The Curious Engineer

All blogs / Security

Cisco Talos Blog

blog.talosintelligence.com

Talos intelligence and world-class threat research team better protects you and your organization against known and emerging cybersecurity threats.

Security

’23’24’25’26
Posts
549 from 31 Aug 2023 to 29 Oct 2026
Posting
about daily (184 in the last year)
Kind
company blog
Feed
https://blog.talosintelligence.com/rss/

2026 164

  1. A quiet week in infosec <.<
  2. IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
  3. NIK C2: The new AI-enabled command-and-control framework
  4. Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
  5. From federal SOCs to Talos: Ryan Fetterman on practical security research
  6. Intelligence Search
  7. Vulnerability Reports
  8. I had plans for that second
  9. Compromised eMudhra intermediate certificates
  10. Two critical RCEs in PHP core
  11. Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
  12. There's only so much code: the rise in vulnerability numbers
  13. The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
  14. Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
  15. Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
  16. Making sure the checks get printed
  17. UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
  18. Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
  19. Microsoft, Adobe, Apple, and Foxit vulnerabilities
  20. One breach, please, and make no mistakes
  21. Give yourself room to be human
  22. The Fine Art of Frustrating the Adversary
  23. China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
  24. Securing the keys to the kingdom: Announcing Executive Threat Detection
  25. Trust and the enticing consultancy offer
  26. Introducing CAIRN: Frontier tracking for AI-integrated malware
  27. The Closed Quorum: Inside the first reported autonomous AI C2 implant
  28. Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
  29. Should you care about an “AI slowdown?”
  30. Securing the unpatchable in an age of AI-driven vulnerabilities
  31. We've got one word for it, and it's usually the wrong one
  32. Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
  33. ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
  34. Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
  35. ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
  36. The story behind the intelligence
  37. JavaScript obfuscation: From party trick to phishing kit
  38. “Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend
  39. Choose your fighter: Balancing competing requirements to select models for your AI SOC
  40. The safety penalty: Reclaiming operational sovereignty in the age of AI
  41. UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
  42. UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
  43. Is Cyber missing the Marque?
  44. Describing attacks with crime script analysis
  45. Dissecting the JWR phishing framework
  46. Curiouser and Curiouser
  47. Vulnerability Research
  48. Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities
  49. Why metaphor may dictate your security strategy
  50. “Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI
  51. [Webinar] Tales from the Frontlines: An exclusive briefing on Q2 incidents
  52. Black Hat special: Rewind and revisit
  53. You were onto something with “It’s the Climb,” Miley
  54. IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains
  55. Preview: Cisco Talos at Black Hat USA 2026
  56. Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
  57. Don’t swing at everything
  58. UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
  59. The Hunter's Paradox: Is it time to embrace automated threat hunting?
  60. Begun, the Patch Wars have
  61. [Video] Where protection starts: Cisco Talos Intelligence Integrations
  62. Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities
  63. The serpent’s tongue: Luring the Python out of its den
  64. Winning 54% of the time
  65. WolfSSL, GeoVision, VTK vulnerabilities
  66. UAT-7810 continues building ORB networks using new malware
  67. Catan and Mouse
  68. ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365
  69. Martin Lee: Running through the Arctic (and the threat landscape)
  70. Introduction to COM usage by Windows threats
  71. Beyond IOCs: AI-enabled threat intelligence
  72. Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model
  73. Close Encounters of the Human Kind
  74. A tale of two eras
  75. Microsoft Patch Tuesday for June 2026 — Snort rules and prominent vulnerabilities
  76. Hypotheses, telemetry, and human judgment: Inside Cisco Talos Threat Hunting
  77. Winning the cyber marathon with Tony Giandomenico
  78. Reporting from Vegas: Networking, AI, and good boys
  79. DICOM, Pydicom, GDCM, and Orthanc: A technical tour of what really happens in the heap
  80. Less panic patching, more precision
  81. Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake
  82. MediaArea heap-based buffer overflow vulnerabilities
  83. The art of being ungovernable
  84. From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat
  85. TP-Link, Photoshop, OpenVPN, Norton VPN vulnerabilities
