Works
2026
-
Talk · 30 September 2026
Red Teams and Real Attacks: Misalignment due to Skewed Incentives
CanSecWest 2026, Vancouver · Speaker · Research with Ben Nahorney · ↗ secwest.net
-
Framework · 24 September 2026
A guide to thinking about AI security risk
Expel · Author · ↗ expel.com
See the project page.
-
Talk · 5 August 2026
AI Security Risk Decoded: a Framework Built for Security Leaders
Black Hat USA 2026, Las Vegas · Speaker · ↗ prnewswire.com
-
Press · 29 April 2026
Beyond "Actionable": How Brian Hein and James Shank Want CTI to Actually Hurt Adversaries
DNSFilter · Quoted, with Brian Hein · ↗ dnsfilter.com
-
Talk · 23 April 2026
How NOT to be Your Adversary's Best Friend - Doing What Matters...
FIRST CTI 2026, Munich · Speaker, with Brian Hein · ↗ first.org
-
Panel · 25 March 2026
Expel, San Francisco · Panelist, with Marcus Hutchins · ↗ expel.com
-
Interview · March 2026
What security teams need to know about Iran's cyber threat right now
Expel · Interview, with Steph Shample · ↗ expel.com
-
Publication · 2026
Anthropic Mythos didn't break your security. It found what was already broken.
Expel · Author · ↗ expel.com
2025
-
Talk · August 2025
What are we doing?
w00con · Speaker
A critical look at the direction of several pursuits in cybersecurity.
-
Publication · 17 June 2025
Operation Endgame: Do Takedowns & Arrests Matter?
Dark Reading · Author · ↗ darkreading.com
-
Press · May 2025
Lumma Stealer Takedown Reveals Sprawling Operation
Dark Reading · Quoted · ↗ darkreading.com
-
Press · 2025
Conti Trickbot Mastermind Unmasked Amid Huge Ops Leak
Dark Reading · Quoted · ↗ darkreading.com
-
Press · 2025
Expel accelerates threat intelligence program to turn signal into shield
Expel · Quoted · ↗ expel.com
-
Interview · 2025
Meet the Expletive: James Shank Director of Threat Operations
Expel · Interview · ↗ expel.com
-
Publication · 2025
Our cybersecurity predictions for 2026
Expel · Contributor · ↗ expel.com
2024
-
Project · 2024 to 2025
Facilitator · Closed, invite-only
-
Press · 19 December 2024
Congress funds removal of Chinese telecom gear as feds probe home router risks
The Washington Post · Quoted · ↗ washingtonpost.com
-
Publication · 19 June 2024
Criminals are Easily Bypassing Passkeys – How Organizations Can Stay Safe
Security Boulevard, for SpyCloud · Author · ↗ securityboulevard.com
2023
-
Podcast · 22 August 2023
James Shank — The Imposter Syndrome Network Podcast
Imposter Syndrome Network · Interview, with Chris Grundemann and Zoë Rose · ↗ impostersyndrome.network
Also on YouTube.
-
Talk · August 2023
Speaking session at Black Hat USA 2023
Black Hat USA 2023, for SpyCloud · Speaker · ↗ spycloud.com
The link is SpyCloud's report on the conference.
-
Talk · 8 June 2023
From Trust Groups to Action Communities: Changing the Sharing Game
35th Annual FIRST Conference, Montreal · Speaker, with Tom Millar (CISA) · ↗ first.org
A TLP:AMBER session.
-
Publication · 24 March 2023
LinkedIn · Author · ↗ linkedin.com
-
Board · 2023
NetDiligence Ransomware Advisory Board
NetDiligence · Member · ↗ netdiligence.com
2022
-
Talk · 27 October 2022
DDoS Mitigation by Community Cooperation ... and other fun
Swiss Websecurity Day 2022, Bern · Speaker · ↗ switch.ch
Video, 15 minutes. SWITCH, the Swiss Internet Security Alliance, and Swico organized the event. James gave the same talk at Peering Days 2022.
-
Talk · 26 October 2022
20 years on... Top 10 Security Recommendations then and now
SWITCH Security Awareness Day 2022, Bern · Speaker
-
Talk · 17 October 2022
Increasing IPv6 Utilization in Consumer Networks
NANOG 86, Hollywood · Joint work, presented by Nimrod Levy (AT&T) · With Rich Compton (Charter) and Louie Lee (Google) · ↗ nanog.org
DNS46 and NAT46 on the home router, so IPv4-only devices reach IPv6 content without carrier-grade NAT.
Video, on the NANOG channel.
-
Talk · 6 June 2022
NANOG 85, Montreal · Speaker, with Tina Morris and Cat Gurinsky · ↗ youtube.com
Video, on the NANOG channel. James was a member of the NANOG Program Committee.
-
Talk · April 2022
DDoS Mitigation by Community Cooperation
Peering Days 2022, Athens · Speaker · ↗ peeringdays.eu
-
Talk · 6 to 7 April 2022
Netnod Meeting 2022, Stockholm · Speaker · ↗ netnod.se
-
Research · 8 March 2022
Record breaking DDoS Potential Discovered: CVE-2022-26143
Team Cymru · Co-author · ↗ team-cymru.com
With Akamai SIRT, Cloudflare, Lumen Black Lotus Labs, Mitel, NETSCOUT Arbor ASERT, TELUS, and the Shadowserver Foundation.
