BastionGuard Introduces ThreatMap CTI — A New Cyber Threat Intelligence Platform

October 23, 2026 — BastionGuard is proud to announce the launch of ThreatMap CTI, a cybersecurity intelligence platform designed to monitor emerging cyber threats, collect Indicators of Compromise (IoCs), analyze malicious infrastructure, and support the development of custom antivirus signature databases for BastionGuard AV.

ThreatMap CTI was created with a clear mission: to transform global cyber threat intelligence into actionable security information, making threat data more accessible, transparent, and useful for cybersecurity professionals, researchers, and the wider security community.

By combining Open Source Intelligence (OSINT), malware classification, geographic threat visualization, and antivirus signature management, ThreatMap provides a centralized environment for understanding today’s evolving threat landscape.

Global Threat Intelligence & Interactive Map

At the core of ThreatMap CTI is an interactive threat intelligence dashboard powered by OpenStreetMap, providing geographic visibility into infrastructure associated with reported cyber threats.

The platform provides access to:

• Phishing, malware, and ransomware indicators.

• Suspicious domains, URLs, and IP addresses.

• Geographic distribution of observed hosting infrastructure.

• Threat classifications and confidence levels.

• Intelligence sources and supporting evidence.

• URL verification results and historical observations.

• Statistics on collected and analyzed indicators.

ThreatMap distinguishes between the geographical location of hosting infrastructure and the actual location of threat actors, ensuring accurate interpretation of geographic intelligence.

Automated OSINT Collection & Threat Monitoring

ThreatMap CTI integrates multiple established cybersecurity intelligence sources to collect and correlate threat information.

OpenPhish — Phishing Intelligence

Collects URLs reported as phishing threats, enabling the platform to identify and categorize phishing infrastructure.

URLhaus — Malware Distribution Intelligence

Provides intelligence on URLs associated with malware distribution, supporting identification and monitoring of malicious hosting infrastructure.

MalwareBazaar — Malware Sample Intelligence

Supplies technical metadata about reported malware samples, including SHA-256 hashes, malware families, file types, tags, and additional classification information.

ThreatMap processes this information into structured intelligence records while preserving source attribution and distinguishing external reports from independently verified evidence.

Advanced Malware Classification

ThreatMap goes beyond basic malicious URL collection.

The platform analyzes available malware metadata to organize threats into more meaningful categories, including:

• Ransomware

• Trojans

• Remote Access Trojans (RATs)

• Infostealers

• Botnets

• Banking malware

• Cryptocurrency miners

• Other malicious software families

For each reported malware sample, ThreatMap can retain its SHA-256 hash, associated family, file size, file type, classification tags, intelligence source, and supporting technical evidence.

Transparency is essential: metadata-based classification is clearly distinguished from independent behavioral analysis. A reported malware sample is not automatically treated as independently verified.

BastionGuard AV — Custom Antivirus Signature Database

One of ThreatMap CTI’s key capabilities is its integration with BastionGuard AV, enabling controlled creation and management of custom antivirus signatures compatible with ClamAV.

The platform supports:

• Collection of SHA-256 indicators associated with reported malware samples.

• Review of malware families and available technical evidence.

• Classification of antivirus signatures as Malware or Ransomware.

• Manual approval and revocation workflows.

• Technical descriptions for approved signatures.

• Creation of custom

  .hsb

  signature databases.

• A dedicated catalogue of approved detections.

Approved signature names follow the BastionGuard AV naming convention:

BastionGuardAV.Malware.<Family>-<ID>BastionGuardAV.Ransomware.<Family>-<ID>

This approach establishes a structured foundation for maintaining an antivirus intelligence database under the BastionGuard AV identity.

Secure Administrative Console & Mandatory MFA

ThreatMap includes a dedicated administrative security console, separated from its public intelligence dashboard.

The administrative system is designed around strict controls for sensitive operations:

• Administrator-only access.

• Mandatory multi-factor authentication (MFA).

• TOTP authentication with authenticator applications.

• QR-code-based MFA enrollment.

• Fresh MFA verification for every signature approval or revocation.

• Protection against TOTP code reuse.

• Audit logging of administrative decisions.

• Controlled management of antivirus signatures.

These safeguards help prevent unauthorized changes to the signature database and support accountability throughout the approval process.

Private Antivirus Signature Distribution

ThreatMap also provides a private distribution mechanism for approved BastionGuard AV signatures.

The database is designed to be retrieved through an HTTPS API using a dedicated, revocable, read-only access key.

This enables authorized BastionGuard AV installations to retrieve signature updates programmatically, including through

curl

, without requiring interactive MFA for each download.

The complete antivirus database remains separate from the public intelligence interface.

Public Intelligence Dashboard & Approved Signatures

ThreatMap CTI offers a publicly accessible, read-only dashboard without requiring user registration.

Visitors can explore the global threat map, review reported indicators, inspect their classifications, and understand the methodology behind the platform.

A dedicated Approved Signatures catalogue provides public information about analyst-approved antivirus detections, organized by category and accompanied by technical descriptions.

The platform also includes expandable intelligence tables, filtering tools, CSV export functionality, and responsive navigation designed to make complex security information easier to explore.

Threat Verification & Evidence Quality

ThreatMap emphasizes the importance of evidence quality and responsible threat verification.

Its architecture supports separating active URL verification from the public-facing intelligence service through isolated scanning components.

The platform distinguishes among reported indicators, technical observations, and analyst-confirmed findings.

This evidence-oriented approach is intended to reduce misleading classifications and improve the usefulness of collected cyber threat intelligence.

Building the Future of BastionGuard Security

ThreatMap CTI represents an important milestone in the continued development of the BastionGuard cybersecurity ecosystem.

By connecting threat intelligence collection, malicious infrastructure monitoring, malware classification, analyst review, and antivirus signature management, ThreatMap establishes a foundation for a more integrated and intelligence-driven security platform.

Our long-term mission is to strengthen the connection between threat research and practical defensive technologies while maintaining transparency, accuracy, and responsible security practices.

Cyber threats are constantly evolving. Our intelligence must evolve with them.

Explore ThreatMap CTI

Official Platform: https://threatmap.bastionguard.eu

Developed by BastionGuard

Cyber Threat Intelligence · Malware Research · Phishing Monitoring · Threat Mapping · Antivirus Signature Intelligence

ThreatMap CTI

Intelligence That Strengthens Protection.

Technical notice: ThreatMap CTI collects intelligence from third-party security sources. Source attribution does not automatically constitute independent malware verification. Antivirus detections are subject to an analyst review process, and geographic observations reflect hosting infrastructure rather than necessarily identifying threat actors. The availability and operational status of individual features may evolve as the platform develops.