Last updated
IndustryNetwork Security
FounderAdam Vincent (CEO), Leigh Reichel (CFO)
Arlington, Virginia
United States
Products Threat Intelligence Platform
Number of employees
129 (May 2019) [1]

ThreatConnect is a cyber-security firm based in Arlington, Virginia. They provide a Threat Intelligence Platform for companies to aggregate and act upon threat intelligence.



The firm was founded in 2011 as Cyber Squared Inc. by Adam Vincent, Richard Barger, Andrew Pendergast and Leigh Reichel. [2] They renamed to ThreatConnect after their series A funding of $4 million in 2014, [3] [4] and in December 2015 obtained series B funding of $16 million. [5]

The company gained attention when it linked the Anthem medical data breach to Chinese government-sponsored entities. [6] According to cybercrime expert Brian Krebs, ThreatConnect identified domains used by the group that were intentionally similar to legitimate domains used by Anthem. [7]

They also linked Guccifer 2.0, responsible for the 2016 Democratic National Committee email leak, to the Russian-backed cyberespionage group Fancy Bear. [8] [9] Further cyberattacks they attributed to Fancy Bear include against a group investigating the Malaysia Airlines 17 crash, [10] and the World Anti-Doping Agency who had recently issued a report about state-sponsored doping. [11]

In September 2020, ThreatConnect acquired Virginia-based software company Nehemiah Security. [12]

Related Research Articles

Computer security The protection of computer systems from theft or damage

Computer security, cybersecurity or information technology security is the protection of computer systems and networks from the theft of or damage to their hardware, software, or electronic data, as well as from the disruption or misdirection of the services they provide.

Brian Krebs is an American journalist and investigative reporter. He is best known for his coverage of profit-seeking cybercriminals. His interest grew after a computer worm locked him out of his own computer in 2001.

Cyberwarfare by Russia includes denial of service attacks, hacker attacks, dissemination of disinformation and propaganda, participation of state-sponsored teams in political blogs, internet surveillance using SORM technology, persecution of cyber-dissidents and other active measures. According to investigative journalist Andrei Soldatov, some of these activities were coordinated by the Russian signals intelligence, which was part of the FSB and formerly a part of the 16th KGB department. An analysis by the Defense Intelligence Agency in 2017 outlines Russia's view of "Information Countermeasures" or IPb as "strategically decisive and critically important to control its domestic populace and influence adversary states", dividing 'Information Countermeasures' into two categories of "Informational-Technical" and "Informational-Psychological" groups. The former encompasses network operations relating to defense, attack, and exploitation and the latter to "attempts to change people's behavior or beliefs in favor of Russian governmental objectives."

FireEye is a publicly traded cybersecurity company headquartered in Milpitas, California. It has been involved in the detection and prevention of major cyber attacks. It provides hardware, software, and services to investigate cybersecurity attacks, protect against malicious software, and analyze IT security risks. FireEye was founded in 2004.

Palo Alto Networks American technology company

Palo Alto Networks, Inc. is an American multinational cybersecurity company with headquarters in Santa Clara, California. Its core products are a platform that includes advanced firewalls and cloud-based offerings that extend those firewalls to cover other aspects of security. The company serves over 70,000 organizations in over 150 countries, including 85 of the Fortune 100. It is home to the Unit 42 threat research team and hosts the Ignite cybersecurity conference.

Cozy Bear, classified by the United States Federal Government as advanced persistent threat APT29, is a Russian hacker group believed to be associated with one or more intelligence agencies of Russia. The Dutch General Intelligence and Security Service (AIVD) deduced from security camera footage that it is led by the Russian Foreign Intelligence Service (SVR). Cybersecurity firm CrowdStrike also previously suggested that it may be associated with either the Russian Federal Security Service (FSB) or SVR. The group was given other nicknames by other cybersecurity firms, including Office Monkeys, CozyCar, The Dukes, and CozyDuke. On 20 December 2020 it was reported that CozyBear was responsible for a cyber attack on US sovereign national data, believed to be at the direction of the Russian government.

