Check Your Exposure

Cybercrime Security Research

SpyCloud Labs is SpyCloud’s focused cybercrime research group dedicated to uncovering and analyzing the most intricate patterns from the criminal underground. We nerd out on all things breach, malware, phishing, and threat actor-related – and are hellbent on making the internet a safer place for all and making bad guys sad. This is a space for our experts to share our latest research findings as well as best practices and solutions for organizations to better their defenses.

Latest security research

Dig in with us as we analyze digital underground collections, reverse-engineer malware, and identify threat actor patterns.

Webinars and videos

Tune in to hear new and interesting research insights from our experts, first-hand.

SpyCloud Labs in the news

Insights and research from the team making headlines.

Ex-FBI Agent: Bank Employees Are Selling Account Access on Telegram (with Trevor Hilligoss, SpyCloud)

Read more
TechNadu

Facing Hardened Defenses vs Easy Incentives: Why Insider Abuse is Becoming Commonplace in Ransomware Operations

Read more
Security Week

Dozens of Major Data Breaches Linked to Single Threat Actor

Read more
SpyCloud News

SpyCloud Analysis Reveals 94% of Fortune 50 Companies Have Employee Data Exposed in Phishing Attacks

Read more

How to Stop Infostealers and Next-Gen Ransomware with an Identity-Centric Security Approach

Read more
podcast

No Password Required – Episode 58 (Trevor Hilligoss)

Read more
SpyCloud News

SpyCloud Research Shows that Endpoint Detection and Antivirus Solutions Miss Two-Thirds (66%) of Malware Infections

Read more
First of 2025: Trending Cybercrime News & Analysis

Cyberwire Research Saturday: The hidden cost of data hoarding

Read more

An Expert in the Dark Web Describes How to Manage the Risk

Read more

China’s Surveillance State Is Selling Citizen Data as a Side Hustle

Read more
The Register

Brazen crims selling stolen credit cards on Meta’s Threads

Read more

Ransomware on repeat

Read more

Magazine Exclusive: The Business of Cybercrime Explodes

Read more

Cybercrime analytics company releases update regarding massive PII data breach

Read more

How cybercriminals are using ‘infostealers’ to sidestep passwordless authentication

Read more

Operation Endgame Partner

2025 Cybersecurity Excellence Awards “Cybersecurity Team of the Year”

Meet the research team

The fuel behind our efforts is a talented team of analysts and researchers relentlessly focused on connecting the dots as threat actors pivot and change.

Trevor Hilligoss

Trevor Hilligoss is SpyCloud's Chief Intelligence Officer, leading its global intelligence strategy and its research team, SpyCloud Labs (named Cybersecurity Team of the Year at the Cyber Security Excellence Awards). Trevor is an Army veteran, was appointed as a Special Agent with Army CID's Major Cybercrime Unit, and later served on the FBI's Cyber Task Force. He has provided expert testimony before the House Intelligence Committee, is a named participant in Europol's Operation Endgame, holds the President's Volunteer Service Award, and speaks regularly at cyber conferences in the US and internationally.

Joe Roosen

Joe spent 20 years in various system administration, consulting and design roles in information technology but eventually shifted his focus to security and thwarting cybercrime. What started as a volunteer passion project in 2017 with the Cryptolaemus group fighting Emotet has now turned into a full-fledged information security career. Joe works as the Director, Security Research at SpyCloud now leading his team to collect all of the data breaches and leaks possible. "Gotta catch them all!"

Kyla Cardona

Kyla is a U.S. military veteran from the Air Force, Marines, and Army, holds a BS in Computer Information Systems and multiple cybersecurity certifications including Security+, CEH, CySA+, and Splunk. Specializing in Terrorism and Homeland Security certifications coupled with extensive Chinese OSINT training, she possesses a strong sense and understanding of geopolitical cyber threats in China’s digital landscape. Kyla is a Senior Security Researcher at SpyCloud, with a focus on cyber threats in China and other cybercrimes occurring within deep/dark web illicit communities.

Paul S.

Paul S. is from the UK and is a biochemist with a PhD in medical research. He decided to leave the life of medical research behind to become a sysadmin for the Crown. It was there he found a love of taking apart phishing campaigns and thwarting bad actors. Paul now hunts phish for a living as a Staff Security Researcher.

