Operational Impact Archive: TLP:CLEAR
Team Cymru provides the internet visibility and infrastructure intelligence that helps trusted partners investigate, attribute, and disrupt cybercrime operations worldwide.
Explore the takedown archivePublic record. Every operation listed here is drawn from official law enforcement announcements, published Team Cymru materials, and independent reporting. Each record cites its sources.
Definition
A cyber threat takedown is a coordinated effort by law enforcement, government agencies, and private-sector partners to identify, seize, disable, or disrupt the infrastructure that cybercriminals depend on, including command-and-control servers, malicious domains, botnets, and hosting environments. The goal is to dismantle criminal operations at the infrastructure level, cutting off the systems attackers use before they can reach more victims.
No single organization executes a takedown alone. Operations of this scale depend on trusted collaboration: agencies bring legal authority, and intelligence partners bring the visibility to map the infrastructure worth targeting. That is where Team Cymru operates.
A takedown can involve one of these actions or many working in sequence.
The Archive
Every operation below is on the public record, verified through law enforcement announcements, partner statements, and independent reporting.
The Visibility Layer
Takedowns succeed or fail on one question: can investigators see the full infrastructure before they act? Hit one server while ten stay live, and the operation rebuilds in a week. Map the whole architecture, and disruption sticks.
Team Cymru observes how internet infrastructure communicates at global scale, in real time and across history. That visibility helps trusted partners connect malicious IPs, hosts, domains, and networks into a complete operational picture, then identify the points where coordinated action creates the greatest impact.
It is why law enforcement agencies and international bodies have repeatedly named Team Cymru as a partner in the operations above.
Identify malicious systems, communications, and relationships across the global internet.
Understand how domains, IPs, hosts, networks, malware, and operators link together.
Follow infrastructure changes and operational movement with historical and real-time visibility.
Deliver trusted intelligence that helps law enforcement and industry partners act with speed and confidence.
Go Deeper
Inside the March 2026 operation against Aisuru, KimWolf, JackSkid, and Mossad.
Joint infrastructure research with Black Lotus Labs supporting Operation Endgame.
How three key cybercriminal tools were dismantled in coordinated European action.
The takedown of 22,000+ cybercrime servers across 95 countries.
Connect with the global defender community and stay current with Team Cymru research, events, and conversations.
Community
Where threat hunters, CSIRTs, and security operators share intelligence and build defense-in-depth together.
Connect with defenders
Events
Team Cymru hosts RISE regional conferences and the annual Underground Economy gathering for vetted defenders.
See upcoming events
Marketplace
An operational marketplace where defenders share trusted tooling, integrations, and intelligence streams.
Browse the marketplace
Webinars
On-demand webinars from Team Cymru analysts and invited practitioners on threat intelligence and defender operations.
Watch the webinars
Podcast
Future of Threat Intelligence: long-form conversations with security leaders and researchers shaping the next generation of defense.
Hear the conversations
Research
Threat research from Team Cymru analysts, including the investigations behind the headlines.
Read the research
Every operation on this page broke on the public record. Follow the next one as it happens, and dig into the research and analysis behind the disruptions.