Shadowserver Foundation

Shadowserver Foundation
Name	Shadowserver Foundation
Formation	2004
Type	Nonprofit organization
Headquarters	Amsterdam
Region served	Global
Purpose	Cybersecurity research, threat intelligence, internet scanning

Shadowserver Foundation is a nonprofit organization focused on collecting, analyzing, and reporting internet-wide security data to help mitigate cyber threats affecting infrastructure, networks, and digital services. It operates global scanning and reporting programs, collaborates with law enforcement, and provides data feeds to network operators, registries, and research institutions. Shadowserver has influenced public policy, incident response, and cybersecurity research through extensive datasets and coordinated disclosure.

History

Founded in 2004 by volunteers with backgrounds in network security and incident response, Shadowserver emerged amid evolving threats exemplified by incidents like the SQL slammer worm, the Conficker outbreak, and the rise of botnets such as Zeus and Mirai. Early work paralleled efforts by organizations including CERT Coordination Center, SANS Institute, and Electronic Frontier Foundation to map vulnerable hosts and notify affected parties. During the 2010s Shadowserver expanded services in response to large-scale incidents such as Operation Aurora, the Sony Pictures hack, and nation-state activity linked to groups discussed in reports by Mandiant and FireEye. The organization’s growth coincided with developments at institutions like ICANN, RIPE NCC, and ARIN addressing routing, abuse handling, and registration policies. Global events such as the WannaCry attack and discussions at forums including the World Economic Forum and Internet Governance Forum influenced Shadowserver’s operational priorities and partnerships.

Mission and Activities

Shadowserver’s mission emphasizes reducing cyber risk through actionable intelligence, transparency, and cooperation with entities like Europol, INTERPOL, and national Computer Emergency Response Teams such as US-CERT and CERT-UK. Activities include daily reporting to network operators, working with top-level domain operators like Verisign, and liaising with internet infrastructure organizations such as Packet Clearing House and Cloudflare. Shadowserver produces incident data used by academic groups at Massachusetts Institute of Technology, University of Oxford, and Stanford University for studies on topics including botnets and vulnerability exploitation. Its engagement spans policy dialogues involving European Commission, NATO Communications and Information Agency, and regulatory bodies considering frameworks like the NIS Directive.

Data Collection and Research

Shadowserver conducts internet-wide scanning and passive data collection similar in scope to projects by Shodan, Censys, and the Project Sonar initiative at Rapid7. Collected datasets cover services, malware sinkholes, command-and-control infrastructures linked to families such as Emotet, TrickBot, and LockBit, and abuse signals tied to registrars like Namecheap and GoDaddy. Researchers from institutions including Carnegie Mellon University, Georgia Institute of Technology, and ETH Zurich have leveraged Shadowserver feeds for longitudinal studies on vulnerability exposure, patching behavior, and routing anomalies referencing incidents like BGP hijacking events involving networks such as Telia and Level 3 Communications. Shadowserver’s methodology informed standards discussions at bodies like IETF and measurement ethics debates involving Association for Computing Machinery conferences.

Partnerships and Collaborations

Shadowserver collaborates with law enforcement agencies such as FBI, Dutch National Police, and Polizia Postale e delle Comunicazioni, as well as private sector partners including Microsoft, Google, Amazon Web Services, and security firms like Kaspersky Lab and Palo Alto Networks. It provides data to registry operators including Verisign, Public Interest Registry, and regional registries such as LACNIC and APNIC to support takedowns and remediation. Academic collaborations involve labs at University of California, Berkeley, University College London, and University of Toronto. Multi-stakeholder engagement has connected Shadowserver with initiatives led by Global Cyber Alliance, FIRST (Forum of Incident Response and Security Teams), and philanthropic efforts by organizations like Mozilla Foundation.

Impact and Notable Operations

Shadowserver’s reporting has enabled mitigation of botnet activity attributed to families such as Zeus and Mirai and supported disruption actions against campaigns linked to actors cited in Mandiant APT1 and other incident reports. The foundation’s sinkholing work contributed to disruption efforts mirrored in operations by Microsoft Digital Crimes Unit and high-profile coordinated actions such as those against Avalanche. Shadowserver data has been cited in analyses by Symantec, Cisco Talos, and Trend Micro, and used in legal and policy cases involving breach responses referenced in hearings before bodies like the United States Congress and inquiries by the European Parliament. Its reports have assisted critical infrastructure providers including E-ON, Siemens, and Schneider Electric during incidents affecting industrial control systems noted in advisories by US-CERT and ENISA.

Organization and Funding

Operated by a small team of analysts, researchers, and volunteers, Shadowserver has historically received support through donations, grants, and contracted services involving entities such as foundations like Open Technology Fund and programs run by European Commission research funding mechanisms. Collaboration agreements with companies including Cisco Systems and Oracle have facilitated tooling and infrastructure, while partnerships with regional CERTs and registries provide operational support. Governance interactions have occurred with oversight bodies and standards organizations such as ICANN and IETF, and funding discussions have engaged philanthropic and governmental stakeholders concerned with cybersecurity resilience, including initiatives by NATO and national ministries of Interior of the Netherlands and counterparts elsewhere.

Category:Cybersecurity organizations