Site search

Search results

Search solutions, research, integrations and community tools.

All results

NetFlow Data That Reveals Threats Beyond Your Perimeter

See malicious infrastructure and attacker movement before damage is done. Team Cymru turns raw NetFlow data into decision-grade threat intelligence.

NetFlow Intelligence: Global Network Visibility You Can Act On.…

Spot Reconnaissance Before Compromise with NetFlow Threat Hunting

Attackers scout before they strike. Raw NetFlow reveals probing, staging, and beaconing across the internet so you can stop attacks before compromise.

NetFlow Advantage Use Case. Raw NetFlow Data for External Threat Reconnaissance. Detect probing and staging activity against critical infrastructure before compromise. Who. Threat hunters, SOC teams, and CTI teams defending critical infrastructure. What.…

Incident Root Cause Analysis That Prevents Repeat Attacks

Trace an attack from first access to today. Historical and live NetFlow data analysis finds the root cause, so you close the gap before attackers return.

NetFlow Advantage Use Case. Historical-to-Live NetFlow Playback for Incident Root Cause. Trace an attack chain from inception to current activity with decades of historical NetFlow data analysis. Who.…

Understanding NetFlow: A Useful Analogy to Get Started | Team Cymru

Explore how NetFlow helps monitor network traffic. A clever analogy in this blog makes a complex topic simple, engaging, and easy to grasp.

Want to learn more about NetFlow? Here's a useful analogy to get you started. The NetFlow Advantage. See the traffic behind the threat.…

Catch Compromised Vendors Early | Supply Chain Threat Monitoring

See which suppliers are talking to threat actor infrastructure within minutes. Validate vendor risk with live evidence, not static questionnaires.

NetFlow Advantage Use Case. NetFlow-Enabled Supply Chain Threat Surface Mapping. See active malicious connections within supplier and partner networks in real time. Who. CISOs, TPRM leaders, CTI teams, and threat hunters responsible for third-party risk.…

Network Traffic Analysis That Exposes Adversaries Early

See threat actor infrastructure in motion, not after the fact. Raw NetFlow gives your network traffic analysis live, full 5-tuple visibility at the source.

Raw NetFlow: the original record of network activity, with no vendor interpretation or bias. Why. Most tools alert after the breach. Raw NetFlow shows threats in motion, before they reach your network. How Cybersecurity Leaders Rethink Visibility.…

Threat Feed Integration for Automated Blocking in SIEM and SOAR

Stream raw NetFlow into your SIEM, SOAR, and TIP via API, STIX/TAXII, or MISP. Automate blocking and enrich alerts with C2 context before attacks land.

NetFlow Advantage Use Case. Direct Data Feeds into SIEM, SOAR. &. TIP Systems. Fuel existing defenses with raw NetFlow streams for automated blocking and enrichment. Who. SOC, SOAR, and CTI teams running SIEM, SOAR, and TIP systems. What.…

Map Botnet C2 Infrastructure Before Infections Spread

Attribute malware callbacks to the operators behind them. Map botnet C2 servers, proxy chains, and staging infrastructure before infections spread.

Uncover the structural visibility that NetFlow provides for botnet malware analysis across ecosystems. Trace Infected Hosts to Operator Nodes.…

Debunking Myths: Team Cymru's Fact-Based Insights

Separating myths from facts with Team Cymru. Learn the truth about cybersecurity and internet security with insights from a leading technology company.

Myth: ‚ÄúAugury also contains so-called netflow data ‚Ä¶ Netflow records can reveal which servers users connect to, often thereby revealing specific websites they visit.…

Pure Signal Scout Now Integrated with Google SecOps

Team Cymru's Pure Signal Scout now integrates with Google SecOps, adding internet-scale NetFlow context to investigations, threat hunting, and response.

This powerful combination delivers internet-scale netflow intelligence directly into your security operations workflow, transforming raw metadata into context-rich, actionable threat intelligence.…

Team Cymru Scout Integration with Palo Alto Cortex XSOAR | Team Cymru

Enhance threat response with Team Cymru Scout’s IP and domain intelligence, now integrated into Palo Alto Cortex XSOAR for automation and real-time insights.