  86. Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities
  87. The time of much patching is coming
  88. Breaking things to keep them safe with Philippe Laulheret
  89. Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities
  90. State-sponsored actors, better known as the friends you don’t want
  91. Unplug your way to better code
  92. Insights into the clustering and reuse of phone numbers in scam emails
  93. CloudZ RAT potentially steals OTP messages using Pheno plugin
  94. UAT-8302 and its box full of malware
  95. Great responsibility, without great power
  96. AI-powered honeypots: Turning the tables on malicious AI agents
  97. Five defender priorities from the Talos Year in Review
  98. It pays to be a forever student
  99. UAT-4356's Targeting of Cisco Firepower Devices
  100. IR Trends Q1 2026: Phishing reemerges as top initial access vector, as attacks targeting public administration persist
  101. Bad Apples: Weaponizing native macOS primitives for movement and execution
  102. Phishing and MFA exploitation: Targeting the keys to the kingdom
  103. [Podcast] It's not you, it's your printer: State-sponsored and phishing threats in 2025
  104. More than pretty pictures: Wendy Bishop on visual storytelling in tech
  105. PowMix botnet targets Czech workforce
  106. The Q1 vulnerability pulse
  107. Foxit, LibRaw vulnerabilities
  108. The n8n n8mare: How threat actors are misusing AI workflow automation
  109. State-sponsored threats: Different objectives, similar access paths
  110. Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities
  111. [Video] The TTP Ep. 22: The Collapse of the Patch Window
  112. From the field to the report and back again: How incident responders can use the Year in Review
  113. The threat hunter’s gambit
  114. New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations
  115. The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines
  116. Talos Takes: 2025's ransomware trends and zombie vulnerabilities
  117. Year in Review: Vulnerabilities old and new and something React2
  118. Axios NPM supply chain incident
  119. Do not get high(jacked) off your own supply (chain)
  120. An overview of ransomware threats in Japan in 2025 and early detection insights from Qilin cases
  121. Inside the Talos 2025 Year in Review: A discussion on what the data means for defenders
  122. UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications
  123. [Video] The TTP Ep 21: When Attackers Become Trusted Users
  124. The democratisation of business email compromise fraud
  125. Ransomware in 2025: Blending in is the strategy
  126. Talos Takes: 2025 insights from Talos and Splunk
  127. A puppet made me cry and all I got was this t-shirt
  128. TP-Link, Canva, HikVision vulnerabilities
  129. 2025 Talos Year in Review: Speed, scale, and staying power
  130. Beers with Talos breaks down the 2025 Talos Year in Review
  131. Everyday tools, extraordinary crimes: the ransomware exfiltration playbook
  132. You have to invite them in
  133. Transparent COM instrumentation for malware analysis
  134. This one’s for you, Mom
  135. Spinning complex ideas into clear docs with Kri Dontje
  136. Agentic AI security: Why you need to know about autonomous agents now
  137. DirectX, OpenFOAM, Libbiosig vulnerabilities
  138. Microsoft Patch Tuesday for March 2026 — Snort rules and prominent vulnerabilities
  139. UAT-9244 targets South American telecommunication providers with three new malware implants
  140. Patch, track, repeat: The 2025 CVE retrospective
  141. Henry IV, Hotspur, Hal, and hallucinations
  142. New Dohdoor malware campaign targets education and health care
  143. Active exploitation of Cisco Catalyst SD-WAN by UAT-8616
  144. Using AI to defeat AI
  145. “Good enough” emulation: Fuzzing a single thread to uncover vulnerabilities
  146. Ryan Liles, master of technical diplomacy
  147. Hand over the keys for Shannon’s shenanigans
  148. Microsoft Patch Tuesday for February 2026 — Snort rules and prominent vulnerabilities
  149. New threat actor, UAT-9921, leverages VoidLink framework in campaigns
  150. All gas, no brakes: Time to come to AI church
  151. Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework
  152. IR Trends Q4 2025: Exploitation remains dominant, phishing campaign targets Native American tribal organizations
  153. Dissecting UAT-8099: New persistence mechanisms and regional focus
  154. Microsoft releases update to address zero-day vulnerability in Microsoft Office
  155. I'm locked in!
  156. Foxit, Epic Games Store, MedDreams vulnerabilities
  157. I scan, you scan, we all scan for... knowledge?
  158. UAT-8837 targets critical infrastructure sectors in North America
  159. Predicting 2026
  160. Brushstrokes and breaches with Terryn Valikodath
  161. Microsoft Patch Tuesday for January 2026 — Snort rules and prominent vulnerabilities
  162. UAT-7290 targets high value telecommunications infrastructure in South Asia
  163. Resolutions, shmesolutions (and what’s actually worked for me)
  164. How Cisco Talos powers the solutions protecting your organization

