Threat Intelligence Discord Bot

The vx-underground Threat Intelligence Discord Bot gets updates from various clearnet domains, ransomware threat actor domains, and Telegram channels. This bot will check for updates in intervals of 1800 seconds (omit Telegram bot, this is gotten in real time).

Don't want to set it up? This Threat Intelligence bot is live on Discord now.
Written in Python 3.10 64bit
Can run on Windows or Linux
Requires Discord Webhook
Easily add or remove domains wanting to be monitored
2 Scripts are present in the /Source/ directory
- DiscordIntelBot.py: responsible for ransomware groups and clearnet domains
- TelegramIntelBot.py: responsible for handling Telegram channels

Getting Started

Step 1. Make a web hook. Not sure how to make a webhook? Discord makes it easy!
Step 2. Create the Config.txt file. This Config.txt stores when data was recently updated. If a value has a "?" this means it has never received an update and/or is a new entry. By default the file is expected in the same path as the scripts. Change configuration_file_path in DiscordIntelBot.py if you'd like to keep it somewhere else.
- If you'd like to monitor Telegram channels, you will need a Telegram API Key
Step 3. Have internet connection
- If you're running the Telegram channel monitor, please note it downloads images from the Telegram channel. Sufficient hard disk space will be required to store images. By default downloaded images are stored in the TelegramImages subfolder. Change download_path in TelegramIntelBot.py if you'd like to store them somewhere else.
Step 4. Run the scripts. They'll run indefinitely, so feel free to run them as services, but not as scheduled tasks.

Known issues

Known issues occur when attempting to import RequestsWebhookAdapter from Discord, users noted a fix by doing either

python3 -m pip install --force-reinstall "discord.py<=1.0.0"

OR

pip install -Iv discord.py==1.7.3

Other notes

By default this script requires 4 discord web hooks (5 in total if you decide to use the Telegram bot). It pipes output for private sector updates, governments updates, ransomware group updates, and log output to indicate whether or not it is running. Feel free to remove whatever, or add whatever
There is no way to ensure what images are being posted to the Telegram channels. Proceed with caution
This bot does not download file attachments (i.e. binaries, zip files, etc.) from Telegram channels. There is no way to determine what it is (reliably).
On initial run the Telegram bot will send a 2FA message. This script handles this appropriately and will ask you to verify your identity by entering the code generated by Telegram
This bot will not send re-join requests on each run. When the script runs a session file is created in the directory it is operating out of. This will save its current state within the specified Telegram channels

Adding or removing RSS Feeds to monitor

All monitored RSS feeds are in the rss_feed_list object. To add a new RSS feed simply append a new entry and assign it a Config.txt file entry name. e.g.

In the Python script:

    rss_feed_list = [["https://grahamcluley.com/feed/", "Graham Cluley"],
                     ["https://1337WebsiteIWannaFollow.com/feed/", "1337Website"]]

Credit