Scout helps quickly determine if suspicious IPs are malicious or compromised and has underlying data - from NetFlow communications, Whois data, passive DNS records, X.509 certificates, and fingerprinting details‚Äî to power a complete investigation.…

Team Cymru Fatos vs Mitos: Unveiling the Truth

Uncover the truth behind Team Cymru's Fatos vs Mitos in the technology world. Explore the myths and facts in this intriguing blog post.

Mito: "Augury tamb√©m cont√©m os chamados dados netflow. Os registros Netflow podem revelar a quais servidores os usu√°rios se conectam, muitas vezes revelando sites espec√≠ficos que visitam.…

Unveiling MoqHao: The Phishing Infrastructure (Part 1)

Learn how MoqHao identifies phishing infrastructure in Part 1 of this insightful series. Discover how this knowledge benefits a Technology Company.

NETFLOW DATA. Looking at netflow, we see over 250 unique Japanese IP addresses connecting over TCP port 443 (HTTPS) to the IP addresses in Table 2.…

Google SecOps + Team Cymru | Scout Enrichment for SIEM and SOAR

Auto-enrich every IP on ingestion with Team Cymru Scout in Google SecOps. Playbooks to block IPs and open tickets are included at no extra cost.

Through a new integration - jointly developed by Team Cymru and Google - SecOps is now enriched with IP, domain and NetFlow intelligence provided by Team Cymru.…

Protecting Your Technology Company from Covid-19 Cyber Threats

Learn how the Covid-19 cyber threat DanaBot is impacting technology companies and what you can do to protect your business from this evolving danger.

Analysis included the use of the Augury™ Pure Signal™ platform to map netflow and the associated malicious infrastructure. NOTE: Organizations identified in this research were notified, as appropriate, prior to the publishing of both the blog and paper.…

From C2 Detection to Victim Identification | Team Cymru

Discover how to transition from C2 detection to possible victim identification. Improve your cyber incident response by tracking attacker infrastructure to compromised systems.

When an IP address is identified as command-and-control infrastructure, we can evaluate available NetFlow observations for sustained, high-confidence interactions with that controller.…

Unveiling Gamaredon: Understanding Victimology Through Recon

Uncover the tactics of Gamaredon cyberattacks and gain a deeper understanding of victimology through reconnaissance. Explore the latest insights and analysis.

Based on these findings, Team Cymru‚Äôs NetFlow data was queried for the two IP addresses identified above, specifically focusing on inbound TCP/80 traffic.…

Coping with Scanners: Practical Tips from Team Cymru

Discover effective strategies for coping with scanners and improving productivity at a technology company. Find helpful tips and insights in our blog post.

The NetFlow Advantage. See the traffic behind the threat. Research like this starts with global visibility into internet traffic beyond your own edge: who talked to whom, when, and from where. See the NetFlow Use Cases →. Pure Signal™ Command.…

Iran and Not Iran: Threat Monitoring Insights by Team Cymru

Explore the latest threat monitoring insights on Iran and beyond from a leading technology company. Stay informed and ahead of potential risks.

Do you collect network flows, such as Netflow, sFlow, or IPFIX? Send these to a collector and baseline your network. Flows can be used for alerting on raw traffic counts, as well as changes in sources and destinations of traffic.…

Beast Ransomware Toolkit: A Proactive Threat Intelligence Report

Explore our latest threat intelligence report on Beast Ransomware. See the exact incident response tools and TTPs used by operators to bypass EDR and delete backups.

This includes global NetFlow communications and open ports data, among other types of data such as X509 certificates, passive DNS, and WHOIS records.…

Visualizing Qakbot Infrastructure: Network Telemetry | Team Cymru

Explore Qakbot’s evolving C2 infrastructure through NetFlow analysis, revealing new servers, port trends, and insights into upstream communication layers.

