bot/telegram-rss-bot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ransomware.live integration, 48h window, CISA feeds, validation updates, README

Browse Source
This commit is contained in:
bot
2026-04-29 11:24:23 +03:00
parent 898909e061
commit ad69c6a266
6 changed files with 604 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+85 -34
View File
@@ -1,6 +1,6 @@
# telegram-rss-bot
Telegram bot that monitors cybersecurity RSS feeds and delivers real-time alerts. Articles are classified by severity and quality before delivery.
Telegram bot that monitors cybersecurity RSS feeds and ransomware.live victim data, delivering real-time alerts to Telegram topics. Articles are enriched with CVEs, threat actors, and malware families extracted from content.
## Project Structure
@@ -8,17 +8,22 @@ Telegram bot that monitors cybersecurity RSS feeds and delivers real-time alerts
rss_telegram_bot/
├── threat_intel_bot.py # Main bot — commands, subscriptions, alert dispatch
├── rss_manager.py # Feed fetching, dedup, message formatting
├── content_classifier.py # Severity/quality scoring, CVE/actor/malware extraction
├── content_classifier.py # CVE/actor/malware extraction
├── ransomware_fetcher.py # ransomware.live PRO API — victim feed
├── check_feeds.py # CLI utility to check feed health
├── feeds/
│ ├── news_feeds.json
│ ├── malware_feeds.json
│ ├── threat_intel_feeds.json
│ ├── threat_intel_feeds.json # includes CISA Advisories, Alerts, ICS
│ ├── osint_feeds.json
│ └── research_feeds.json
├── .env # Not committed — BOT_TOKEN + optional filters
├── subscribers.json # Auto-managed — chat/topic subscriptions
└── seen_articles.db # SQLite — tracks sent articles (7-day retention)
├── validation/
│ ├── run_validation.py # continuous validation monitor (saves to results.jsonl)
│ └── review.py # pretty-print and filter results.jsonl
├── .env # not committed — see Setup
├── subscribers.json # auto-managed — chat/topic subscriptions
├── seen_articles.db # SQLite — tracks sent RSS articles (7-day retention)
└── seen_victims.db # SQLite — tracks sent ransomware victims (7-day retention)
```
## Setup
@@ -31,6 +36,7 @@ Create `.env`:
```env
BOT_TOKEN=your_token_here
RANSOMWARE_LIVE_API_KEY=your_key_here # optional — register at api-pro.ransomware.live
```
Run:
@@ -52,23 +58,9 @@ Categories: `news`, `malware`, `threat_intel`, `osint`, `research`
**Telegram Topics:** Run `/on_<category>` inside each topic to route categories to separate threads.
## Feed Management
Each `feeds/*.json` file follows this structure:
```json
{
"category_name": {
"Feed Display Name": "https://example.com/rss.xml"
}
}
```
Add or remove feeds by editing the JSON, then restart the bot. Run `python3 check_feeds.py` to verify feed health before deploying.
## Message Format
Each alert follows this structure:
RSS articles:
```
{emoji} Title
@@ -83,19 +75,69 @@ Description
🔗 Read Full Article
```
The enrichment lines (CVEs, actors, malware) only appear when the classifier finds something — clean articles stay minimal.
Ransomware victims (posted to the malware topic):
```
🦠 company.com claimed by LockBit
Sector: Finance | Country: US
Data description from leak post
📡 ransomware.live · Published (UTC)
🦠 Lockbit
🔗 View on ransomware.live
```
Enrichment lines only appear when the classifier finds something — clean articles stay minimal.
## Data Sources
### RSS Feeds (64 feeds across 5 categories)
| Category | Sources |
|---|---|
| `news` | Krebs, Bleeping Computer, The Hacker News, Security Week, Dark Reading, The Record, Cyberscoop, NCSC UK, and others |
| `threat_intel` | CISA Advisories, CISA Alerts, CISA ICS, SANS ISC, Unit42, Mandiant, Cisco Talos, Microsoft MSRC, and others |
| `malware` | Malware Traffic Analysis, Kaspersky Securelist, Security Affairs, Sekoia, and others |
| `osint` | DataBreaches.net, Have I Been Pwned, UpGuard, Vulmon Research |
| `research` | Google Project Zero, watchTowr Labs, SpecterOps, Synacktiv, Doyensec, NCC Group, and others |
Add or remove feeds by editing the relevant `feeds/*.json` file, then restart the bot. Run `python3 check_feeds.py` to verify health before deploying.