Illusive Networks is a cybersecurity firm headquartered in Tel Aviv, Israel and New York. The company produces technology that stops cyber attackers from moving laterally inside networks by finding and eliminating errant credentials and connections, planting false information about given network's resources, emulating devices, and deploying high interactivity decoys. Network administrators are alerted when cyber attackers use security deceptions in an attempt to exploit the network. Illusive Networks is the first company launched by the Tel Aviv-based incubator, Team8. In June 2015, Illusive Networks received $5 million in Series A funding from Team8. To date, it has raised over $30M.

Fancy Bear is a Russian cyber espionage group. Cybersecurity firm CrowdStrike has said with a medium level of confidence that it is associated with the Russian military intelligence agency GRU. The UK's Foreign and Commonwealth Office as well as security firms SecureWorks, ThreatConnect, and Fireeye's Mandiant, have also said the group is sponsored by the Russian government. In 2018, an indictment by the United States Special Counsel identified Fancy Bear as GRU Unit 26165.

CrowdStrike Holdings, Inc. is an American cybersecurity technology company based in Sunnyvale, California. It provides endpoint security, threat intelligence, and cyberattack response services. The company has been involved in investigations of several high-profile cyberattacks, including the 2014 Sony Pictures hack, the 2015–16 cyber attacks on the Democratic National Committee (DNC), and the 2016 email leak involving the DNC.

The Democratic National Committee cyber attacks took place in 2015 and 2016, in which Russian computer hackers infiltrated the Democratic National Committee (DNC) computer network, leading to a data breach. Cybersecurity experts, as well as the U.S. government, determined that the cyberespionage was the work of Russian intelligence agencies.

The 2016 Democratic National Committee email leak is a collection of Democratic National Committee (DNC) emails stolen by one or more hackers operating under the pseudonym "Guccifer 2.0" who are alleged to be Russian intelligence agency hackers, according to indictments carried out by the Mueller investigation. These emails were subsequently leaked by DCLeaks in June and July 2016 and by WikiLeaks on July 22, 2016, just before the 2016 Democratic National Convention. This collection included 19,252 emails and 8,034 attachments from the DNC, the governing body of the United States' Democratic Party. The leak includes emails from seven key DNC staff members, and date from January 2015 to May 2016. On November 6, 2016, WikiLeaks released a second batch of DNC emails, adding 8,263 emails to its collection.

"Guccifer 2.0" is a persona which claimed to be the hacker(s) who gained unauthorized access to the Democratic National Committee (DNC) computer network and then leaked its documents to the media, the website WikiLeaks, and a conference event. Some of the documents "Guccifer 2.0" released to the media appear to be forgeries cobbled together from public information and previous hacks, which had been mixed with disinformation. According to indictments in February 2018, the persona is operated by Russian military intelligence agency GRU. On July 13, 2018, Special Counsel Robert Mueller indicted 12 GRU agents for allegedly perpetrating the cyberattacks.

On Friday July 29, 2016 the Democratic Congressional Campaign Committee reported that its computer systems had been infiltrated. It is strongly believed by US intelligence sources that the infiltrator groups are Russian foreign intelligence groups that breached the Democratic National Committee's computer systems. These groups are known as Fancy Bear and Cozy Bear.

DCLeaks was a website that was established in June 2016. Since its creation, it has been responsible for publishing leaks of emails belonging to multiple prominent figures in the United States government and military. Cybersecurity research firms say the site is a front for the Russian cyber-espionage group Fancy Bear. On July 13, 2018, an indictment was made against 12 Russian GRU military officers; it alleged that DCLeaks is part of a Russian military operation to interfere in the 2016 U.S. presidential election.