Whilst examining NetFlow data for the C2 to T2 communications from which we derived the findings described above, we kept making the same unexpected observation.…

Real-Time Threat Intelligence With Unmatched Internet Visibility

Scanners and feeds see the edge. Team Cymru, the threat intelligence company trusted by 1,000+ partners, sees adversary infrastructure as it forms.

That global NetFlow foundation is fused with 60+ additional data types and strengthened by trusted relationships across the defender community.…

Fortinet's Aamir Lakhani on Mapping Business Pain Points Attackers Exploit

Hear Fortinet’s Aamir Lakhani explain the role of AI in cybersecurity and how AI-driven threat detection is reshaping modern threat intelligence.

Network-centric threat hunting using metadata and netflow analysis over full packet capture due to bandwidth and analysis constraints.…

Fingerprinting Malware C2s with Tags | Team Cymru

This blog is written for threat analysts, defenders, and CTI teams who use our Scout platform—but even if you’re not a user today, it offers practical insight into how advanced research teams fingerprint C2 infrastructure, and how you might apply similar methods using your tools.

These Tags will then appear in the NetFlow records and are searchable within our Pure Signal products, including Scout and Recon. They can be used to filter out or inspect certain network traffic.…

Supply Chain & CTI | Team Cymru

This blog explores how cyber threat intelligence (CTI) must change and support a new approach to supply chain risk.

An even more proactive measure that could be taken to manage supply chain risks involves using passive scanning services to check for unpatched vulnerabilities in supply chain networks, as well as using NetFlow data to detect malicious command-and-control (…

Mitigating Webmin Vulnerability: Tips for Port Scanning

Stay ahead of cyber threats with our in-depth analysis of the Webmin vulnerability and port scanning activity. Protect your technology company now!

Cybersecurity Glossary | TLP, PAP, TTPs, and Threat Intel Terms

Plain-language definitions of threat intelligence terms, from TLP and the Permissible Actions Protocol (PAP) to TTPs, IOCs, and adversary infrastructure.

NetFlow. Introduced by Cisco Systems in 1996, NetFlow provides the ability to collect metadata on IP network traffic as it enters or exits an interface. Flow exporter. Flow collector. Analysis application. Read the NetFlow definition. A. B. C. D. E. F. G.…

Unveiling Home Router Backdoors: Team Cymru Investigation

Uncover the hidden threats lurking behind your home router backdoors in this eye-opening blog post. Stay informed and keep your network secure!

Tracking CyberStrikeAI: AI-Native Offensive Tools & MSS Ties | Team Cymru

Discover how CyberStrikeAI is revolutionizing AI-augmented offensive security. Explore its ties to Chinese state-sponsored actors and learn to detect it with NetFlow.

Team Cymru is continuously monitoring our global netflow visibility to uncover patterns of adversary activity, identify malicious operations, and gain actionable intelligence.…

Yurei Double Extortion Ransomware: Operator Toolkit and Analysis

Analyze the Yurei double extortion ransomware campaign, including its toolkit, attack lifecycle, and key tactics used by operators.

Using Team Cymru‚Äôs NetFlow-augmented Open Ports collection, we detected a list of notable file names running on Port 8000.…

Threat Intelligence Solutions to Outpace Attackers | Pure Signal™

Built on observed traffic, not scraped data. Pure Signal™ threat intelligence solutions give your team the visibility to stop attackers before they act.

Global internet visibility across NetFlow, PDNS, routing, certificates, WHOIS, malware context, and 60+ data types. 02. Interpret. Enriched context turns raw signal into infrastructure intelligence defenders can understand and trust. 03. Operationalize.…

APT Attacks in Singapore Telecom: UNC3886 ORB Tracking Explained

APT attacks by UNC3886 target Singapore telecom using ORB networks. Learn practical ORB tracking techniques to uncover hidden infrastructure with Scout.

Using Team Cymru Scout further, we can identify the NetFlow records of every IP tagged as an ORB that has communicated with one of the four named victim ISPs from Singapore.…

Supply Chain Risk Management That Sees Third-Party Threats

Know when a supplier is compromised before they do. Continuous third-party monitoring strengthens your cyber security supply chain risk management.

