The Cybersecurity and Infrastructure Security Agency has released a new open-source malware and forensic analysis platform designed to help analysts automate large-scale threat detection.
Developed in partnership with Sandia National Laboratories, the platform, called Thorium, allows users to integrate custom, commercial and open-source analysis tools and enables automated, customizable analysis workflows, CISA said Thursday.
Join the Potomac Officers Club’s 2025 Homeland Security Summit to learn more about the latest in U.S. homeland security programs, efforts and strategic initiatives.
Thorium Accelerates Malware Analysis
Cybersecurity teams can also filter tool results using tags and full-text search; use strict group-based permissions to control access to submissions, tools and results; scale with hardware using Kubernetes and ScyllaDB to meet workload requirements; and import and export tools for ease of sharing across cyber defense teams.
The platform can ingest over 10 million files per hour and run more than 1,700 jobs per second, while maintaining a fast results query. Thorium is now publicly available through GitHub.
“The Thorium framework underscores CISA’s focus and commitment to provide valuable services and resources at scale that help government and critical infrastructure protect against cyber threats and strengthen their cybersecurity,” said Jermaine Roebuck, CISA associate director for threat hunting. “By publicly sharing this platform, we empower the broader cybersecurity community to orchestrate the use of advanced tools for malware and forensic analysis.”