In March 2016, the personal Gmail account of John Podesta, a former White House chief of staff and chair of Hillary Clinton's 2016 U.S. presidential campaign, was compromised in a data breach accomplished via a spear-phishing attack, and some of his emails, many of which were work-related, were hacked. Cybersecurity researchers as well as the United States government attributed responsibility for the breach to the Russian cyber spying group Fancy Bear, allegedly two units of a Russian military intelligence agency.

<i>The Plot to Hack America</i>

The Plot to Hack America: How Putin's Cyberspies and WikiLeaks Tried to Steal the 2016 Election is a non-fiction book by Malcolm Nance about what the author describes as Russian interference in the 2016 United States elections. It was published in paperback, audiobook, and e-book formats in 2016 by Skyhorse Publishing. A second edition was also published the same year, and a third edition in 2017. Nance researched Russian intelligence, working as a Russian interpreter and studying KGB history.

Anomali is a US-based cyber security company known for its threat intelligence and analysis platform.

Greg Martin is a cybersecurity expert and entrepreneur. He is the co-founder of cyber-security company Anomali and is the co-founder and CEO of cyber security company JASK. Martin is credited with inventing the first Threat Intelligence Platform (TIP), and is the creator of the popular open source Honeypot project “Modern Honey Network”.

Timeline of Russian interference in the 2016 United States elections (July 2016–election day) Major events prior to Trumps inauguration related to interference by Russia in the U.S. 2016 election

This is a timeline of events related to Russian interference in the 2016 United States elections.

2020 United States federal government data breach US federal government data breach

In March 2020, a major cyberattack by a group backed by a foreign government penetrated multiple parts of United States federal government, via software released from three U.S. firms: Microsoft, SolarWinds, and VMware, leading to data breaches, and the breach discovered December 2020. The hacking group Cozy Bear (APT29), backed by the Russian intelligence agency SVR, was identified as the cyberattackers. The cyberattack and data breach were reported to be among the worst cyber-espionage ever suffered by the U.S., due to the sensitivity and high profile of the targets and the long duration in which the hackers had access. Within days of its discovery, at least 200 organizations around the world had been reported to be affected by the attack, and some of these may also have suffered data breaches.


  1. Chris Bing (26 January 2016). "This Cyber Startup Is Flying Under the Radar With a Monster Valuation". DC Inno.
  2. Ethan Rothstein (12 January 2015). "Shirlington Startup Helping Big Companies Prevent Hacking". ARLnow - Arlington, Va. Local News & Community.
  3. Eric Hal Schwartz (20 November 2014). "Virginia Cybersecurity Startup Cyber Squared Gets $4M and a Name Change". In The Capital.
  4. Steven Overly (20 November 2014). "Cybersecurity firm Cyber Squared raises $4 million, changes name to ThreatConnect". The Washington Post.
  5. Cara O'Donnell (22 December 2016). "Threat Intelligence Startup ThreatConnect Closes $16M Investment Round and Makes Strategic Move within Arlington". Arlington Economic Development.
  6. Ellen Nakashima (27 February 2015). "Security firm finds link between China and Anthem hack". The Washington Post.
  7. Brian Krebs (9 April 2016). "Anthem Breach May Have Started in April 2014". Krebs On Security.
  8. Teri Robinson (26 July 2016). "ThreatConnect: Guccifer 2.0 likely persona for Russian-linked propagandists, PR operatives leaking info to media". SC Magazine. Haymarket Media Group.
  9. "US cybersecurity firms say Russia likely behind hacks". The Times of Israel. Associated Press. 1 August 2016.
  10. India Ashok (29 September 2016). "Journalists investigating MH17 hacked by Russia-backed Fancy Bear hackers - ThreatConnect". International Business Times.
  11. Sam Thielman (23 August 2016). "Same Russian hackers likely breached Olympic drug-testing agency and DNC". The Guardian.
  12. "Arlington cybersecurity firm buys Tysons software company". Virginia Business. 2020-09-10. Retrieved 2020-09-29.