NetFlow, passive DNS, and BGP. Delivered in. Pure Signal™ Command. , APIs, and MCP. Book a supply chain risk briefing. See NetFlow Supply Chain Mapping. Monitoring. Who It's For. The Gap. Attack Path. How We Help. First Hour. Use Cases. Resources.…

Disrupting Cyber Fraud: Team Cymru’s Role in INTERPOL’s Operation

Team Cymru's NetFlow-powered intelligence supports INTERPOL’s Operation Red Card 2.0, disrupting international cyber fraud and malicious infrastructure.

By performing NetFlow analysis and using our unique datasets, Team Cymru analysts were able to find additional actor infrastructure and activity related to crypto-related scams.…

Cybercrime Intelligence Analysis of Carding Operations

A cybercrime intelligence analysis of carding operations, detailing the infrastructure, hosting providers, and network patterns used to support carding activity.

Further, using Team Cymru‚Äôs NetFlow analysis capabilities, researchers can link related infrastructure directly tied to the IP addresses used for carding. Summary of Findings.…

Insights into Internet Outages in Africa's Western Coast | Team Cymru

Major internet outages hit 13 African nations in March 2024. Our analysis reveals traffic patterns, ongoing impacts, and connectivity insights from Pure Signal™.

AI Lies, Packets Don't!

On-demand webinar: use packet inspection and global NetFlow analysis to find and block the infrastructure behind AI attacks, even when AI telemetry fails.

Learn how to use packet inspection and global NetFlow analysis to locate and monitor adversary infrastructure in real time and block it before a breach, even when AI telemetry can’t be trusted.…

Vertex Synapse + Team Cymru | Pure Signal™ Scout Integration

Pivot faster in Vertex Synapse. Team Cymru Pure Signal™ Scout enriches alerts with NetFlow, passive DNS, and certificate data in one place.

Consolidate NetFlow, pDNS, certificate data, and 45+ datasets in one central intelligence system. Focused, Actionable Analysis. Resolve critical questions and alerts during time-sensitive investigations with high-fidelity insights.…

Faster IOC Threat Hunting in One Query | Pure Signal™ Scout

Stop tab-hopping between lookups. Team Cymru's Scout fuses NetFlow, passive DNS, x509, and WHOIS into IOC threat intelligence you can act on in one query.

NetFlow, passive DNS, x509, open ports, WHOIS, and fingerprints fuse into one enriched, tagged return, so triage stops being reconstruction and becomes a decision an analyst can defend. Look Up a Live IOC. →. See Scout Inside Your SIEM and SOAR. →.…

Ransomware Incident Response: Infrastructure Analysis

A year of incident response data reveals how Akira, DragonForce & Clop build ransomware infrastructure — and how defenders can hunt it.

investigation, our trusted partner shared live indicators of compromise (IOCs) they uncovered from manual host-based forensic analysis as the incidents were ongoing to provide Team Cymru with the best opportunity to analyze and track the operators in our global netflow…

Advanced Cyber Recon Detection with Network Signals | Team Cymru

Uncover the secrets of detecting cyber recon using network signals. Stay one step ahead with insights from a leading technology company.

Operationally this allows us to create workflows around the presence of ICMP type 11 in our router logs or netflow records.…

Team Cymru & Europol Dismantle 3 Key Cybercrime Tools in Operation Endgame

Team Cymru provided critical data to Europol, leading to the massive disruption of over 1,000 malicious servers and the arrest of a major cybercriminal. See the full Operation Endgame report.

Working alongside more than 30 national and international public and private parties, Team Cymru contributed to this phase of Operation Endgame by identifying Rhadamanthys‚Äô backend and management infrastructure by using our netflow data, in addition to other…

Uncovering North Korean ‘Internet Outages’ with Team Cymru

Explore the mystery behind North Korean 'Internet Outages' and gain insight into the technological implications in this intriguing blog post.