2025 156

  1. Adios 2025, you won’t be missed
  2. Lexi DiScola’s guide to global teamwork and overflowing TBRs
  3. UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager
  4. Libbiosig, Grassroot DiCoM, Smallstep step-ca vulnerabilities
  5. One newsletter to rule them all
  6. New in Snort3: Enhanced rule grouping for greater flexibility and control
  7. New BYOVD loader behind DeadLock ransomware attack
  8. Microsoft Patch Tuesday for December 2025 — Snort rules and prominent vulnerabilities
  9. Spy vs. spy: How GenAI is powering defenders and attackers
  10. Your year-end infosec wrapped
  11. Socomec DIRIS Digiware M series and Easy Config, PDF XChange Editor vulnerabilities
  12. Care that you share
  13. Dell ControlVault, Lasso, GL.iNet vulnerabilities
  14. It’s not personal, it’s just business
  15. Bill Largent: On epic reads, lifelong learning, and empathy
  16. Unleashing the Kraken ransomware group
  17. Viasat and the terrible, horrible, no good, very bad day
  18. Microsoft Patch Tuesday for November 2025 — Snort rules and prominent vulnerabilities
  19. Remember, remember the fifth of November
  20. TruffleHog, Fade In and BSAFE Crypto-C vulnerabilities
  21. Trick, treat, repeat
  22. Dynamic binary instrumentation (DBI) with DynamoRio
  23. Cybersecurity on a budget: Strategies for an economic downturn
  24. Uncovering Qilin attack methods exposed through multiple cases
  25. Think passwordless is too complicated? Let's clear that up
  26. IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
  27. Strings in the maze: Finding hidden strengths and gaps in your team
  28. Reducing abuse of Microsoft 365 Exchange Online’s Direct Send
  29. BeaverTail and OtterCookie evolve with a new Javascript module
  30. Ransomware attacks and how victims respond
  31. Laura Faria: Empathy on the front lines
  32. Open PLC and Planet vulnerabilities
  33. Microsoft Patch Tuesday for October 2025 — Snort rules and prominent vulnerabilities
  34. Velociraptor leveraged in ransomware attacks
  35. Why don’t we sit around this computer console and have a sing-along?
  36. What to do when you click on a suspicious link
  37. Too salty to handle: Exposing cases of CSS abuse for hidden text salting
  38. UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud
  39. Family group chats: Your (very last) line of cyber defense
  40. Nvidia and Adobe vulnerabilities
  41. Great Scott, I’m tired
  42. What happens when you engage Cisco Talos Incident Response?
  43. How RainyDay, Turian and a new PlugX variant abuse DLL search order hijacking
  44. Alex Ryan: From zero chill to quiet confidence
  45. Put together an IR playbook — for your personal mental health and wellbeing
  46. Why a Cisco Talos Incident Response Retainer is a game-changer
  47. Beaches and breaches
  48. Maturing the cyber threat intelligence program
  49. Microsoft Patch Tuesday for September 2025 – Snort rules and prominent vulnerabilities
  50. Stopping ransomware before it starts: Lessons from Cisco Talos Incident Response
  51. From summer camp to grind season
  52. Link up, lift up, level up
  53. Libbiosig, Tenda, SAIL, PDF XChange, Foxit vulnerabilities
  54. Cherry pie, Douglas firs and the last trip of the summer
  55. Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices
  56. JJ Cummings: The art of controlling information
  57. Ransomware incidents in Japan during the first half of 2025
  58. UAT-7237 targets Taiwanese web hosting infrastructure