Aurora Johnson

Aurora is an information security researcher and cybersecurity policy expert who worked as a Senior Analyst for CISA before joining SpyCloud as the Manager of Security Research Partnerships where she manages the program to alert organizations when SpyCloud finds their sensitive breached, leaked, or exposed data through it's collections. Aurora participates in a range of volunteer and public-private initiatives to track and disrupt the cybercriminal ecosystem and was a recipient of the President’s Volunteer Service Award in 2023 for work with the U.S. government against cyber security threats.

Aurora was also named a 2026 Gold "Cybersecurity Woman of the Year" by the Cybersecurity Excellence Awards.

Keegan Keplinger

Keegan has degrees in physics, neuroscience, and mathematics and holds a President's Volunteer Service Award for cybersecurity. Raised a commercial fisherman out of Kodiak, Alaska, Keegan joined the cybersecurity community in 2017, as part of eSentire's Threat Intelligence team where he participated in detection engineering, tool building and the collection, analysis, and dissemination of threat intelligence. Keegan studies the linguistics and humanities of Slavic and Germanic cultures as part of a broader interest in Proto-Indo-European studies. At SpyCloud, Keegan focuses on tool-development, methodology, and theory around collection and promotes a disease-based view of criminology.

Daniel

Daniel is hyper-focused on developing new methods to automate the collections process and acquire more data from criminal communities. He is the Manager of Identity Threat Research at SpyCloud Labs.

Yashar H.

Yashar is a GIAC Certified Forensic Analyst (GCFA) and a former SOC/Incident Response analyst who dabbles in security research and reverse engineering in his free time. At SpyCloud, he works as a Security Data Analyst, focusing primarily on processing recaptured breach data that powers SpyCloud's identity threat protection solutions.

Andy Culler

Andy is a seasoned security engineer passionate about automation. He started his career as an analyst and tool developer at Dell SecureWorks before moving on to help build security engineering and automation programs at Box and Slack. As the Manager, Security Research Engineering at SpyCloud, Andy is excited to leverage his more than 15 years of industry experience to tackle new challenges in the world of security research.

Aaron Coffey

Forged at industry leaders like Google and Box, Aaron crafts elegant solutions to accelerate threat intelligence and disrupt cybercriminal operations. As a Principal Security Research Engineer at SpyCloud, he brings over a decade of expertise across IT, Incident Response, Security Automation, and Detection Engineering. Outside the world of threat research, Aaron swaps code for a camera, capturing landscapes instead of compromises.

Trina

Trina is a security researcher with a background in digital forensics and cybercrime investigations. At SpyCloud, she analyzes cybercriminal tactics and breach data, leveraging multilingual research to understand global threat activity. Outside of her professional work, she supports law enforcement and nonprofit initiatives focused on combating human trafficking and online exploitation, assists with missing persons investigations, and mentors aspiring analysts through CTI-focused programs.

Peter Anderson

Peter has over 20 years of experience in developing tools and building infrastructure for both offensive and defensive aspects of cybersecurity. He's performed this work in both the public and private sectors and has accrued a deep understanding of how threat actors operate. Outside of his professional work, he volunteers his time to support non-profit and law enforcement efforts to combat online exploitation of children.

James K.

James has spent more than two decades exploring the darker corners of the internet, building a deep understanding of how cybercriminal communities operate, before putting that knowledge to work as a Security Analyst for the Crown (British Local Government). Now a Security Researcher at SpyCloud Labs, James focuses on phishing and human intelligence. He tracks phishing kits and the operators who build and sell them, embeds himself in underground communities to follow their activity first-hand, and connects what he finds there with breach data and malware logs to expose how stolen credentials move through the criminal ecosystem.

James M.

James has over 17 years of experience in cybersecurity, infrastructure, and automation, building tools and systems that secure large-scale environments. As a Network Security Architect at Rackspace and as a security-focused Senior Site Reliability Engineer at Atlassian, he defended systems from the network edge to the cloud and developed automation and security tooling, an experience that gave him a deep understanding of how threat actors target both systems and identities. As a Senior Security Research Engineer at SpyCloud, James brings that experience and perspective to the forefront of security research and identity threat protection.

SpyCloud Labs

Meet the research team

The fuel behind our efforts is a talented team of analysts and researchers relentlessly focused on connecting the dots as threat actors pivot and change.

