Release Notes

View the list of updates introduced across Cyware Intelligence Suite capabilities.

Cyware Sandbox

Date	Updates
February, 2026	Note To use the following features, ensure you are on Intel Exchange v3.7.6.0 or later, or Collaborate v3.8.11.1 or later. Submit Hashes and QR Codes: Submit hashes and QR codes for analysis in Sandbox and Scan, expanding submission options beyond files and URLs. Analyze Password-Protected ZIPs: Analyze password-protected ZIP files by extracting their contents for sandbox analysis. This enables full analysis of protected artifacts. View Monthly Quota Details: Quota Details is now available to provide visibility into Sandbox and Scan usage, helping you monitor monthly consumption and plan usage accordingly. For more information, see View Quota Details. Download Artifacts as ZIP: Download sandbox-generated artifacts as a ZIP file for simplified artifact retrieval. For more information, see View Sandbox Submissions. Download Records as PDF: Download sandbox and scan records in PDF format for offline analysis. Rescan Artifacts: Rescan previously analyzed artifacts to access updated results.
July, 2025	Run Scan and Sandbox Analysis: Perform lightweight scans to quickly detect known threats or detonate suspicious files and URLs in an isolated environment to observe detailed behavior. For more information, see Cyware Sandbox. Generate Actionable Threat Intelligence: Uncover potential threats, enrich threat intelligence, and generate actionable indicators without risking infrastructure or network exposure.

Date

Updates

February, 2026

To use the following features, ensure you are on Intel Exchange v3.7.6.0 or later, or Collaborate v3.8.11.1 or later.

Submit Hashes and QR Codes: Submit hashes and QR codes for analysis in Sandbox and Scan, expanding submission options beyond files and URLs.
Analyze Password-Protected ZIPs: Analyze password-protected ZIP files by extracting their contents for sandbox analysis. This enables full analysis of protected artifacts.
View Monthly Quota Details: Quota Details is now available to provide visibility into Sandbox and Scan usage, helping you monitor monthly consumption and plan usage accordingly. For more information, see View Quota Details.
Download Artifacts as ZIP: Download sandbox-generated artifacts as a ZIP file for simplified artifact retrieval. For more information, see View Sandbox Submissions.
Download Records as PDF: Download sandbox and scan records in PDF format for offline analysis.
Rescan Artifacts: Rescan previously analyzed artifacts to access updated results.

July, 2025

Run Scan and Sandbox Analysis: Perform lightweight scans to quickly detect known threats or detonate suspicious files and URLs in an isolated environment to observe detailed behavior. For more information, see Cyware Sandbox.
Generate Actionable Threat Intelligence: Uncover potential threats, enrich threat intelligence, and generate actionable indicators without risking infrastructure or network exposure.

Date	Updates
July, 2025	Track Sector-Specific Threats: Enable industry-specific feeds to reduce noise and prioritize indicators relevant to your environment. The following feeds are supported as part of the initial release: Cyware Financial Threat Feed Cyware Energy Threat Feed Cyware Healthcare Threat Feed Cyware Manufacturing Threat Feed Cyware Government Threat Feed Cyware OT Threat Feed Cyware Ransomware Feed Cyware Malware Threat Feed Speed Up Investigations: Use enriched context for each indicator, including static and behavioral analysis, sandbox results, and related infrastructure. Identify Patterns Across Sectors: Leverage dedicated ransomware and malware feeds to monitor high-risk threats and spot broader trends beyond your sector. For more information, see Cyware Sectoral Feeds.

Date

Updates

July, 2025

Track Sector-Specific Threats: Enable industry-specific feeds to reduce noise and prioritize indicators relevant to your environment. The following feeds are supported as part of the initial release:
- Cyware Financial Threat Feed
- Cyware Energy Threat Feed
- Cyware Healthcare Threat Feed
- Cyware Manufacturing Threat Feed
- Cyware Government Threat Feed
- Cyware OT Threat Feed
- Cyware Ransomware Feed
- Cyware Malware Threat Feed
Speed Up Investigations: Use enriched context for each indicator, including static and behavioral analysis, sandbox results, and related infrastructure.
Identify Patterns Across Sectors: Leverage dedicated ransomware and malware feeds to monitor high-risk threats and spot broader trends beyond your sector.

For more information, see Cyware Sectoral Feeds.

Date	Updates
November, 2025	View Exposed Credentials: Monitor compromised credentials from multiple third-party sources in a unified view. Data is deduplicated and normalized to help you focus on confirmed exposures. For more information, see View Compromised Credentials. Track Dark Web Domain Mentions: Monitor your organization’s domains across dark web forums and marketplaces to detect potential targeting early. For more information, see View Domain Sightings. Prioritize High-Risk Accounts: Correlate exposed credentials with IAM data to assess user-level risk and prioritize high-impact threats. Automate Response Actions: Trigger predefined actions when threats are detected, reducing manual effort and accelerating remediation. Analyze Exposure Trends with Dashboards: Use dashboards to monitor exposure trends, evaluate data source performance, and track key metrics. For more information, see View Dashboard. For more information, see Exposure Management.

Date

Updates

November, 2025

View Exposed Credentials: Monitor compromised credentials from multiple third-party sources in a unified view. Data is deduplicated and normalized to help you focus on confirmed exposures. For more information, see View Compromised Credentials.
Track Dark Web Domain Mentions: Monitor your organization’s domains across dark web forums and marketplaces to detect potential targeting early. For more information, see View Domain Sightings.
Prioritize High-Risk Accounts: Correlate exposed credentials with IAM data to assess user-level risk and prioritize high-impact threats.
Automate Response Actions: Trigger predefined actions when threats are detected, reducing manual effort and accelerating remediation.
Analyze Exposure Trends with Dashboards: Use dashboards to monitor exposure trends, evaluate data source performance, and track key metrics. For more information, see View Dashboard.

For more information, see Exposure Management.

Date	Updates
February, 2025	Integrate with Team Cymru: Integrate Intel Exchange with Team Cymru to ingest enriched, actionable threat intelligence feeds directly into the platform. Ingest BARS and Controller Feeds: Consume intelligence from Team Cymru’s Botnet Analysis & Reporting Service (BARS) and Controller feeds to identify botnet activity and monitor command-and-control infrastructure. Operationalize Enriched Intelligence: Correlate and operationalize Team Cymru data within Intel Exchange for streamlined analysis and response. For more information, see Team Cymru.

Date

Updates

February, 2025

Integrate with Team Cymru: Integrate Intel Exchange with Team Cymru to ingest enriched, actionable threat intelligence feeds directly into the platform.
Ingest BARS and Controller Feeds: Consume intelligence from Team Cymru’s Botnet Analysis & Reporting Service (BARS) and Controller feeds to identify botnet activity and monitor command-and-control infrastructure.
Operationalize Enriched Intelligence: Correlate and operationalize Team Cymru data within Intel Exchange for streamlined analysis and response.

For more information, see Team Cymru.