ip_address']}, Threat: {entry['malware']}")

4. Windows Threat Hunting Commands

For Windows-based analysts:

 Check active network connections (similar to Censys port scanning) 
netstat -ano | findstr ESTABLISHED

Extract hashes of running processes for VirusTotal-like analysis 
Get-Process | Select-Object Name, Id, Path | ForEach-Object { 
if ($<em>.Path) { Get-FileHash -Algorithm SHA256 $</em>.Path } 
}

Setting Up a Local Malware Analysis Lab
Since VirusTotal may become less accessible, build your own sandbox:

Install Cuckoo Sandbox (Linux) 
sudo apt update && sudo apt install -y python3 virtualenv 
git clone https://github.com/cuckoosandbox/cuckoo 
cd cuckoo && python3 -m pip install -r requirements.txt 
./cuckoo.py

What Undercode Say

Budget cuts to critical cybersecurity tools like VirusTotal and Censys create gaps in threat visibility. Organizations must adapt by leveraging open-source intelligence (OSINT), automating threat data collection, and enhancing in-house malware analysis capabilities. Proactive measures, such as deploying intrusion detection systems (Snort, Suricata) and cross-referencing multiple threat feeds, can mitigate risks.