## Social Media Intelligence\n\n### Twitter/X Analysis\n\nThreat actors often communicate on Twitter:\n- New vulnerability disclosures\n- Malware samples shared\n- Breach announcements\n- CTI researcher community\n\n**Search Operators**:\n```\nfrom:username keyword\n"exact phrase" since:2024-01-01\n#ransomware filter:links\n```\n\n### Telegram & Discord\n\nCybercrime communities use these platforms:\n- Ransomware leak sites\n- Stolen data marketplaces\n- Malware-as-a-Service\n- Credential dumps\n\n⚠️ **Warning**: Passive observation only. Never interact or purchase.\n\n### LinkedIn Intelligence\n\n- Identify company employees\n- Technology stack (job postings)\n- Organizational structure\n- Recent hires (potential phishing targets)\n\n### Dark Web Monitoring\n\n**What to monitor**:\n- Ransomware leak sites\n- Initial Access Broker (IAB) forums\n- Credential marketplaces\n- Company mentions\n\n**Tools**: Tor Browser, Ahmia, DarkSearch, commercial services\n\n### Building a Source Network\n\n- Follow CTI researchers\n- Join ISACs (Information Sharing and Analysis Centers)\n- Participate in threat intel communities\n- Attend conferences (virtual/in-person)