What AV Vendors Can Get from Network-Level Telemetry
Sample analysis tells you what malware does, but rarely who runs it, where it lives, or who else is talking to it. This talk shows how pairing file-based detection with network-level telemetry (NetFlow, passive DNS, certificate and service fingerprints, and BGP data) closes that gap. Using an anonymized case study, we walk a pivot chain from a single indicator to sibling infrastructure, affected networks, and the hosting provider behind it. We cover how this improves attribution, prioritization, and takedown, where the data misleads (shared hosting, CDNs, sinkholes), and how research teams can add infrastructure enrichment to their existing triage workflow.
Kyle Krejci – Team Cymru
Kyle Krejci is a Sr. Threat Intelligence Engineer at Team Cymru, where he works with ISPs, IXPs, hosting providers, national CERTs, and government organizations to bring threat intelligence and real visibility to the people running the networks. His focus is practical: helping service and hosting providers find the malicious infrastructure operating inside their own address space, understand what it is doing, and get it off their networks for good.
With more than a decade in cybersecurity, Kyle specializes in NetFlow/IPFIX, BGP, and passive DNS. He has presented at MNSEC13, LACNIC45, Cybercrime.4, INTERPOL CyberEX, Underground Economy, and CERT-In SAMVAAD 2025, and works regularly with international law enforcement on abuse and bulletproof hosting investigations. He is based in Tampa, Florida.