{
	"id": "3762734f-98b0-40a6-b35e-e19d343907f7",
	"created_at": "2026-10-29T02:57:14.218185Z",
	"updated_at": "2026-10-29T03:01:25.222036Z",
	"deleted_at": null,
	"sha1_hash": "3dc4d00ee579199b6fdf493e1eb06120e35544f7",
	"title": "Team Cymru Cybersecurity Blog | Threat Research and Intelligence",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 55969,
	"plain_text": "https://team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion/\n\nTeam Cymru Cybersecurity Blog | Threat Research and\n\nIntelligence\n\nBy Annika Martins\n\nArchived: 2026-10-29 02:03:07 UTC\n\n1. Home\n\n2. Resources\n\n3. Blog\n\nTeam Cymru Blog\n\nCybersecurity Research from the Front Lines\n\nfrom the global network visibility we maintain across the internet.\n\nWho\n\nTeam Cymru threat analysts and researchers, with a named byline on technical posts.\n\nWhat\n\npivots behind them.\n\nHow\n\nreporting.\n\nThreat research, infrastructure analysis, and operational guidance from the Team Cymru intelligence team, drawn\n\nNamed threat actors, mapped command-and-control infrastructure, ransomware toolkit teardowns, and the\n\nSourced from Team Cymru’s own internet-scale network telemetry, not third-party feeds or aggregated\n\nResearch Library\n\nFind research by threat, problem, or role\n\nEvery article carries the same Team Cymru tags as the rest of the site. Stack filters to narrow fast, or tap a category\n\non any card.\n\n177 articles\n\nSearch articles\n\nSort articles\n\n3 min read\n\nOctober 22, 2026 · Annika Martins\n\nPage 1 of 3\n\nhttps://team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion/\n\nFrom Serengeti to Serengeti III: What Three INTERPOL Operations Reveal\n\nINTERPOL’s Operation Serengeti has led to 3,677 arrests across three operations since 2024. What changed from\n\nSerengeti to III, and what it means for defenders.\n\n3 min read\n\nOctober 14, 2026 · Will Thomas\n\nLegionRelay: Ukraine Targeted by Five Previously Unidentified C2 Servers\n\nSee how threat hunting in Team Cymru Scout surfaced five previously unreported LegionRelay C2 servers tied to\n\na Russia-aligned campaign targeting Ukraine.\n\n5 min read\n\nSeptember 22, 2026 · Scott Fisher\n\nRelaying to the Frontier\n\nenabling model distillation and abuse.\n\n4 min read\n\nSeptember 15, 2026 · Will Thomas\n\nFrom the Disk to the Flows: Ransomware Infrastructure Analysis\n\nhow defenders can hunt it.\n\n3 min read\n\nTeam Cymru uncovered self-hosted LLM gateways relaying pooled credentials to frontier models like Claude,\n\nA year of incident response data reveals how Akira, DragonForce \u0026 Clop build ransomware infrastructure — and\n\nSeptember 2, 2026 · Team Cymru\n\nThe Transaction Is the Last Step, Not the First\n\nWaiting for the transaction to catch fraud? You're already too late. Learn how tracking attack patterns in threat\n\nintelligence stops actors early.\n\n5 min read\n\nAugust 12, 2026 · Eli Woodward\n\nCl0p Til you Drop - 6 Years, 10 Campaigns, 8 Zero-Days\n\nAnalyze Cl0p ransomware's history of targeting MFT systems. Discover their attack pattern in threat intelligence\n\nto improve cyber attack surface reduction.\n\nPage 2 of 3\n\nhttps://team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion/\n\n5 min read\n\nAugust 5, 2026 · Stephen Campbell\n\nBehind the Panels: Validating ShinyHunters Cluster A Infrastructure Through Network\n\nTelemetry\n\nUse network telemetry to validate cyber threat actors' phishing infrastructure. Track ShinyHunters clusters and\n\ndefend against SaaS data exfiltration.\n\n3 min read\n\nJuly 27, 2026 · Josh Picolet\n\nFrom C2 Detection to Possible Victim Identification\n\nDiscover how to transition from C2 detection to possible victim identification. Improve your cyber incident\n\nresponse by tracking attacker infrastructure to compromised systems.\n\n2 min read\n\nJuly 14, 2026 · Abigail Lorion\n\nModernizing Incident Response: 4 Steps to Bulletproof Your Windows Logging\n\nImprove your cyber incident response steps with our guide to bulletproof Windows logging. Discover incident\n\nresponse tools and how AI streamlines DFIR.\n\nShowing 9 of 177 articles\n\nStay in the loop\n\nStay current with Team Cymru insights\n\nGet the latest research, articles, and threat intelligence resources, delivered straight to your inbox.\n\nEngage with Team Cymru and the Threat Intelligence Community\n\nConnect with the global defender community and stay current with Team Cymru research, events, and\n\nconversations.\n\nSource: https://team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion/\n\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion/"
	],
	"report_names": [
		"moqhao-part-2-continued-european-expansion"
	],
	"threat_actors": [],
	"ts_created_at": 1793242634,
	"ts_updated_at": 1793242885,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3dc4d00ee579199b6fdf493e1eb06120e35544f7.pdf",
		"text": "https://archive.orkl.eu/3dc4d00ee579199b6fdf493e1eb06120e35544f7.txt",
		"img": "https://archive.orkl.eu/3dc4d00ee579199b6fdf493e1eb06120e35544f7.jpg"
	}
}