Trevor Hilligoss

Trevor Hilligoss is SpyCloud's Chief Intelligence Officer, leading its global intelligence strategy and its research team, SpyCloud Labs (named Cybersecurity Team of the Year at the Cyber Security Excellence Awards). Trevor is an Army veteran, was appointed as a Special Agent with Army CID's Major Cybercrime Unit, and later served on the FBI's Cyber Task Force. He has provided expert testimony before the House Intelligence Committee, is a named participant in Europol's Operation Endgame, holds the President's Volunteer Service Award, and speaks regularly at cyber conferences in the US and internationally.

Joe Roosen

Joe spent 20 years in various system administration, consulting and design roles in information technology but eventually shifted his focus to security and thwarting cybercrime. What started as a volunteer passion project in 2017 with the Cryptolaemus group fighting Emotet has now turned into a full-fledged information security career. Joe works as the Director, Security Research at SpyCloud now leading his team to collect all of the data breaches and leaks possible. "Gotta catch them all!"

Aurora Johnson

Aurora is an information security researcher and cybersecurity policy expert who worked as a Senior Analyst for CISA before joining SpyCloud as Responsible Disclosure Coordinator. She manages the program to alert organizations when SpyCloud finds their sensitive breached, leaked, or exposed data through its collections. Aurora participates in a range of volunteer and public-private initiatives to track and disrupt the cybercriminal ecosystem and was a recipient of the President’s Volunteer Service Award in 2023 for work with the U.S. government against cyber security threats.

Kyla Cardona

Kyla is a U.S. military veteran from the Air Force, Marines, and Army, holds a BS in Computer Information Systems and multiple cybersecurity certifications including Security+, CEH, CySA+, and Splunk. Specializing in Terrorism and Homeland Security certifications coupled with extensive Chinese OSINT training, she possesses a strong sense and understanding of geopolitical cyber threats in China’s digital landscape. Kyla is a Staff Security Researcher at SpyCloud, with a focus on cyber threats in China and other cybercrimes occurring within deep/dark web illicit communities.

Yashar H.

Yashar is a GIAC Certified Forensic Analyst (GCFA) and a former SOC/Incident Response analyst who dabbles in security research and reverse engineering in his free time. At SpyCloud, he works as a Staff Security Data Analyst, focusing primarily on processing breach data for the SpyCloud Cybercrime Analytics Engine.

Daniel

Daniel is hyper-focused on developing new methods to automate the collections process and acquire more data from criminal communities. He is a Senior Security Researcher at SpyCloud Labs.

Paul S.

Paul S. is from the UK and is a biochemist with a PhD in medical research. He decided to leave the life of medical research behind to become a sysadmin for the Crown. It was there he found a love of taking apart phishing campaigns and thwarting bad actors. Paul now hunts phish for a living as our latest Staff Security Researcher.

Aaron Coffey

Forged at industry leaders like Google and Box, Aaron crafts elegant solutions to accelerate threat intelligence and disrupt cybercriminal operations. As a Senior Security Research Engineer at SpyCloud, he brings over a decade of expertise across IT, Incident Response, Security Automation, and Detection Engineering. Outside the world of threat research, Aaron swaps code for a camera, capturing landscapes instead of compromises.

Keegan Keplinger

Keegan has degrees in physics, neuroscience, and mathematics and holds a President's Volunteer Service Award for cybersecurity. Raised a commercial fisherman out of Kodiak, Alaska, Keegan joined the cybersecurity community in 2017, as part of eSentire's Threat Intelligence team where he participated in detection engineering, tool building and the collection, analysis, and dissemination of threat intelligence. Keegan studies the linguistics and humanities of Slavic and Germanic cultures as part of a broader interest in Proto-Indo-European studies. At SpyCloud, Keegan focuses on tool-development, methodology, and theory around collection and promotes a disease-based view of criminology.

Andy Culler

Andy is a seasoned security engineer passionate about automation. He started his career as an analyst and tool developer at Dell SecureWorks before moving on to help build security engineering and automation programs at Box and Slack. As a Principal Security Research Engineer at SpyCloud, Andy is excited to leverage his more than 15 years of industry experience to tackle new challenges in the world of security research.

