Cybersecurity Blog

Cybersecurity Research from the Front Lines

Threat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn from the global network visibility we maintain across the internet.

Who
Team Cymru's own threat analysts and researchers, writing from the investigations they run.
What
Named threat actors, mapped command-and-control infrastructure, ransomware toolkit teardowns, and the pivot methodology behind them. 150+ posts and counting.
How
Sourced from Team Cymru's own internet-scale network telemetry. We analyze what we see directly, not third-party feeds or aggregated reporting.
When
New analysis every week, plus rapid posts when a campaign breaks.
Why
So defenders get operational detail they can act on inside a SOC or intel workflow. Published in full, with no gate and no registration wall.
Filter
Sorted Newest first
S2 Research Team

FIN8: BADHATCH Threat Indicator Enrichment

Threat Actor, Campaign & Infrastructure Intelligence
March 15, 2021
Uncover the latest threat indicators with our BADHATCH Threat Indicator Enrichment. Stay ahead of FIN8 and protect your technology company from cyber attacks.
Steve Santorelli

Interviews from The Underground Economy Conference – Part 1

Events, Conferences & Community Engagement
March 12, 2021
Explore exclusive interviews from The Underground Economy Conference – Part 1, featuring insights and perspectives from leaders in the underground economy.
James Shank

Taking Down Emotet

Incident Response & Preemptive Defense
January 27, 2021
Learn how a leading Technology Company successfully dismantled Emotet, the notorious malware, and secured its systems against future cyber threats.
S2 Research Team

GhostDNSbusters (Part 3)

SOC Enablement & Intelligence Enrichment
January 26, 2021
Uncover the latest tech insights with GhostDNSbusters (Part 3) as we delve into the world of cybersecurity. Stay ahead with our expert analysis!
S2 Research Team

MoqHao Part 1: Identifying Phishing Infrastructure

Fraud, Phishing & Supply Chain Risk
January 10, 2021
Learn how MoqHao identifies phishing infrastructure in Part 1 of this insightful series. Discover how this knowledge benefits a Technology Company.
James Shank

Who Comes Knocking on Home Router Backdoors?

Threat Hunting & Detection Engineering
December 16, 2020
Uncover the hidden threats lurking behind your home router backdoors in this eye-opening blog post. Stay informed and keep your network secure!
S2 Research Team

Mapping out AridViper Infrastructure Using Recon’s Malware Module

Malware & Ransomware Analysis
December 16, 2020
Discover how AridViper, a leading technology company, utilizes Recon’s malware module to map out its infrastructure for enhanced security.
David Monnier

Tracking Botnets and other Threats with Team Cymru

Malware & Ransomware Analysis
November 4, 2020
Learn how Team Cymru uses cutting-edge technology to track botnets and other threats, providing invaluable insights for businesses and organizations.
James Shank

FlowSpec for DDoS

Routing, DNS & Certificate Security
October 29, 2020
Learn how implementing FlowSpec for DDoS protection can benefit your technology company. Find out how this innovative solution can safeguard your network.
S2 Research Team

GhostDNSbusters (Part 2)

Threat Reports & Intelligence Briefings
October 7, 2020
Uncover the latest in the battle against cyber threats with 'GhostDNSbusters (Part 2)', as we delve into the cutting-edge tactics of a leading Technology Company.
S2 Research Team

GhostDNSbusters

Threat Reports & Intelligence Briefings
September 8, 2020
Unleash the power of 'GhostDNSbusters' with cutting-edge technology solutions. Join the revolution with this innovative technology company.
James Shank

Emotet is back… and where are we?

Incident Response & Preemptive Defense
July 31, 2020
Discover the latest on Emotet's resurgence and its impact on the tech industry. Stay informed with insights from a leading technology company.

Stay in the loop

Stay current with Team Cymru insights

Get the latest research, articles, and threat intelligence resources, delivered straight to your inbox.