TrustFlare CTI · Problems it solves
The file is gone.
The key may still work.
A leak does not end when a file is removed. Copies spread, and keys keep working. Here are five problems this causes.
Public copy removed
Key not revokedKey may still work
Key revoked
Rotated by its ownerLeak closed
01
You learn about stolen logins after the attack.
Infostealer logs and combolists spread before anyone uses them. Most teams never see them.
How CTI fixes it
CTI watches the sources where stolen logins appear.
See 03: Logins02
A deleted commit does not revoke the key.
Git keeps history, and bots keep copies. The key works until someone rotates it.
How CTI fixes it
CTI finds the key and tells the owner to rotate it.
See 05: Keys and tokens03
Internal files appear online, and nobody tells you.
Contracts and database dumps get posted on leak sites. Security learns from a customer or a journalist.
How CTI fixes it
CTI watches leak sites and forums for your documents.
See 06: Documents04
Most leak alerts are not yours or not new.
Alerts match a company name, not your data. An old combolist comes back as a new alert.
How CTI fixes it
CTI checks that the data is yours and new.
See 08: Only what matters05
A password reset does not end a stolen session.
Infostealers take session cookies too. After a reset, old sessions can stay open.
How CTI fixes it
Each finding lists the next steps: rotate, reset and end sessions.
See 04: Sessions