Peter Anderson

Peter has over 20 years of experience in developing tools and building infrastructure for both offensive and defensive aspects of cybersecurity. He's performed this work in both the public and private sectors and has accrued a deep understanding of how threat actors operate. Outside of his professional work, he volunteers his time to support non-profit and law enforcement efforts to combat online exploitation of children.

Trina

Trina is a security researcher with a background in digital forensics and cybercrime investigations. At SpyCloud, she analyzes cybercriminal tactics and breach data, leveraging multilingual research to understand global threat activity. Outside of her professional work, she supports law enforcement and nonprofit initiatives focused on combating human trafficking and online exploitation, assists with missing persons investigations, and mentors aspiring analysts through CTI-focused programs.

James K.

James has spent more than two decades exploring the darker corners of the internet, building a deep understanding of how cybercriminal communities operate, before putting that knowledge to work as a Security Analyst for the Crown (British Local Government). Now a Security Researcher at SpyCloud Labs, James focuses on phishing and human intelligence. He tracks phishing kits and the operators who build and sell them, embeds himself in underground communities to follow their activity first-hand, and connects what he finds there with breach data and malware logs to expose how stolen credentials move through the criminal ecosystem.

James M.

James has over 17 years of experience in cybersecurity, infrastructure, and automation, building tools and systems that secure large-scale environments. As a Network Security Architect at Rackspace and as a security-focused Senior Site Reliability Engineer at Atlassian, he defended systems from the network edge to the cloud and developed automation and security tooling, an experience that gave him a deep understanding of how threat actors target both systems and identities. As a Senior Security Research Engineer at SpyCloud, James brings that experience and perspective to the forefront of security research and identity threat protection.

Meet the research team

The fuel behind our efforts is a talented team of analysts and researchers relentlessly focused on connecting the dots as threat actors pivot and change.

Trevor Hilligoss

Trevor Hilligoss is SpyCloud's Chief Intelligence Officer, leading its global intelligence strategy and its research team, SpyCloud Labs (named Cybersecurity Team of the Year at the Cyber Security Excellence Awards). Trevor is an Army veteran, was appointed as a Special Agent with Army CID's Major Cybercrime Unit, and later served on the FBI's Cyber Task Force. He has provided expert testimony before the House Intelligence Committee, is a named participant in Europol's Operation Endgame, holds the President's Volunteer Service Award, and speaks regularly at cyber conferences in the US and internationally.

Joe Roosen

Joe spent 20 years in various system administration, consulting and design roles in information technology but eventually shifted his focus to security and thwarting cybercrime. What started as a volunteer passion project in 2017 with the Cryptolaemus group fighting Emotet has now turned into a full-fledged information security career. Joe works as the Security Research Manager at SpyCloud Labs now leading his team to collect all of the data breaches and leaks possible. "Gotta catch them all!"

Aurora Johnson

Aurora is an information security researcher and cybersecurity policy expert who worked as a Senior Analyst for CISA before joining SpyCloud as Responsible Disclosure Coordinator. She manages the program to alert organizations when SpyCloud finds their sensitive breached, leaked, or exposed data through its collections. Aurora participates in a range of volunteer and public-private initiatives to track and disrupt the cybercriminal ecosystem and was a recipient of the President’s Volunteer Service Award in 2023 for work with the U.S. government against cyber security threats.

Kyla Cardona

Kyla is a U.S. military veteran from the Air Force, Marines, and Army, holds a BS in Computer Information Systems and multiple cybersecurity certifications including Security+, CEH, CySA+, and Splunk. Specializing in Terrorism and Homeland Security certifications coupled with extensive Chinese OSINT training, she possesses a strong sense and understanding of geopolitical cyber threats in China’s digital landscape. Kyla is a Staff Security Researcher at SpyCloud, with a focus on cyber threats in China and other cybercrimes occurring within deep/dark web illicit communities.

Yashar H.

Yashar is a GIAC Certified Forensic Analyst (GCFA) and a former SOC/Incident Response analyst who dabbles in security research and reverse engineering in his free time. At SpyCloud, he works as a Staff Security Data Analyst, focusing primarily on processing breach data for the SpyCloud Cybercrime Analytics Engine.

Daniel

Daniel is hyper-focused on developing new methods to automate the collections process and acquire more data from criminal communities. He is a Senior Security Researcher at SpyCloud Labs.

Paul S.

