The IT Nerd

Team Cymru today announced Pure Signal™ Command, the connected operating environment for analysts, security teams, applications, and AI agents to access and act on Team Cymru’s internet infrastructure intelligence. Command unlocks Team Cymru’s globally observed threat intelligence data by connecting telemetry, investigative and attack surface management capabilities, expert analysis, and machine-native access within a common architecture. The result is a continuous path from discovery to action, eliminating fragmented workflows, preserving investigative context, and accelerating active threat disruption.

Command is queryable in natural language and draws from source-proximate, verified data with a clear provenance giving both real-time information and the historical context to inform current and future actions. Drawing on the Pure Signal™ Model Context Protocol (MCP) server, Command incorporates agentic AI capabilities while maintaining the option of human-in-the-loop review, ensuring continued accuracy and scalable threat intelligence. 

“Pure Signal™ Command is transforming how we identify and stop threats,” said Tim Jones, Chief Technology Officer, Team Cymru. “Instead of having to combine a patchwork of tools or switch between workflows, users can access all of Team Cymru’s global telemetry, including current and historical data, so they get full and continuous context while evaluating the next steps. And because Command provides validated, current intelligence in a machine-native ecosystem, AI agents can ingest vast amounts of information. This will help defenders turn external visibility into action faster, giving them back the time to investigate before compromise, block before disruption, and act before damage is done.”

Command provides access and improved operational capabilities for customers (and customers’ agents) in a connected operating environment with continuous context and integrated workflows.

In addition to continued access to Team Cymru’s globally observed, validated data and findings, and visibility into internet threats across infrastructure, behavior, relationships, malware, and time, analysts can now operate across every phase of the threat intelligence lifecycle — Discover, Enrich, Investigate, Attribute, Operationalize, Respond — within Command. This streamlined access enables analysts to act without the friction of switching between contexts, so they can spend their time on what matters: addressing threats and directing operations. 

Tracking Adversary Behavior Across the Internet with Global Data and Deep Research

The machine-operable infrastructure of Command provides a comprehensive operational hub and visibility into adversary behavior, identifying threats and offering the latest, most up-to-date intelligence on how to stop them. In addition to having the largest global NetFlow data set, Command ingests data from BGP / Routing, partner telemetry, WHOIS, malware intelligence, and other sources to provide critical visibility into external threats and indicators of compromise, backed by expert analysis. Command provides human and agentic practitioners with a continuous, actionable view of adversary infrastructure, relationships, and movement across the internet, tracking threats even as the infrastructure is created, moved, and absorbed.

Command is powered by Team Cymru’s globally observed network telemetry, including more than 400 billion daily internet connections, 1,000+ data sharing partnerships across more than 140 countries, and over 2,000 behavioral tags curated by the company’s S2 Research Team. This foundation enables security teams to detect adversary infrastructure as it emerges, attribute activity to specific campaigns, and respond with context that automated feeds alone cannot replicate.

Command integrates the full capabilities of the rest of the Pure Signal™ suite and Total Insights Feed, including:

• Investigation and behavioral enrichment with analyst-curated context, campaign mapping, and infrastructure attribution
• Continuous attack surface intelligence that monitors internet-facing infrastructure and surfaces adversary staging activity before threats cross the perimeter
• Deep investigative intelligence for threat hunting, third-party exposure analysis, and continuous monitoring of external-facing assets
• Operationalized, structured threat intelligence enriched with telemetry-backed behavioral context for direct integration with SIEM, SOAR, and response workflows.

Internet-Scale Telemetry for Human and Agentic Workflows

With Command, CISOs gain observable, defensible risk data backed by real internet telemetry, board-ready metrics, and ROI clarity. Threat hunters can pivot across IP, ASN, domain, and certificate data without losing investigative thread. SOC and IR teams receive investigation-ready context with every alert, supported by 2,000+ analyst-curated behavioral tags and full integration with Splunk, Microsoft Sentinel, Cortex XSOAR, and Cyware.

Pure Signal™ Command is designed to serve the full operational team, including AI agents, extending Pure Signal™ from human investigation workflows into agent-driven operational environments and supporting current and future investigative workflows.

and, with its integrated capabilities and proactive insights, to give defenders the tools to rapidly fight back against threat actors. Command’s integrated workflows, agentic AI capabilities, and insights help organizations discover threats before impact and move to implement protective measures at scale.”

Availability

Pure Signal Command is available today. To request a strategic briefing or live technical demonstration, visit https://www.team-cymru.com/pure-signal/command-threat-intelligence-platform.

Cyberattacks targeting the water utilities of Braham, South St. Paul, Plymouth, Maple Plain and St. Cloud, Minnesota disrupted automated control systems at multiple facilities, prompting operators to switch to manual operations.

