Cybersecurity Blog

Cybersecurity Research from the Front Lines

Threat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn from the global network visibility we maintain across the internet.

Who
Team Cymru's own threat analysts and researchers, writing from the investigations they run.
What
Named threat actors, mapped command-and-control infrastructure, ransomware toolkit teardowns, and the pivot methodology behind them. 150+ posts and counting.
How
Sourced from Team Cymru's own internet-scale network telemetry. We analyze what we see directly, not third-party feeds or aggregated reporting.
When
New analysis every week, plus rapid posts when a campaign breaks.
Why
So defenders get operational detail they can act on inside a SOC or intel workflow. Published in full, with no gate and no registration wall.
Filter
Sorted Newest first
Jeremy Bender
2
min read

Cybersecurity in the Public Sector: Two CISOs’ Views on the Future of Threat Intelligence

Incident Response & Preemptive Defense
January 16, 2026
Hear how public sector CISOs think about cybersecurity. Michael Moore, CISO of Arizona’s Secretary of State, joins the Future of Threat Intelligence podcast.
Jeremy Bender
2
min read

Team Cymru and OpenCTI: Better Together for Threat Intelligence

SOC Enablement & Intelligence Enrichment
January 14, 2026
Accelerate triage and automate threat hunting with the Team Cymru and OpenCTI integration. Combine global visibility with open-source orchestration for faster defense.
Will Thomas
5
min read

Analysing Carding Infrastructure

SOC Enablement & Intelligence Enrichment
January 9, 2026
A cybercrime intelligence analysis of carding operations, detailing the infrastructure, hosting providers, and network patterns used to support carding activity.
Jeremy Bender
2
min read

RADAR Offers Full External Asset Discovery at the Click of a Button

Attack Surface & Exposure Visibility
January 5, 2026
Stop chasing unknown assets. Learn how RADAR provides a full footprint of internet-exposed assets and CVE context in minutes using a single search.
Jeremy Bender
2
min read

Team Cymru Supports INTERPOL in Coordinated Operation Across Africa as Part of Operation Sentinel

Incident Response & Preemptive Defense
December 22, 2025
Team Cymru partners with INTERPOL in Operation Sentinel to dismantle BEC and ransomware networks across Africa. See how 573 arrests and $3M in recoveries were made.
Eli Woodward
2
min read

The Indictment Is the IOC: Using Legal Records to Hunt DPRK Remote Workers

Threat Actor, Campaign & Infrastructure Intelligence
December 18, 2025
Stop hunting for North Korean malware and start hunting for North Korean behavior. See how Eli Woodward uses criminal indictments and Team Cymru’s global telemetry to surface DPRK remote worker infrastructure by identifying subtle TTP patterns.
Jeremy Bender
3
min read

Query Scout in Synapse Enterprise With New Power-Up for Team Cymru

SOC Enablement & Intelligence Enrichment
December 17, 2025
Instantly run Team Cymru Scout queries on the Pure Signal™ data ocean directly within Synapse Enterprise. See how to hunt for phishing infrastructure, analyze communication patterns, and unpack malicious IPs for frictionless, confident analysis.
3
min read

From Discovery to Attribution, RADAR Makes Threat Hunting Seamless

Threat Hunting & Detection Engineering
December 11, 2025
Learn how RADAR’s pivot feature automatically generates queries in Scout, allowing analysts to move from infrastructure discovery to threat attribution seamlessly.
Jeremy Bender
1
min read

RADAR Takes the Guess Work Out of Vulnerability Exposure Management

Attack Surface & Exposure Visibility
December 4, 2025
Stop manual asset inventory. RADAR automatically discovers all internet-facing infrastructure and filters for CISA KEVs within seconds. Get a prioritized, actionable list of risks. Learn how.
Jacomo Piccolini
3
min read

Team Cymru and Abusix Partner to Eradicate Botnets

Real-Time Threat Detection & Signals
December 3, 2025
Team Cymru's threat intelligence and Abusix's reporting join forces to close the loop on botnet infections. Learn how the partnership systematically eradicates Mirai.
Jeremy Bender
2
min read

Minimize Partner Risk with RADAR's Third-Party Infrastructure Mapping

Fraud, Phishing & Supply Chain Risk
December 2, 2025
Stop guessing about partner security. RADAR, powered by PureSignal, maps all third-party infrastructure for 100% visibility. Get real-time vulnerability insights without noisy active scans. Learn more
Jeremy Bender
2
min read

With RADAR, Never Worry About Losing Sight of Exposed Assets

SOC Enablement & Intelligence Enrichment
November 19, 2025
Stop losing sight of exposed assets and shadow IT. RADAR provides instant, complete visibility into your entire digital footprint and third-party suppliers, without noisy scanning. Learn how to get started today.

Stay in the loop

Stay current with Team Cymru insights

Get the latest research, articles, and threat intelligence resources, delivered straight to your inbox.

Engage with Team Cymru and the Threat Intelligence Community

Connect with the global defender community and stay current with Team Cymru research, events, and news.

CommunityJoin the defender community.Where threat hunters, CSIRTs, and security operators share intelligence and build defense-in-depth together.Connect with defenders EventsMeet defenders in person.Team Cymru hosts RISE regional conferences and the annual Underground Economy gathering for vetted defenders.See upcoming events WebinarsWatch expert sessions.On-demand webinars from Team Cymru analysts and invited practitioners on threat intelligence and defender operations.Watch the webinars PodcastHear long-form conversations.Future of Threat Intelligence: conversations with security leaders and researchers shaping the next generation of defense.Hear the conversations Press ReleasesGet it from the source.Company announcements, product launches, partnerships, and operational milestones, straight from Team Cymru.Read press releases