Systems and methods for threat disruption

A non-transitory computer-readable medium having instructions stored thereon for execution by a server to implement a method for disrupting a detected cyberthreat, the method comprising the steps of:

• receiving a request, the request identifying suspected malicious content;
• identifying one or more indicators of compromise (IOCs) associated with the content;
• enriching the request with the IOCs;
• transmitting the request and the one or more IOCs to an analyst device;
• receiving a verification indication from the analyst device;
• and
• reporting the verified request and the one or more IOCs to a third-party, wherein reporting the verified request and the one or more IOCs to the third-party comprises:
• identifying an entity associated with the request:
• identifying a format associated with the entity;
• transforming the one or more IOCs based on the format;
• and
• transmitting the transformed one or more IOCs and the request to the entity.

A system for disrupting a detected cyberthreat, the system comprising a server, the server comprising a processor and a non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the processor to perform a method operable to:

• receive a request, the request identifying suspected malicious content;
• identify one or more indicators of compromise (IOCs) associated with the content;
• enrich the request with the IOCs;
• verify the request;
• and
• report the verified request and the one or more IOCs to a third-party, wherein reporting the verified request and the one or more IOCs to the third-party comprises:
• transmitting a first report to the third-party, the first report comprising the verified request and the one or more IOCs;
• obtaining one or more additional IOCs in a subsequent 24-hour time period;
• and
• transmitting a second report to the third-party, the second report comprising the verified request, the one or more IOCs, and the one or more additional IOCs.