Cybersecurity Blog

Cybersecurity Research from the Front Lines

Threat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn from the global network visibility we maintain across the internet.

Who
Team Cymru's own threat analysts and researchers, writing from the investigations they run.
What
Named threat actors, mapped command-and-control infrastructure, ransomware toolkit teardowns, and the pivot methodology behind them. 150+ posts and counting.
How
Sourced from Team Cymru's own internet-scale network telemetry. We analyze what we see directly, not third-party feeds or aggregated reporting.
When
New analysis every week, plus rapid posts when a campaign breaks.
Why
So defenders get operational detail they can act on inside a SOC or intel workflow. Published in full, with no gate and no registration wall.
Filter
Sorted Newest first
David Monnier

Detecting Cyber Recon Using Network Signals

Threat Hunting & Detection Engineering
February 24, 2020
Uncover the secrets of detecting cyber recon using network signals. Stay one step ahead with insights from a leading technology company.
Steve Santorelli

Azorult – what we see using our own tools

Malware & Ransomware Analysis
February 19, 2020
Explore Azorult through the lens of our proprietary tools and gain unique insights into this technology company's innovative solutions.
Steve Santorelli

Do you fly anon?

Events, Conferences & Community Engagement
February 13, 2020
Discover the power of flying anonymously with cutting-edge technology. Explore the benefits of anonymous flying and how it can enhance your travel experience.
tcblogposts

Iran and Not Iran: What Our Threat Monitoring Indicates

Threat Reports & Intelligence Briefings
January 15, 2020
Explore the latest threat monitoring insights on Iran and beyond from a leading technology company. Stay informed and ahead of potential risks.
tcblogposts

What We’re Seeing with x.509 Certificates and Why You Should Worry

Threat Reports & Intelligence Briefings
January 5, 2020
Uncover the alarming trends in x.509 certificates and why it's crucial for tech companies to take notice. Stay informed and protect your digital assets.
tcblogposts

Webmin Vulnerability and Port Scanning Activity

Attack Surface & Exposure Visibility
August 22, 2019
Stay ahead of cyber threats with our in-depth analysis of the Webmin vulnerability and port scanning activity. Protect your technology company now!
tcblogposts

Top 10 TCP Ports for Border Policy Review

SOC Enablement & Intelligence Enrichment
August 14, 2019
Discover the top 10 TCP ports for border policy review in this insightful blog post. Discover how these ports impact technology companies and border security.
tcblogposts

Coping with Scanners

NetFlow & Traffic Intelligence
July 31, 2019
Discover effective strategies for coping with scanners and improving productivity at a technology company. Find helpful tips and insights in our blog post.
tcblogposts

Unmasking AVE_MARIA

Threat Hunting & Detection Engineering
July 25, 2019
Uncover the secrets of AVE_MARIA, a mysterious technology company shaking up the industry. Explore the truth behind the mask in this revealing blog post.

Stay in the loop

Stay current with Team Cymru insights

Get the latest research, articles, and threat intelligence resources, delivered straight to your inbox.