team-cymru.com

Team Cymru Finds LLM Relay Gateways Linked to Regional-Access Abuse and Possible Model Distillation

Team Cymru found more than 10,000 LLM relay gateways, later reporting over 80,000, that can mask users and bypass providers’ regional controls. Telemetry showed heavy uploads to Anthropic, though researchers could not confirm the prompts or prove model distillation.

Sep 22, 2026

Team Cymru Details Ransomware Infrastructure Trends Across 20+ Investigations

Analysis of more than 20 ransomware investigations found recurring use of Rclone, FileZilla, RDP, remote-management tools, VPS hosting, VPNs, and Tor. Team Cymru says static IP blocking is insufficient and recommends behavior-based detection.

Sep 15, 2026

Fraud Defense Should Start Before the Transaction, Team Cymru Says

Team Cymru argues that fraud teams can detect and disrupt operations earlier by tracing infrastructure, targeting, and account compromise instead of relying mainly on transaction-level signals.

Sep 2, 2026