Cybersecurity Blog

Cybersecurity Research from the Front Lines

Threat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn from the global network visibility we maintain across the internet.

Who: Team Cymru's own threat analysts and researchers, writing from the investigations they run.
What: Named threat actors, mapped command-and-control infrastructure, ransomware toolkit teardowns, and the pivot methodology behind them. 150+ posts and counting.
How: Sourced from Team Cymru's own internet-scale network telemetry. We analyze what we see directly, not third-party feeds or aggregated reporting.
When: New analysis every week, plus rapid posts when a campaign breaks.
Why: So defenders get operational detail they can act on inside a SOC or intel workflow. Published in full, with no gate and no registration wall.

FilterTopicAuthor

Sorted Newest first

From Serengeti to Serengeti III: What Three INTERPOL Operations Reveal

Incident Response & Preemptive Defense

October 22, 2026

INTERPOL’s Operation Serengeti has led to 3,677 arrests across three operations since 2024. What changed from Serengeti to III, and what it means for defenders.

LegionRelay: Ukraine Targeted by Five Previously Unidentified C2 Servers

Threat Actor, Campaign & Infrastructure Intelligence

October 14, 2026

See how threat hunting in Team Cymru Scout surfaced five previously unreported LegionRelay C2 servers tied to a Russia-aligned campaign targeting Ukraine.

Relaying to the Frontier

Threat Actor, Campaign & Infrastructure Intelligence

September 22, 2026

Team Cymru uncovered self-hosted LLM gateways relaying pooled credentials to frontier models like Claude, enabling model distillation and abuse.

From the disk to the flows: ransomware infrastructure analysis of Akira, DragonForce, Clop, and other ransomware gangs

From the Disk to the Flows: Ransomware Infrastructure Analysis

Malware & Ransomware Analysis

September 15, 2026

A year of incident response data reveals how Akira, DragonForce & Clop build ransomware infrastructure — and how defenders can hunt it.

The transaction is the last step, not the first: spotting fraud attack patterns earlier with threat intelligence

The Transaction Is the Last Step, Not the First

Fraud, Phishing & Supply Chain Risk

September 2, 2026

Waiting for the transaction to catch fraud? You're already too late. Learn how tracking attack patterns in threat intelligence stops actors early.

Cl0p Til You Drop: Cl0p ransomware threat intelligence research on managed file transfer attack campaigns

Cl0p Til you Drop - 6 Years, 10 Campaigns, 8 Zero-Days

Malware & Ransomware Analysis

August 12, 2026

Analyze Cl0p ransomware's history of targeting MFT systems. Discover their attack pattern in threat intelligence to improve cyber attack surface reduction.

Behind the Panels: validating ShinyHunters phishing panel infrastructure through network telemetry

Stephen Campbell

Behind the Panels: Validating ShinyHunters Cluster A Infrastructure Through Network Telemetry

Threat Actor, Campaign & Infrastructure Intelligence

Use network telemetry to validate cyber threat actors' phishing infrastructure. Track ShinyHunters clusters and defend against SaaS data exfiltration.

From C2 Detection to Possible Victim Identification

Malware & Ransomware Analysis

Discover how to transition from C2 detection to possible victim identification. Improve your cyber incident response by tracking attacker infrastructure to compromised systems.

Modernizing Incident Response: 4 Steps to Bulletproof Your Windows Logging

Threat Reports & Intelligence Briefings

Improve your cyber incident response steps with our guide to bulletproof Windows logging. Discover incident response tools and how AI streamlines DFIR.

Cybercrime Doesn't Reinvent Itself. It Optimizes.

Malware & Ransomware Analysis

Discover how AI threat intelligence reveals cybercriminals' true tactics. Learn why agentic AI and automated threat detection are reshaping cybersecurity.

The Unclosed Gap: Why the 2026 DBIR Proves the Decisive Battle Happens Before the First Internal Alert

Attack Surface & Exposure Visibility

The 2026 DBIR reveals 88% of threats are external. Learn how Team Cymru's Pure Signal closes the visibility gap before internal alerts trigger.

Stephen Campbell

Targeting the Defense Industrial Base: What Network Telemetry Reveals About Nation-State Pre-Positioning

Attack Surface & Exposure Visibility

Discover how nation-states target the Defense Industrial Base via pre-positioning. Learn why network telemetry is crucial to detect these hidden cyber threats.

Stay in the loop

Stay current with Team Cymru insights

Get the latest research, articles, and threat intelligence resources, delivered straight to your inbox.

Engage with Team Cymru and the Threat Intelligence Community

Connect with the global defender community and stay current with Team Cymru research, events, and news.

CommunityJoin the defender community.Where threat hunters, CSIRTs, and security operators share intelligence and build defense-in-depth together.Connect with defenders EventsMeet defenders in person.Team Cymru hosts RISE regional conferences and the annual Underground Economy gathering for vetted defenders.See upcoming events WebinarsWatch expert sessions.On-demand webinars from Team Cymru analysts and invited practitioners on threat intelligence and defender operations.Watch the webinars PodcastHear long-form conversations.Future of Threat Intelligence: conversations with security leaders and researchers shaping the next generation of defense.Hear the conversations Press ReleasesGet it from the source.Company announcements, product launches, partnerships, and operational milestones, straight from Team Cymru.Read press releases