[ Team Cymru Community Services ] [ Team Cymru Commercial Services ] [ Dragon Research Group ]
The mundane but disturbing truth: Most Targeted Attacks Exploit Privileged Accounts by phishing or password guessing http://t.co/2ZQfu1Qf5A | #Hacking #RFID Payment Cards Made Possible with Android App #cybercrime http://t.co/d8r5JJ9Dki http://t.co/d8r5JJ9Dki | Interesting paper by FoxIT: socially engineering website owners via CMS themes and plugins: “CryptoPHP” http://t.co/OzvVwvDvMT | E-cigarettes join photo frames and MP3 players as weirdest #malware #cybercrime targets http://t.co/CMSll4xt1l http://t.co/CMSll4xt1l | Amplification/reflection that doesn't use UDP - DVMRP Ask Neighbors2: an IGMP-based DDoS/leak threat http://t.co/d0iSNlvkIY | Websense claim that these are 8 cybercrime trends that will shape IT #infosec #cybercrime http://t.co/vIdHUeeLXk | Chinese internet #freedom watchdog GreatFire claims the EdgeCast content delivery network now partially blocked http://t.co/xaK2a807KB | #Hackers seize Detroit's database, demand $800k. Motor City shrugs: 'OK, take it' http://t.co/SqZVaCt6Rr | Intel/McAfee signs agreement to work with Europol's EC3 group on fighting #cybercrime http://t.co/r9LlCPXmeA | new very improved NotCompatible #mobile #malware now encrypts traffic to hide and can use infected devices as proxies http://t.co/8k68X7h1gh | fascinating write up of the recent New York City CSAW Capture The Flag 2014 Finalist Event http://t.co/VqLNLMFrzo | Turkish Embassy's Education Consultancy in Kyrgyzstan Hacked by Anti-Assad Hacker Dr.SHA6H #infowar #hacker http://t.co/vjPRLMO0vd | #infosec #malware tools: Autorun File Remover - Free Autorun Virus File Removal Tool http://t.co/JfEX9gjPIJ | Localized Tools and Services, Prominent in the Brazilian Underground. Good overview from Trend Micro http://t.co/yfmju7BS9K | NSA Reform Bill USA FREEDOM Act failed by just two votes to obtain the 60 votes needed to move the bill forward http://t.co/8ahrXT7NwZ | JOB AVAILABLE: @teamcymru looking for #Malware #Software #SysAdmin and more http://t.co/20PjGtIMYH | Microsoft: critical Out-of-Band patch for Kerberos flaw to correct signature verification http://t.co/e6mTcJ6pUx http://t.co/e6mTcJ6pUx | X-Force analysed 23B URLs, IPs: 43% of malicious links hosted in US, 11% in .CN (thats twice as many as last year) http://t.co/BY7H04gNeh | July-Sept '14: 320 breaches reported: 25% up YOY,183 M customer 'accounts' of various sorts http://t.co/lanOdEjDQZ http://t.co/lanOdEjDQZ | CAREERS: @teamcymru is looking for you! #Malware #Software #SysAdmin http://t.co/20PjGtIMYH http://t.co/20PjGtIMYH | BadUSB: 60 chip families reviewed from 8 vendors, none disabled ability for reprogramming http://t.co/3mjnjdTJws http://t.co/3mjnjdTJws | KPMG survey finds that 53% would consider hiring #cybersecurity staff with a criminal record for #hacking: seriously? http://t.co/4lSjwpiGTj | Survey finds DDoS costs $40k p/hr and that half of the attacks last 6 to 24 hours #cybercrime #hacking http://t.co/n6ShHn87eO | Tor 'failed' former .il bank employee trying blackmail from .th: futher 7 of gang arrested http://t.co/BWtNqNyLzy http://t.co/BWtNqNyLzy | JOIN @TEAMCYMRU: #InfoSec Careers for the best and the brightest http://t.co/20PjGtIMYH | #cybersecurity researchers review 600k online ads on 40k sites for 3 months and find that 1% of ads were malicious http://t.co/OarIysr8IW | Steam user? new #malware distributed via Steam Chat via bitly disguised link to Google Drive hosted .SCR file http://t.co/Ni6js2UZLr | Clever marketing? entice victims with free file recovery via #CoinVault #Ransomware #cybercrime http://t.co/swyqslndHe | Viber user? This new spam changes routines based on the type of latform you're using http://t.co/j0LQEcof2B http://t.co/j0LQEcof2B | Lithuania charges state-owned airline navigation services employee with spying for Belarus+.ru http://t.co/A0r3QKqO3o http://t.co/A0r3QKqO3o
Team Cymru in the UK: TC-UK INTERNET SECURITY YouTube RSS Feed Twitter

Recent Data

[ Data Page 1 ] [ Data Page 2 ] [ Data Page 3 ] [ Data Page 4 ] [ Data Page 5 ]

IP Protocol Trends

Our global view of Internet traffic provides many useful insights, one of which is the relative prevalance of various IP protocols. This chart shows the most commonly seen IP protocols, and their relative popularity in sampled network traffic over the past 30 days. Note that the Y axis is scaled logarithmically, so even small differences on the chart reflect significant differences in usage levels.

