Coordinated Cyber Threat Intelligence Ecosystem Manipulation: Multi-Feed Poisoning, SOC Detection Degradation, and a Resilience Framework

Modern Security Operations Centers (SOCs) rely on open-source Cyber Threat Intelligence (CTI) feeds as the foundation of automated threat detection. These feeds are trusted but not verified: no existing mechanism detects whether the intelligence consumed has been deliberately shaped by an adversary. This paper investigates coordinated CTI ecosystem manipulation, in which an adversary systematically poisons multiple feed layers simultaneously to create a detection blind spot timed to a real attack campaign. Four original contributions are presented: (1) the first taxonomy of coordinated CTI ecosystem manipulation techniques across four attack layers and three attacker capability levels, identifying 13 distinct techniques; (2) an empirical simulation demonstrating a detection rate drop from 88.0% at baseline to 46.0% under multi-feed poisoning, with a blind spotwindow of 4.3 minutes during active attack traffic; (3) a structured analyst survey revealing a severity underestimation rate of 87.5% and a manipulation detection rate of only 25.0% under poisoned feed conditions; and (4) a three-layer resilience framework com bining cross-feed consistency scoring, temporal anomaly detection, and provenance tracking, with open-source implementation guidance for Wazuh, MISP, and n8n environments. The results demonstrate that coordinated CTI poisoning is measurable, that analysts cannot reliably detect it without structured framework support, and that ecosystem-level validation is necessary to defend against this class of attack.