Cybersecurity Blog

Cybersecurity Research from the Front Lines

Threat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn from the global network visibility we maintain across the internet.

Who
Team Cymru's own threat analysts and researchers, writing from the investigations they run.
What
Named threat actors, mapped command-and-control infrastructure, ransomware toolkit teardowns, and the pivot methodology behind them. 150+ posts and counting.
How
Sourced from Team Cymru's own internet-scale network telemetry. We analyze what we see directly, not third-party feeds or aggregated reporting.
When
New analysis every week, plus rapid posts when a campaign breaks.
Why
So defenders get operational detail they can act on inside a SOC or intel workflow. Published in full, with no gate and no registration wall.
Filter
Sorted Newest first
Jeremy Bender
2
min read

What Cyber Insurance Claims Reveal About Real Cyber Risk

Malware & Ransomware Analysis
February 26, 2026
Learn how to reduce cybersecurity risks by analyzing ransomware attack trends and attacker behavior, featuring insights from Daniel Woods of Coalition.
2
min read

Team Cymru Partners with INTERPOL in Coordinated Operation Red Card 2.0

Malware & Ransomware Analysis
February 24, 2026
Team Cymru's NetFlow-powered intelligence supports INTERPOL’s Operation Red Card 2.0, disrupting international cyber fraud and malicious infrastructure.
Jeremy Bender
3
min read

Fraud Intelligence at Stripe: Inside the Financial Fraud Kill Chain

Fraud, Phishing & Supply Chain Risk
February 23, 2026
Learn how Stripe’s Vincent Passaro applies fraud intelligence to the financial fraud kill chain, breaking down account takeover and how to proactively defend.
4
min read

Protecting Critical National Infrastructure (CNI) through extended global visibility

Incident Response & Preemptive Defense
February 17, 2026
Adversaries are pre-positioning for destructive attacks on CNI. Learn how to track nation-state threat actors and ORB networks to harden the OT boundary "left of boom."
Will Thomas
3
min read

Tracking ORBs on Singapore's Telecommunications Networks

Threat Reports & Intelligence Briefings
February 11, 2026
APT attacks by UNC3886 target Singapore telecom using ORB networks. Learn practical ORB tracking techniques to uncover hidden infrastructure with Scout.
Jeremy Bender
2
min read

How AI-driven Threat Detection is Reshaping Threat Intelligence

AI-Driven Threats & Autonomous Security
February 10, 2026
Hear Fortinet’s Aamir Lakhani explain the role of AI in cybersecurity and how AI-driven threat detection is reshaping modern threat intelligence.
Eli Woodward
3
min read

MediaLand Isn't Dormant: The Reality of Active OFAC-Sanctioned Infrastructure

Malware & Ransomware Analysis
February 4, 2026
OFAC sanctions compliance goes beyond policy—sanctioned bulletproof hosting like MediaLand AS206728 remains an active risk for financial services.
Jeremy Bender
2
min read

Payment Fraud Detection: How ATO and Phishing Kits Drive Modern Abuse

Fraud, Phishing & Supply Chain Risk
February 3, 2026
Blake Butler of PayPal explains modern payment fraud detection, key payment fraud trends, and how ATO account takeover impacts platforms at scale.
Kyle Contorno
3
min read

Operationalize Pure Signal™ in OpenCTI

Threat Reports & Intelligence Briefings
January 30, 2026
Enhance your threat hunting in OpenCTI with Team Cymru’s Pure Signal™ data. Learn how to use dedicated Scout connectors for deep enrichment, infrastructure mapping, and automated STIX relationship graphing.
Jeremy Bender
2
min read

From Raw Intelligence to Validation: Thoughts on Operationalizing MITRE from a Cyber Threat Intelligence Director

SOC Enablement & Intelligence Enrichment
January 28, 2026
Stop siloing roles. Learn how to operationalize MITRE ATT&CK at a granular level to deprioritize vulnerabilities and build smarter, AI-assisted CTI workflows.
Will Thomas
5
min read

Scattered Spider Attacks | Infrastructure and TTP Analysis

NetFlow & Traffic Intelligence
January 21, 2026
An in-depth analysis of Scattered Spider attacks, detailing the group’s infrastructure usage and TTPs to help defenders detect and disrupt activity earlier.
Jeremy Bender
2
min read

Reducing Friction in Cyber Threat Intelligence: Views from a Director of Advanced Cyber Practices

Incident Response & Preemptive Defense
January 20, 2026
Learn how Casey Beaumont (Marsh McLennan) reduces incident response friction through unified leadership and discover the 4 critical questions for vendor breach assessments.

Stay in the loop

Stay current with Team Cymru insights

Get the latest research, articles, and threat intelligence resources, delivered straight to your inbox.

Engage with Team Cymru and the Threat Intelligence Community

Connect with the global defender community and stay current with Team Cymru research, events, and news.

CommunityJoin the defender community.Where threat hunters, CSIRTs, and security operators share intelligence and build defense-in-depth together.Connect with defenders EventsMeet defenders in person.Team Cymru hosts RISE regional conferences and the annual Underground Economy gathering for vetted defenders.See upcoming events WebinarsWatch expert sessions.On-demand webinars from Team Cymru analysts and invited practitioners on threat intelligence and defender operations.Watch the webinars PodcastHear long-form conversations.Future of Threat Intelligence: conversations with security leaders and researchers shaping the next generation of defense.Hear the conversations Press ReleasesGet it from the source.Company announcements, product launches, partnerships, and operational milestones, straight from Team Cymru.Read press releases