View all available monitoring graphs

Sampled DNS Request Rate (daily)

Our insight into Internet traffic around the globe allows us to sample and estimate trends in Domain Name System (DNS) requests, one of the key pieces of Internet infrastructure. This chart provides a glimpse into that sampled rate over the past 30 days, aggregated daily, for both TCP and UDP DNS requests (though the TCP request rate is so low it is difficult to discern).

View all available monitoring graphs

Top 10 UDP Ports (logarithmic scale)

This chart shows the top 10 UDP ports seen in sampled global Internet traffic in our most recent hourly data sample. This chart is on a logarithmic scale, so the difference between the top port (usually UDP/53) and the bottom port may be more significant than it appears to the naked eye.

View all available monitoring graphs

Underground Economy Activity

This chart shows a very general sampled indicator of the average number of messages per hour seen each day in various underground economy forums for the past 30 days. The numbers should not be taken as absolutes, and have considerable sampling error, but are believed to be a reasonable indicator of overall trends.

View all available monitoring graphs

Internet Malicious Activity Maps

Internet Malicious Activity Hilbert Map The map to the left shows network locations of malicious activity on the Internet within the past 30 days, plotted using a Hilbert curve. Check out our Internet Malicious Activity Maps page for full details and a larger view of this and other maps.

Recent Releases

Our contribution to Operation Ghost Click

[17 NOV 2011] On 09 November 2011, US law enforcement released details of a major series of arrests as part of Operation Ghost Click. Team Cymru is proud to have been able to add details of victim computers that were part of this criminal infrastructure into one of our daily feeds of data that is provided at no cost to providers around the world. These lists of affected IP addresses enable network managers to identify and remediate computers infected by malware that are taking part in criminal activities.

This has a direct impact on people: it disrupts criminals and improves the lives of legitimate Internet users everywhere; we're honored to have been able to contribute to this effort. Our great thanks to all who contributed to this team effort.

Details of the case and our commentary can be found in this darkreading.com article. Images of the data we provided to our partners can be found via Twitter here and here.

Unexpected and unsubstantiated blog post

[25 OCT 2011] A recent blog post appeared to draw the unsubstantiated conclusion that more than 760 organizations were compromised with some of the same resources used to hit RSA earlier this year. Team Cymru was one of the organizations named in the posting.

We have no evidence of compromise related to incidents at RSA or anywhere else. The source of the report, and those who revealed and posted it, didn't take the time to contact us, or to share incident details with us. Thus we are unable to investigate further. We hope that those who gathered this data will responsibly disclose it to the potential victims.

Please note that without more details on the methodology used to determine the list of organizations, and a scientific review of the same, it's not safe to assume that an entry on the list means either "victim" or "false positive". We've seen no data or methodology description that would support either case.

New Underground Insight: A Criminal Perspective on Exploit Packs

[05 MAY 2011] The Team Cymru Business Intelligence Team is pleased to announce the release of their latest paper, entitled "A Criminal Perspective on Exploit Packs". This paper chronicles the genesis and historical eveolution of the Browser Exploit Pack (BEP). We discuss our research into the installation and usage of 40 different packs. Most notably, the paper discusses dishonor among coding thieves and the entrenched practice of "statistics shaving". Finally, we examine the monetization, code protection, and overall effectiveness of the various packs. For full details, check out the whitepaper, and don't forget to look at the rest of our whitepapers as well!

Team Cymru moving to Florida

[04 MAY 2011] Team Cymru today announced that they are relocating their headquarters staff from Chicago, Illinois, to Central Florida over the summer. The majority of our Chicago staff will move and are excited at the prospect of continuing to use our insight to improve lives, but from a significantly warmer location.

We do not forsee any disruption to our community or commercial feeds and services during this transition and we will continue to update our partners with news as appropriate. If you have any questions or concerns in the meantime, please e-mail outreach@cymru.com and we will be happy to discuss them with you!

View older news items in our news archives.

Friends of Team Cymru  
  CSIRT-MU DomainSponsor Dyn, Inc. F-Secure  
  FIRST GoDaddy.com Interoute Communications Oversee.net GOVCERT-LU  
  REN-ISAC Savvis Communications Support Intelligence Tata Communications Verizon Business INTECO CERT  

Team Cymru Community Services