Cybersecurity Blog

Cybersecurity Research from the Front Lines

Threat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn from the global network visibility we maintain across the internet.

Who
Team Cymru's own threat analysts and researchers, writing from the investigations they run.
What
Named threat actors, mapped command-and-control infrastructure, ransomware toolkit teardowns, and the pivot methodology behind them. 150+ posts and counting.
How
Sourced from Team Cymru's own internet-scale network telemetry. We analyze what we see directly, not third-party feeds or aggregated reporting.
When
New analysis every week, plus rapid posts when a campaign breaks.
Why
So defenders get operational detail they can act on inside a SOC or intel workflow. Published in full, with no gate and no registration wall.
Filter
Sorted Newest first
Rob Thomas
3
min read

Celebrating a Milestone - Over 1.5 Billion Daily Queries on Our IP to ASN Mapping Service

Incident Response & Preemptive Defense
November 8, 2024
Team Cymru’s IP to ASN service now handles 1.5B+ daily queries—thanks to our community for supporting our mission to save and improve human lives.
S2 Research Team
3
min read

Team Cymru Supports INTERPOL’s Operation Synergia II to Dismantle 22,000 Cybercrime Servers

Incident Response & Preemptive Defense
November 5, 2024
Team Cymru helped INTERPOL dismantle 22K cybercrime servers across 95 countries in Operation Synergia II, disrupting phishing, malware, and ransomware threats.
Introduction to Operational Relay Box (ORB) networks used by threat actors to obscure malicious activity
S2 Research Team
8
min read

An Introduction to Operational Relay Box (ORB) Networks - Unpatched, Forgotten, and Obscured

Threat Actor, Campaign & Infrastructure Intelligence
October 29, 2024
Explore how threat actors use Operational Relay Box (ORB) networks to evade detection, hide malicious activity, and complicate cyber defense efforts. Talk to an expert.
Dan Schoenbaum
4
min read

Announcing the Team Cymru Scout Integration With Palo Alto Cortex XSOAR

SOC Enablement & Intelligence Enrichment
October 26, 2024
Enhance threat response with Team Cymru Scout’s IP and domain intelligence, now integrated into Palo Alto Cortex XSOAR for automation and real-time insights.
tcblogposts
3
min read

Talent and Technology: Bridging the Gap in Modern Threat Hunting Programs

Threat Hunting & Detection Engineering
September 17, 2024
Discover how the right tools and trained analysts can boost threat hunting and shift your security program from reactive defense to proactive reconnaissance.
tcblogposts
8
min read

What is Threat Intelligence?

Malware & Ransomware Analysis
September 14, 2024
Learn what threat intelligence is, why it matters, and how it helps organizations detect, prevent, and respond to cyber threats with real-time, actionable insights.
tcblogposts
3
min read

How Effective Threat Hunting Programs are Shaping Cybersecurity

Threat Hunting & Detection Engineering
September 10, 2024
Boost cybersecurity with better threat hunting. Explore how tools, talent, and data help teams detect and prevent threats earlier. Visit our website.
tcblogposts
4
min read

The Evolution of Threat Hunting

Threat Reports & Intelligence Briefings
September 3, 2024
Discover how 2024's threat hunting programs are evolving with better tools, skilled analysts, and proactive strategies to stay ahead of cyber threats. Talk to an expert.
S2 Research Team
4
min read

Insights into a “Cyber Attack” against the Venezuelan National Electoral Council

Malware & Ransomware Analysis
August 29, 2024
Analyze the suspected cyber attack on Venezuela's National Electoral Council during the 2024 elections, including network traffic and DDoS attack insights.
tcblogposts
3
min read

How Security Teams are Strengthening Their Threat Hunting

Threat Hunting & Detection Engineering
August 27, 2024
Discover how security teams are strengthening their threat hunting programs with the right tools, training, and strategies to proactively prevent cyber attacks.
S2 Research Team
6
min read

FIN7: The Truth Doesn't Need to be so STARK

Incident Response & Preemptive Defense
August 13, 2024
Explore how Silent Push, Stark, and Team Cymru joined forces to disrupt FIN7’s malicious activities and uncover critical threat intelligence. Learn more.
S2 Research Team
7
min read

Botnet 7777: Are You Betting on a Compromised Router?

Threat Reports & Intelligence Briefings
August 8, 2024
Quad7 botnet evolves: Over 12K infected routers found, including new ASUS-based 63256 bots. Learn how to identify, track, and defend against this threat.

Stay in the loop

Stay current with Team Cymru insights

Get the latest research, articles, and threat intelligence resources, delivered straight to your inbox.

Engage with Team Cymru and the Threat Intelligence Community

Connect with the global defender community and stay current with Team Cymru research, events, and news.

CommunityJoin the defender community.Where threat hunters, CSIRTs, and security operators share intelligence and build defense-in-depth together.Connect with defenders EventsMeet defenders in person.Team Cymru hosts RISE regional conferences and the annual Underground Economy gathering for vetted defenders.See upcoming events WebinarsWatch expert sessions.On-demand webinars from Team Cymru analysts and invited practitioners on threat intelligence and defender operations.Watch the webinars PodcastHear long-form conversations.Future of Threat Intelligence: conversations with security leaders and researchers shaping the next generation of defense.Hear the conversations Press ReleasesGet it from the source.Company announcements, product launches, partnerships, and operational milestones, straight from Team Cymru.Read press releases