2021
-
Press · 16 November 2021
Researchers Spot Comeback of the Emotet Botnet
BankInfoSecurity · Quoted · ↗ bankinfosecurity.com
-
Press · 16 November 2021
Emotet Botnet Returns | Researchers Say it was Once the 'World's Most Dangerous Malware'
TechTimes · Quoted · ↗ techtimes.com
-
Publication · 7 October 2021
Apache Vulnerability allows RCE and Path Traversal
Team Cymru · Author · ↗ web.archive.org
The link is the archived copy.
-
Project · 12 July 2021
Chairperson of the Board · Cofounder, with Tim April, Matt Ploessel and Warren Kumari ·↗ internetfire.org
A nonprofit, incorporated on 12 July 2021. Its records are on ProPublica.
-
Panel · 6 July 2021
Executives and Ransomware: Stop Collaborate and Listen! (webcast + Q&A)
SANS Institute · Panelist, with Ryan Chapman · ↗ sans.org
Video, on the SANS Institute channel.
-
Press · 3 July 2021
Ransomware attack before holiday leaves companies scrambling
The Associated Press · Quoted · ↗ mprnews.org
-
Press · 21 May 2021
The Cybersecurity 202: Cybersecurity pros are split on banning ransomware payments
The Washington Post · Quoted · ↗ washingtonpost.com
-
Press · 10 May 2021
Cybercriminal gang hit Colonial Pipeline with ransomware attack
Intelligent CIO North America · Quoted · ↗ intelligentcio.com
-
Press · 29 April 2021
PRWeb, for Team Cymru and the Institute for Security and Technology · Quoted, with Philip Reiner · ↗ prweb.com
-
Publication · 29 April 2021
Approaching Ransomware with a Fresh Perspective
Team Cymru · Author · ↗ web.archive.org
The link is the archived copy.
-
Project · April 2021
Institute for Security and Technology · Contributor · Chair of the Worst Case Scenarios subcommittee · ↗ prweb.com
-
Press · 28 January 2021
The Cybersecurity 202: International law enforcement took down a leading cybercrime gang
The Washington Post · Quoted · ↗ washingtonpost.com
-
Publication · 27 January 2021
Team Cymru · Author · ↗ team-cymru.com
With Cryptolaemus, the Department of Homeland Security, and law enforcement in eight countries.
-
Press · January 2021
Law enforcement strikes back at Emotet one of the world's most popular ransomware loaders
SC Media · Quoted · ↗ scworld.com
2020
-
Publication · 16 December 2020
Who Comes Knocking on Home Router Backdoors?
Team Cymru · Author · ↗ team-cymru.com
-
Publication · 29 October 2020
Team Cymru · Author · ↗ team-cymru.com
-
Talk · 2 October 2020
Pandamic: Emissary Pandas in the Middle East
Virus Bulletin, VB2020 localhost · Speaker, with Jacomo Piccolini · ↗ vblocalhost.com
Video, on the Virus Bulletin channel.
-
Research · October 2020
Pandamic: Emissary Pandas in the Middle East (paper)
Virus Bulletin, VB2020 localhost · Co-author, with Jacomo Piccolini · ↗ vblocalhost.com
-
Publication · 31 July 2020
Emotet is back… and where are we?
Team Cymru · Author · ↗ team-cymru.com
-
Publication · 8 April 2020
BGP Hijacking and BGP Security
Team Cymru · Author · ↗ team-cymru.com
-
Talk · 24 February 2020
DNS Hijacking, Gaps, and Fixes
LINX108, London · Speaker · ↗ linx.net
Video, on the LINX portal. A LINX login can be necessary.
-
Publication · 24 February 2020
Team Cymru · Author · ↗ team-cymru.com
2019
-
Talk · 31 October 2019
DNS Transparency Project (lightning talk)
DNS-OARC 31, Austin · Speaker, with Matt Ploessel, Tim April, Barry Greene, and Warren Kumari · ↗ dns-oarc.net
-
Talk · 30 October 2019
Lightning Talk: DNS Transparency Project
NANOG 77, Austin · Speaker, with Tim April, Barry Greene, Warren Kumari, and Matt Ploessel · ↗ nanog.org
Video, on the NANOG channel.
-
Talk · April 2019
All your DNS, are belong to …?
ISOI XXI · Speaker
A TLP:AMBER session.
-
Project · 2019
Internet Fire Brigade Society · Founding member, with Tim April, Barry Greene, Warren Kumari, and Matt Ploessel · ↗ internetfire.org
2018
-
Project · 2018
Community-side coordinator · ↗ team-cymru.com
2013
-
Talk · September 2013
Designing Resilient Networks
Interpol World Headquarters · Author and presenter · A 3.5-hour workshop for executives, CISOs and international law enforcement
Other
-
Interview
Madness and Mayhem: How James Shank found success in the fast-paced tech industry
Expel, on YouTube · Interview · ↗ youtube.com
-
Membership
FIRST · Liaison · ↗ first.org