Cyber threat signals are fragmented across multiple social media platforms, yet no existing approach has fully automated their integration into actionable threat intelligence (TI) reports. We present TIBlender, a multi-agent system that monitors four platforms (X, Reddit, Telegram, and Discord) and produces structured TI reports via role-specialized LLM agents. These agents conduct multi-perspective investigations, tracing chains of evidence to uncover related Indicators of Compromise (IoCs) via collaborative, evidence-backed analysis. In a real-world deployment, TIBlender detected emerging threats across all four threat categories ahead of public feeds, including in-the-wild exploitation ahead of public vulnerability registries; the majority of its IoCs were absent from each evaluated feed. Quantitative evaluation confirms that each platform contributes unique threat information unavailable from the others, and that excluding any single platform results in substantial loss of reports in specific threat categories. Under identical single-platform input conditions, TIBlender's IoC extraction meets or exceeds each baseline; the full pipeline surfaces substantially more IoCs, most of which are absent from any single-platform baseline. These results establish cross-platform social media monitoring as an effective and scalable early-warning layer for operational TI pipelines.

翻译：网络威胁信号分散在多个社交媒体平台上，但现有方法尚未实现将其完全自动化整合为可操作的威胁情报（TI）报告。我们提出TIBlender，一个多智能体系统，用于监控四个平台（X、Reddit、Telegram和Discord），并通过角色专业化的大语言模型智能体生成结构化TI报告。这些智能体进行多视角调查，追溯证据链，通过协作式基于证据的分析揭示相关危害指标（IoC）。在实际部署中，TIBlender在公共信息流之前检测到所有四类威胁类别中的新兴威胁，包括在公共漏洞注册库之前发现野外利用；其多数IoC在评估的每个信息流中均未被收录。定量评估证实，每个平台提供其他平台无法获得的独特威胁信息，且排除任何单一平台将导致特定威胁类别报告的显著损失。在相同单平台输入条件下，TIBlender的IoC提取达到或超过所有基线；完整流程揭示了大量额外IoC，其中多数未出现在任何单平台基线中。这些结果确立了跨平台社交媒体监测作为可扩展的早期预警层对于运营级TI流程的有效性。