### ransomware.live PRO API
When `RANSOMWARE_LIVE_API_KEY` is set, the bot polls the PRO API every 5 minutes for newly discovered ransomware victims. New entries are posted to the `malware` topic. Victims are tracked in `seen_victims.db` with 7-day retention.
## Classification
`content_classifier.py` extracts the following from article title + description:
**CVEs** — standard `CVE-YYYY-NNNNN` pattern matching.
**CVEs** — `CVE-YYYY-NNNNN` regex pattern.
**Threat actors** — APT groups and named adversaries: APT28/29/40/41, Lazarus, Sandworm, Volt Typhoon, Scattered Spider, FIN7, and others defined in `THREAT_ACTORS`.
**Threat actors** — APT groups and named adversaries including APT28/29/40/41, Lazarus, Sandworm, Volt Typhoon, Scattered Spider, FIN7, and others. Full list in `THREAT_ACTORS`.
**Malware families** — ransomware, C2 frameworks, loaders, stealers, and APT tooling: LockBit, Cobalt Strike, Emotet, QakBot, Sliver, PlugX, and others defined in `MALWARE_FAMILIES`. To add a family, append its display name to the set — matching is case-insensitive with word-boundary checking to avoid false positives.
**Malware families** — ransomware, C2 frameworks, loaders, stealers, APT tooling: LockBit, Cobalt Strike, Emotet, QakBot, Sliver, PlugX, and others. Full list in `MALWARE_FAMILIES`. Matching is case-insensitive with word-boundary checking. To add a family, append its display name to the set.
Severity and quality scoring were intentionally removed — the extracted enrichment fields (CVEs, actors, malware) give the reader enough context to judge importance themselves.
Severity and quality scoring are intentionally absent — the enrichment fields give enough context for the reader to judge importance.
## Validation
A separate monitor for testing without affecting the production bot:
```bash
# runs continuously, same poll cycle as the bot
python3 validation/run_validation.py
# review collected results
python3 validation/review.py # all results
python3 validation/review.py --category research # filter by category
python3 validation/review.py --has cves # only articles with CVEs
python3 validation/review.py --has malware # only articles with malware hits
python3 validation/review.py --today # only today's run
```
Results are saved to `validation/results.jsonl`. Each line is a JSON object with a `type` field (`article` or `victim`) so RSS articles and ransomware victims can be filtered separately.
## Systemd Service (VPS)
@@ -108,10 +150,10 @@ After=network.target
[Service]
Type=simple
User=your_user
WorkingDirectory=/home/your_user/rss_telegram_bot
EnvironmentFile=/home/your_user/rss_telegram_bot/.env
ExecStart=/usr/bin/python3 threat_intel_bot.py
User=root
WorkingDirectory=/root/tele-bots/rss_splited_bot
EnvironmentFile=/root/tele-bots/rss_splited_bot/.env
ExecStart=/root/tele-bots/rss_splited_bot/venv/bin/python3 threat_intel_bot.py
Restart=always
RestartSec=10
@@ -125,9 +167,18 @@ sudo systemctl enable --now rss-bot
sudo journalctl -u rss-bot -f
```
## Deploying Updates
From the local project directory:
```bash
rsync -avz ransomware_fetcher.py threat_intel_bot.py rss_manager.py content_classifier.py feeds/threat_intel_feeds.json feeds/news_feeds.json feeds/research_feeds.json root@deployer:/root/tele-bots/rss_splited_bot/
ssh root@deployer "systemctl restart rss-bot"
```
## Notes
- First run marks all current articles as seen — no flood on startup
- Polling interval: 5 minutes (`asyncio.sleep(300)` in `threat_intel_bot.py`)
- Only today's UTC articles are processed (strict date gate in `rss_manager.py`)
- `seen_articles.db` auto-purges entries older than 7 days
- First run marks all current articles and victims as seen — no flood on startup
- Polling interval: 5 minutes
- Articles published within the last 48 hours are processed (rolling window, not calendar day)
- `seen_articles.db` and `seen_victims.db` auto-purge entries older than 7 days