Cybersecurity Blog

Cybersecurity Research from the Front Lines

Threat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn from the global network visibility we maintain across the internet.

Who: Team Cymru's own threat analysts and researchers, writing from the investigations they run.
What: Named threat actors, mapped command-and-control infrastructure, ransomware toolkit teardowns, and the pivot methodology behind them. 150+ posts and counting.
How: Sourced from Team Cymru's own internet-scale network telemetry. We analyze what we see directly, not third-party feeds or aggregated reporting.
When: New analysis every week, plus rapid posts when a campaign breaks.
Why: So defenders get operational detail they can act on inside a SOC or intel workflow. Published in full, with no gate and no registration wall.

FilterTopicAuthor

Sorted Newest first

Unmasking DPRK Cyber Threat Actors: Fake IT Worker Infrastructure & Post-Exposure Analysis

Threat Actor, Campaign & Infrastructure Intelligence

Uncover how DPRK cyber threat actors use fake IT schemes, Astrill VPN, and freelance platforms to infiltrate networks. Learn to spot these advanced persistent threats.

Cyber security intelligence analysis of attacks on edge devices amid growing vulnerabilities

Cyber Security Intelligence: Analysis of Edge Devices Amid Growing Vulnerabilities

Threat Reports & Intelligence Briefings

Cisco, Ivanti & Fortinet edge device attacks are rising. Read our cybersecurity intelligence on cybersecurity trends and attack patterns.

Stranger Strings: Yurei Ransomware Operator Toolkit Exposed

Malware & Ransomware Analysis

Analyze the Yurei double extortion ransomware campaign, including its toolkit, attack lifecycle, and key tactics used by operators.

Industrial Cybersecurity Risks from Internet-Exposed ICS Devices

SOC Enablement & Intelligence Enrichment

Industrial cybersecurity analysis of exposed ICS and OT devices. Discover how attackers target critical infrastructure and how defenders can detect exposed systems.

From Developer to Product Owner: The Fundamental Shifts from Generative AI

Securing AI & Limits of Machine Learning

Generative AI handles the plumbing. Learn how AI threat intelligence tools empower analysts to outpace threat actors and become true product owners.

Team Cymru Partners with DOJ to Disrupt World’s Largest IoT DDoS Botnets

Incident Response & Preemptive Defense

Team Cymru partners with the DOJ to dismantle Aisuru, KimWolf, JackSkid & Mossad botnets. See how global network visibility and community-driven intel stopped 30 Tbps attacks.

The Beast Returns: Analysis of a Beast Ransomware Server

Real-Time Threat Detection & Signals

Explore our latest threat intelligence report on Beast Ransomware. See the exact incident response tools and TTPs used by operators to bypass EDR and delete backups.

Duaine Labno on Digital Investigations and Corporate Threat Intelligence

Threat Reports & Intelligence Briefings

Explore how digital investigations support corporate threat intelligence, fraud response, and cyber threat investigation with Duaine Labno of TIG Risk Services.

Cybersecurity Incident Response at Thermo Fisher: How the Ransomware Landscape Has Evolved

Incident Response & Preemptive Defense

Explore how ransomware and incident response have evolved with Matt McKnew of Thermo Fisher. Learn about the shift to RaaS and the rise of DPRK fake IT worker scams.

GRIMBOLT C2 Infrastructure Recon: Pivoting From One IP to a Mapped Cluster

Threat Actor, Campaign & Infrastructure Intelligence

Explore how to Map GRIMBOLT C2 infrastructure linked to UNC6201 by pivoting from one IP using WHOIS, PDNS, ports, and X509 certificate fingerprints.

What Helping Secure SMBs Shows About Attack Trends

Threat Reports & Intelligence Briefings

Explore SMB ransomware and the latest cybersecurity trends with Alex Bovicelli of Tokio Marine HCC. Learn why securing initial access vectors is the key to proactive defense

Tracking CyberStrikeAI Usage

Threat Actor, Campaign & Infrastructure Intelligence

Discover how CyberStrikeAI is revolutionizing AI-augmented offensive security. Explore its ties to Chinese state-sponsored actors and learn to detect it with NetFlow.

Stay in the loop

Stay current with Team Cymru insights

Get the latest research, articles, and threat intelligence resources, delivered straight to your inbox.

Engage with Team Cymru and the Threat Intelligence Community

Connect with the global defender community and stay current with Team Cymru research, events, and news.

CommunityJoin the defender community.Where threat hunters, CSIRTs, and security operators share intelligence and build defense-in-depth together.Connect with defenders EventsMeet defenders in person.Team Cymru hosts RISE regional conferences and the annual Underground Economy gathering for vetted defenders.See upcoming events WebinarsWatch expert sessions.On-demand webinars from Team Cymru analysts and invited practitioners on threat intelligence and defender operations.Watch the webinars PodcastHear long-form conversations.Future of Threat Intelligence: conversations with security leaders and researchers shaping the next generation of defense.Hear the conversations Press ReleasesGet it from the source.Company announcements, product launches, partnerships, and operational milestones, straight from Team Cymru.Read press releases