Palo Alto Cortex XSOAR + Team Cymru | Scout Integration

Enrich Cortex XSOAR with IP and domain intel from NetFlow, WHOIS, passive DNS, and X.509. Get Team Cymru's no-cost Scout pack on Cortex Marketplace.

Access NetFlow communications, WHOIS information, Passive DNS (PDNS), X509 certificates, and fingerprinting details for enrichment and incident response. How It Works. Intelligence-enriched XSOAR Lets You See More and Do More with Less Noise.…

C2 Infrastructure Recon: Pivoting on GRIMBOLT With X509 Certificates

Explore how to Map GRIMBOLT C2 infrastructure linked to UNC6201 by pivoting from one IP using WHOIS, PDNS, ports, and X509 certificate fingerprints.

This includes WHOIS data, Port Banners, X509 certificates, and passive DNS records, as well as internet NetFlow analysis.…

Give AI Agents Real-Time Internet Context | Team Cymru MCP Server

Most AI agents can reason. Few can see. Team Cymru's MCP server connects your AI agents to Pure Signal™ NetFlow, passive DNS, and WHOIS data.

NetFlow. IP-to-IP communication patterns. Passive DNS. Historical resolution data. X.509 Certificates. Shared infrastructure attribution. WHOIS Intelligence. Registration data with pivoting capability. Scout Query Language.…

JA4+ Primer: Allowing Threat Analysts with Traffic Review | Team Cymru

JA4+ enhances threat analysis by providing precise insights into encrypted traffic, helping analysts detect malware and anomalies faster and more accurately.

IX Protect EULA

The end user license agreement for the IX Protect project, covering the data exchange terms under which Team Cymru provides malicious activity indicators.

Data provided by Team Cymru to PARTNER: Team Cymru will provide to PARTNER representative IX indicators of malicious activity derived from the matching of rules against PARTNER netflow data. 2.…

Botnet 7777: Are You Betting on a Compromised Router? | Team Cymru

Quad7 botnet evolves: Over 12K infected routers found, including new ASUS-based 63256 bots. Learn how to identify, track, and defend against this threat.

NetFlow Analysis. Having established a substantial pool of recent analytical leads in the form of hosts likely enrolled in the Quad7 botnet (or botnets), we can now start to examine supporting. NetFlow data.…

Operation Ghost Mail, Starlink Evasion, and the Stoat Waffle Threat

Dragon News Bytes on Operation Ghost Mail, Handala's Starlink evasion, the Stoat Waffle campaign against developers, and tracking Beast ransomware.

Beast Ransomware Operations: Team Cymru's latest research highlights how Open Directories data combined with NetFlow can unmask ransomware actor infrastructure and target lists.…

An Introduction to Operational Relay Box (ORB) Networks | Team Cymru

Explore how threat actors use Operational Relay Box (ORB) networks to evade detection, hide malicious activity, and complicate cyber defense efforts. Talk to an expert.

When investigating botnets through an internet telemetry dataset like NetFlow, one exploitable "weakness" is that botnets rely on a central control mechanism.…

The Canvas Breach, AI-Enabled Intrusions, and APT-29's Easter Bunny

Listen to Dragon News Bytes to explore the massive Instructure data breach, the rise of AI in cyber attacks, and how threat actors execute long-term espionage.

Infrastructure Analysis: The team discusses Push Security's research into Shiny Hunters' phishing panels and how Team Cymru is utilizing NetFlow to uncover additional targets. Part 2: The Double-Edged Sword of AI.…

Protecting Critical National Infrastructure: ORB Networks & OT Visibility

Adversaries are pre-positioning for destructive attacks on CNI. Learn how to track nation-state threat actors and ORB networks to harden the OT boundary "left of boom."

Using Team Cymru Scout to query netflow communications, we can search for all BlueVPS and Hostinger IPs that have been communicating with Fortigate systems in Poland, using a search such as tag = "fortigate" cc = "PL" comms.asn = "62005,47583".…

Rogue LLMs, Clop’s 8th Zero-Day, and Threat Hunting at Scale

Catch the latest Dragon News Bytes on rogue LLMs, Clop's zero-days, and the evolving cyber attack surface. Learn the attack pattern in threat intelligence.

