Cybersecurity Blog

Cybersecurity Research from the Front Lines

Threat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn from the global network visibility we maintain across the internet.

Who
Team Cymru's own threat analysts and researchers, writing from the investigations they run.
What
Named threat actors, mapped command-and-control infrastructure, ransomware toolkit teardowns, and the pivot methodology behind them. 150+ posts and counting.
How
Sourced from Team Cymru's own internet-scale network telemetry. We analyze what we see directly, not third-party feeds or aggregated reporting.
When
New analysis every week, plus rapid posts when a campaign breaks.
Why
So defenders get operational detail they can act on inside a SOC or intel workflow. Published in full, with no gate and no registration wall.
Filter
Sorted Newest first
Lewis Henderson
8
min read

Risk Modeling and Real-Time Intelligence - Part 2

Threat Hunting & Detection Engineering
December 15, 2023
Learn how NIST 2.0 supports smarter risk modeling, supply chain security, and real-time intelligence to protect organizations of all sizes from cyber threats.
Lewis Henderson
5
min read

Risk Modeling and Real-Time Intelligence - Part 1

Threat Reports & Intelligence Briefings
November 29, 2023
Discover how DPRM solutions enhance cyber risk models, helping you assess vulnerabilities, prioritize threats, and support smart business decisions. Talk to an expert.
Lewis Henderson
7
min read

Threat Modeling and Real-Time Intelligence - Part 2

SOC Enablement & Intelligence Enrichment
November 13, 2023
Discover how real-time threat intel complements MITRE ATT&CK, offering dynamic visibility into adversaries and helping analysts outpace evolving threats.
Lewis Henderson
5
min read

Threat Modeling and Real-Time Intelligence - Part 1

Threat Actor, Campaign & Infrastructure Intelligence
November 3, 2023
Explore how real-time threat intelligence enhances threat modeling to proactively defend apps, infrastructure, and digital services from evolving cyber threats.
S2 Research Team
15
min read

Visualizing Qakbot Infrastructure Part II: Uncharted Territory

Malware & Ransomware Analysis
August 7, 2023
Explore Qakbot’s evolving C2 infrastructure through NetFlow analysis, revealing new servers, port trends, and insights into upstream communication layers.
S2 Research Team
11
min read

Inside the IcedID BackConnect Protocol (Part 2)

Threat Actor, Campaign & Infrastructure Intelligence
July 28, 2023
Browse new insights into IcedID's evolving BackConnect protocol—more C2 servers, shorter lifespans, and shifting post-compromise infrastructure tactics.
tcblogposts
4
min read

Unravelling the Mystery of Bogons: A senior stakeholder and IT professional guide

Threat Reports & Intelligence Briefings
July 19, 2023
Bogons are unassigned IPs that can enable cyberattacks. Learn why senior leaders and IT teams must act now to filter and defend against these hidden risks.
S2 Research Team
5
min read

Darth Vidar: The Aesir Strike Back

Attack Surface & Exposure Visibility
June 15, 2023
Discover how Vidar malware is expanding and masking its operations. Stay updated with key insights into infrastructure changes and tracking tips.
S2 Research Team
6
min read

Visualizing QakBot Infrastructure

Threat Actor, Campaign & Infrastructure Intelligence
May 17, 2023
Learn trends in QakBot C2 infrastructure with data-driven insights into affiliate behavior, upstream servers, and botnet activity patterns. Learn more.
S2 Research Team
5
min read

AllaKore(d) the SideCopy Train

Malware & Ransomware Analysis
April 19, 2023
Explore new findings on SideCopy’s use of AllaKore RAT, revealing connected C2 infrastructure and management activity linked to Pakistan-based threat actors.
tcblogposts
5
min read

Team Cymru Fatos vs Mitos

Threat Reports & Intelligence Briefings
April 19, 2023
Uncover the truth behind Team Cymru's Fatos vs Mitos in the technology world. Explore the myths and facts in this intriguing blog post.
S2 Research Team
5
min read

MoqHao Part 3: Recent Global Targeting Trends

Malware & Ransomware Analysis
March 17, 2023
Protect yourself from MoqHao and Roaming Mantis with insights from Team Cymru's ongoing analysis series on this dangerous malware family.

Stay in the loop

Stay current with Team Cymru insights

Get the latest research, articles, and threat intelligence resources, delivered straight to your inbox.

Engage with Team Cymru and the Threat Intelligence Community

Connect with the global defender community and stay current with Team Cymru research, events, and news.

CommunityJoin the defender community.Where threat hunters, CSIRTs, and security operators share intelligence and build defense-in-depth together.Connect with defenders EventsMeet defenders in person.Team Cymru hosts RISE regional conferences and the annual Underground Economy gathering for vetted defenders.See upcoming events WebinarsWatch expert sessions.On-demand webinars from Team Cymru analysts and invited practitioners on threat intelligence and defender operations.Watch the webinars PodcastHear long-form conversations.Future of Threat Intelligence: conversations with security leaders and researchers shaping the next generation of defense.Hear the conversations Press ReleasesGet it from the source.Company announcements, product launches, partnerships, and operational milestones, straight from Team Cymru.Read press releases