In Braham, the attack temporarily shut down the city’s water treatment plant, but crews restored service in less than two hours, and officials said water quality, public safety and infrastructure were not affected.

Minnesota IT Services (MNIT) confirmed it is assisting the affected communities with incident response, forensic analysis, and recovery efforts. Officials said the attacks primarily targeted industrial control systems used to monitor and operate water infrastructure, and investigations into the incidents remain ongoing.

Denis Calderone, CTO, Suzu Labs:

“The reporting is early on these attacks and there is no way to definitively attribute who the threat actor is, but it’s awfully coincidental that attacks against water utility control systems in five Minnesota cities are coming this soon after CISA released advisory AA26-097A warning about exactly these kinds of targets. That advisory, updated just last week with expanded scope covering Siemens and Schneider PLCs alongside Rockwell, specifically names water and wastewater systems as a targeted sector. We can’t draw a line between the two yet, but it fits the pattern we’ve been tracking since April.

“The good news here is that every one of these cities was able to fall back to manual operations and maintain service. The fact that trained crews could step in and run these systems manually while the automated controls were compromised is what kept this from becoming a major public safety incident.

“With the little that is known about these attacks, we did find it particularly interesting that Plymouth city officials noted that the impact was limited to equipment connected via cellular communications. Water towers, lift stations, pump stations, these remote assets often connect back to the SCADA system over cellular modems, and in our experience secondary and/or alternative comm links are often overlooked when doing risk and vulnerability analysis, so it’s not too surprising then that the vector of attack may have been via these cellular connections. Oftentimes, regarding SCADA and Industrial Control networks, the infrastructure is largely built out by the integrator which increases the chance that these connections get overlooked. We saw in the reporting that Braham’s city administrator is now asking for their system vulnerability study to be reevaluated, and I wouldn’t be surprised if that study never included those cellular communication paths in the first place.

“The prescriptive advice here is the same as it’s been all year: take control systems off the internet, segment OT networks from IT, change default credentials on every device in the environment, and put remote access behind a VPN. But the lesson from Minnesota is that you have to know all the links. Every communication path into your control environment needs to be inventoried and tested, including the cellular modems, the radio links, the backup communication channels that don’t show up on the network diagram because the diagrams just don’t go into that level of depth, or because some components are simply forgotten about because they were installed five years ago by a contractor who’s long gone. If you don’t know every way into your control systems, you can’t protect them.”

Donald McFarlane, Advisory Board Member, Xcape, Inc.

“The encouraging news is that operators appear to have maintained safe water service through a mix of manual operations and resilient system design. If those facts hold, this demonstrates an important principle: cyber resilience isn’t about preventing every intrusion, it’s about ensuring cyber incidents don’t become public safety incidents. As cyber attacks increasingly target operational technology, organizations need the operational ability to find exposed systems, fix the highest-risk vulnerabilities, detect compromise when prevention fails, and contain attacks before they disrupt essential services.”

John Strand, Owner, Black Hills Information Security, Inc.:

“We’re seeing more breaches targeting public and critical infrastructure, and I think one of the biggest things people are missing is the difference between financially motivated attackers and nation-state adversaries. When a criminal group compromises a network, they’re often looking for a quick payday through ransomware or data theft. Nation-state operators frequently have a very different objective.

“Their goal is often to gain access and stay there. They want to establish persistence, quietly understand the environment, and position themselves so they can disrupt critical infrastructure whenever it serves their strategic interests. Water treatment facilities, power generation, transportation, and other essential services are attractive targets because they provide leverage long before an attack is ever launched.

“The challenge is that many security programs are still built to detect noisy attacks like ransomware or smash and grab intrusions. They’re much less effective at finding the low and slow activity that characterizes many nation-state operations. If organizations responsible for critical infrastructure aren’t investing in threat hunting, network telemetry, and behavioral analysis designed to uncover long-term persistence, there’s a real risk that sophisticated adversaries will remain inside those environments long before anyone realizes they’re there.”

Seemant Sehgal, Founder & CEO, BreachLock:

“Five separate water utilities hit across Minnesota tells you this was coordinated targeting of a sector, not opportunistic scanning that happened to find a few open doors. The reassuring headline is that crews switched to manual and restored service fast, but manual fallback is a contingency, and contingencies have limits that vary by facility, by staffing, and by how long the disruption runs. What investigators need to establish is how the same attack pattern reached systems in Braham, South St. Paul, Plymouth, Maple Plain, and St. Cloud, because whatever that common thread is, it almost certainly exists in water infrastructure well beyond Minnesota.”

You’re a target. So you have to behave that way. Beef up your defences so that you don’t end up like these organizations. Otherwise you will end up like these organizations.