Data Tagging: How Team Cymru’s S2T team tracks specific AI infrastructure and model deployments across netflow data. Part 2: Clop Ransomware Drops Zero-Day #8.…

Team Cymru & DOJ Disrupt World’s Largest IoT DDoS Botnets

Team Cymru partners with the DOJ to dismantle Aisuru, KimWolf, JackSkid & Mossad botnets. See how global network visibility and community-driven intel stopped 30 Tbps attacks.

Team Cymru's passive visibility into internet infrastructure ‚Äî spanning 700+ ISP partnerships and petabytes of NetFlow telemetry ‚Äî provides the type of longitudinal, protocol-level insight that helps investigators trace botnet command-and-control (C2) infrastructure…

RADAR: Seamless Threat Hunting from Discovery to Attribution

Learn how RADAR’s pivot feature automatically generates queries in Scout, allowing analysts to move from infrastructure discovery to threat attribution seamlessly.

Analysts can pivot off of any RADAR discovery directly into Scout to view recent NetFlow, PassiveDNS, and certificate activity. Analysts can select any returned single IP address, group of addresses, or CIDR ranges in RADAR.…

Inside the Mind of a Threat Hunter: New Report Finds 50% Faced Major Breaches Last Year, Yet Threat Hunters Lack Budget

Team Cymru's Voice of a Threat Hunter 2024 report surveyed 293 security pros: nearly half faced a major breach, yet threat hunting teams lack budget.

The most valuable threat hunting product is network forensic detection, netflow telemetry, raw network telemetry data and/or full packet captures. The top priority for the next year is expanding third-party monitoring for signals of compromise.…

Fraud Intelligence to Disrupt Criminal Networks Early

Fraud doesn't begin with a transaction. Trace the domains, IPs, and certificates behind a campaign four stages earlier and cut fraud investigation time.

NetFlow. , Passive DNS. , BGP routing. , Malware intel. Delivered in. Pure Signal™ Command. , APIs. , MCP. Talk to a Fraud Intelligence Expert. See Command for Fraud Intelligence. Financial Services. Fraud Defense Intelligence. See Beyond the Transaction.…

Team Cymru & INTERPOL: Operation Sentinel Cybercrime Takedown

Team Cymru partners with INTERPOL in Operation Sentinel to dismantle BEC and ransomware networks across Africa. See how 573 arrests and $3M in recoveries were made.

Team Cymru is proud to have contributed to this operation by identifying relevant offensive security tooling within our NetFlow records that may have been precursors to ransomware. An Ongoing Commitment to Saving and Improving Human Lives.…

Team Cymru Company Overview | Executive Leadership Team

Meet the leadership behind Team Cymru, turning raw internet telemetry into threat intelligence that helps defenders act before attackers can.

Team Cymru has spent 25 years building something no one else has: direct partnerships with 800+ ISPs, passive NetFlow visibility across a significant portion of global internet traffic, and longitudinal data that lets defenders see what adversaries are doing…

We could not find a page that matches your search. Try one of these starting points, or search for a product, tool or topic.

Start here

Solutions

Threat Intelligence Solutions

Built on observed traffic, not scraped data, so your team can stop attackers before they act.

Explore the solutions →

Integrations

Bring Team Cymru threat intelligence into Splunk, Google SecOps, Sentinel, XSOAR and your AI copilots.

See the integrations →

Resources

Resource Library

CISO guides, case studies, eBooks and product briefs from Team Cymru.

Browse the library →

Customers

Customer Stories

How banks, network operators and global enterprises use Team Cymru threat intelligence.

Read the stories →

From the Resource Library

Reports and guides on this topic

Browse the Resource Library →

eBook

Executive Strategy, Risk & ROI

The CISO's Ultimate Guide to Threat Reconnaissance ROI

How organizations reached a 488% ROI with proactive threat reconnaissance. A CISO guide backed by Forrester research.

Get the guide →