Paul S. is from the UK and is a biochemist with a PhD in medical research. He decided to leave the life of medical research behind to become a sysadmin for the Crown. It was there he found a love of taking apart phishing campaigns and thwarting bad actors. Paul now hunts phish for a living as our latest Staff Security Researcher.

Keegan Keplinger

Keegan has degrees in physics, neuroscience, and mathematics and holds a President's Volunteer Service Award for cybersecurity. Raised a commercial fisherman out of Kodiak, Alaska, Keegan joined the cybersecurity community in 2017, as part of eSentire's Threat Intelligence team where he participated in detection engineering, tool building and the collection, analysis, and dissemination of threat intelligence. Keegan studies the linguistics and humanities of Slavic and Germanic cultures as part of a broader interest in Proto-Indo-European studies. At SpyCloud, Keegan focuses on tool-development, methodology, and theory around collection and promotes a disease-based view of criminology.

Andy Culler

Andy is a seasoned security engineer passionate about automation. He started his career as an analyst and tool developer at Dell SecureWorks before moving on to help build security engineering and automation programs at Box and Slack. As a Principal Security Research Engineer at SpyCloud, Andy is excited to leverage his more than 15 years of industry experience to tackle new challenges in the world of security research.

Aaron Coffey

Forged at industry leaders like Google and Box, Aaron crafts elegant solutions to accelerate threat intelligence and disrupt cybercriminal operations. As a Senior Security Research Engineer at SpyCloud, he brings over a decade of expertise across IT, Incident Response, Security Automation, and Detection Engineering. Outside the world of threat research, Aaron swaps code for a camera, capturing landscapes instead of compromises.

Trina

Trina is a security researcher with a background in digital forensics and cybercrime investigations. At SpyCloud, she analyzes cybercriminal tactics and breach data, leveraging multilingual research to understand global threat activity. Outside of her professional work, she supports law enforcement and nonprofit initiatives focused on combating human trafficking and online exploitation, assists with missing persons investigations, and mentors aspiring analysts through CTI-focused programs.

Peter Anderson

Peter has over 20 years of experience in developing tools and building infrastructure for both offensive and defensive aspects of cybersecurity. He's performed this work in both the public and private sectors and has accrued a deep understanding of how threat actors operate. Outside of his professional work, he volunteers his time to support non-profit and law enforcement efforts to combat online exploitation of children.

James K.

James has spent more than two decades exploring the darker corners of the internet, building a deep understanding of how cybercriminal communities operate, before putting that knowledge to work as a Security Analyst for the Crown (British Local Government). Now a Security Researcher at SpyCloud Labs, James focuses on phishing and human intelligence. He tracks phishing kits and the operators who build and sell them, embeds himself in underground communities to follow their activity first-hand, and connects what he finds there with breach data and malware logs to expose how stolen credentials move through the criminal ecosystem.

James M.

James has over 17 years of experience in cybersecurity, infrastructure, and automation, building tools and systems that secure large-scale environments. As a Network Security Architect at Rackspace and as a security-focused Senior Site Reliability Engineer at Atlassian, he defended systems from the network edge to the cloud and developed automation and security tooling, an experience that gave him a deep understanding of how threat actors target both systems and identities. As a Senior Security Research Engineer at SpyCloud, James brings that experience and perspective to the forefront of security research and identity threat protection.

Driven by SpyCloud's identity intelligence

The purpose of SpyCloud Labs is to relentlessly analyze the active tactics we’re seeing among cybercriminals and look ahead in the evolution of these practices. We use advanced analytics to illuminate exposures relating to employee and customer credentials, cookies, PII, and other stolen assets so you can protect your organization.

1 T+

Recaptured Assets

0 B+

Assets Ingested Monthly

0 K+

Breaches

0 +

Malware Families

0 +

Phish Kits

Get the latest research

Sign up to receive regular updates from SpyCloud, including new cybercrime research, product updates, and security resources.

Cybersecurity dashboard displaying SpyCloud threat intelligence and data breach monitoring tools.

About SpyCloud's Responsible Disclosure Program

SpyCloud Labs coordinates SpyCloud’s Responsible Disclosure (RD) program. We regularly and proactively engage with victimized organizations to make sure they have access to the data that was allegedly stolen from them, giving them an opportunity to remediate potential user or employee exposures due to the release of the information.