Cybersecurity Blog

Cybersecurity Research from the Front Lines

Threat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn from the global network visibility we maintain across the internet.

Who
Team Cymru's own threat analysts and researchers, writing from the investigations they run.
What
Named threat actors, mapped command-and-control infrastructure, ransomware toolkit teardowns, and the pivot methodology behind them. 150+ posts and counting.
How
Sourced from Team Cymru's own internet-scale network telemetry. We analyze what we see directly, not third-party feeds or aggregated reporting.
When
New analysis every week, plus rapid posts when a campaign breaks.
Why
So defenders get operational detail they can act on inside a SOC or intel workflow. Published in full, with no gate and no registration wall.
Filter
Sorted Newest first
S2 Research Team
4
min read

Insights into North Korean ‘Internet Outages’

Threat Reports & Intelligence Briefings
February 3, 2022
Explore the mystery behind North Korean 'Internet Outages' and gain insight into the technological implications in this intriguing blog post.
S2 Research Team
4
min read

Analysis of a Management IP Address linked to Molerats APT

Malware & Ransomware Analysis
January 26, 2022
Uncover the implications of a Molerats APT-linked management IP address, and the potential impact on a technology company. Dive into the analysis now!
S2 Research Team
4
min read

Webinject Panel Administration: A Vantage Point into Multiple Threat Actor Campaigns

Threat Reports & Intelligence Briefings
November 3, 2021
Uncover the tactics of threat actors with a deep dive into Webinject Panel Administration. Explore how this insight can benefit your technology company.
S2 Research Team
1
min read

Collaborative Research on the CONTI Ransomware Group

Threat Reports & Intelligence Briefings
October 5, 2021
Discover how a collaborative research effort on the CONTI Ransomware Group is shedding light on the latest cyber threats. Learn more on our blog!
Lewis Henderson
7
min read

Team Cymru’s Threat Hunting Maturity Model Explained - Part 2

Threat Hunting & Detection Engineering
September 2, 2021
Uncover the next level of threat hunting with Team Cymru's Maturity Model. Explore advanced strategies and insights in part 2 of this in-depth guide.
S2 Research Team
4
min read

MoqHao Part 1.5: High-Level Trends of Recent Campaigns Targeting Japan

Threat Reports & Intelligence Briefings
August 11, 2021
Explore the high-level trends of recent campaigns targeting Japan in MoqHao Part 1.5. Discover how technology companies are leveraging this valuable market.
Lewis Henderson
4
min read

Team Cymru’s Threat Hunting Maturity Model Explained - Part 1

Threat Hunting & Detection Engineering
August 9, 2021
Uncover the secrets of threat hunting maturity with Team Cymru's expert insights. Level up your cybersecurity game with this in-depth exploration.
S2 Research Team
3
min read

Enriching Threat Intelligence for the Carbine Loader Crypto-jacking Campaign

AI-Driven Threats & Autonomous Security
July 8, 2021
Discover how a technology company enriches threat intelligence for the Carbine Loader Crypto-jacking Campaign. Stay ahead of cyber threats with our expert insights.
S2 Research Team
9
min read

Transparent Tribe APT Infrastructure Mapping - Part 2

Threat Actor, Campaign & Infrastructure Intelligence
July 2, 2021
Transparent Tribe (APT36, Mythic Leopard, ProjectM, Operation C-Major) is the name given to a threat actor group largely targeting Indian entities and assets.
S2 Research Team
3
min read

Tracking BokBot (IcedID) Infrastructure

Threat Actor, Campaign & Infrastructure Intelligence
May 19, 2021
Uncover the intricate web of BokBot (IcedID) infrastructure with expert insights. Stay ahead of the game with our in-depth analysis.
S2 Research Team
4
min read

Transparent Tribe APT Infrastructure Mapping - Part 1

Threat Actor, Campaign & Infrastructure Intelligence
April 16, 2021
This is the first article of a two-part series on Transparent Tribe’s CrimsonRAT infrastructure. We have been tracking CrimsonRAT , Transparent Tribe’s most ubiquitous remote access tool, over a number of months.
Steve Santorelli
6
min read

Interviews from The Underground Economy Conference – Part 2

Events, Conferences & Community Engagement
April 8, 2021
Explore exclusive interviews from The Underground Economy Conference – Part 2, featuring insights from leaders in the technology industry and beyond.

Stay in the loop

Stay current with Team Cymru insights

Get the latest research, articles, and threat intelligence resources, delivered straight to your inbox.

Engage with Team Cymru and the Threat Intelligence Community

Connect with the global defender community and stay current with Team Cymru research, events, and news.

CommunityJoin the defender community.Where threat hunters, CSIRTs, and security operators share intelligence and build defense-in-depth together.Connect with defenders EventsMeet defenders in person.Team Cymru hosts RISE regional conferences and the annual Underground Economy gathering for vetted defenders.See upcoming events WebinarsWatch expert sessions.On-demand webinars from Team Cymru analysts and invited practitioners on threat intelligence and defender operations.Watch the webinars PodcastHear long-form conversations.Future of Threat Intelligence: conversations with security leaders and researchers shaping the next generation of defense.Hear the conversations Press ReleasesGet it from the source.Company announcements, product launches, partnerships, and operational milestones, straight from Team Cymru.Read press releases