  59. What happened in Vegas (that you actually want to know about)
  60. Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
  61. Malvertising campaign leads to PS1Bot, a multi-stage malware framework
  62. ReVault! When your SoC turns against you… deep dive edition
  63. AI wrote my code and all I got was this broken prototype
  64. WWBN, MedDream, Eclipse vulnerabilities
  65. August 5, 2025 09:00 Talos reported 5 vulnerabilities to Broadcom and Dell affecting both the ControlVault3 Firmware and its associated Windows APIs that we are calling “ReVault”.
  66. Backdoors & Breaches: How Talos is helping humanitarian aid NGOs prepare for cyber attacks
  67. IR Trends Q2 2025: Phishing attacks persist as actors leverage compromised valid accounts to enhance legitimacy
  68. Using LLMs as a reverse engineering sidekick
  69. The Booker Prize Longlist and Hacker Summer Camp
  70. Cisco Talos at Black Hat 2025: Briefings, booth talks and what to expect
  71. Insights from Talos IR: Navigating NIS2 technical implementation
  72. Unmasking the new Chaos RaaS group attacks
  73. Bloomberg Comdb2 null pointer dereference and denial-of-service vulnerabilities
  74. BRB, pausing for a "Sanctuary Moon" marathon
  75. Meet Hazel Burton
  76. ToolShell: Details of CVEs affecting SharePoint servers
  77. MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities
  78. This is your sign to step away from the keyboard
  79. Talos IR ransomware engagements and the significance of timeliness in incident response
  80. Asus and Adobe vulnerabilities
  81. Patch, track, repeat
  82. Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities
  83. A message from Bruce the mechanical shark
  84. PDFs: Portable documents, or perfect deliveries for phish?
  85. Decrement by one to rule them all: AsIO3.sys driver exploitation
  86. Getting a career in cybersecurity isn’t easy, but this can help
  87. Cybercriminal abuse of large language models
  88. Famous Chollima deploying Python version of GolangGhost RAT
  89. When legitimate tools go rogue
  90. A week with a "smart" car
  91. Know thyself, know thy environment
  92. catdoc zero-day, NVIDIA, High-Logic FontCreator and Parallel vulnerabilities
  93. Microsoft Patch Tuesday for June 2025 — Snort rules and prominent vulnerabilities
  94. Newly identified wiper malware “PathWiper” targets critical infrastructure in Ukraine
  95. Everyone's on the cyber target list
  96. Cybercriminals camouflaging threats as AI tool installers
  97. A new author has appeared
  98. Scarcity signals: Are rare activities red flags?
  99. UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware
  100. Ghosted by a cybercriminal
  101. Duping Cloud Functions: An emerging serverless attack vector
  102. Xoxo to Prague
  103. Redefining IABs: Impacts of compartmentalization on threat tracking and modeling
  104. Defining a new methodology for modeling and tracking compartmentalized threats
  105. Microsoft Patch Tuesday for May 2025 — Snort rules and prominent vulnerabilities
  106. Spam campaign targeting Brazil abuses Remote Monitoring and Management tools
  107. The IT help desk kindly requests you read this newsletter
  108. Proactive threat hunting with Talos IR
  109. State-of-the-art phishing: MFA bypass
  110. Understanding the challenges of securing an NGO
  111. Year in Review: AI based threats
  112. IR Trends Q1 2025: Phishing soars as identity-based attacks persist
  113. Lessons from Ted Lasso for cybersecurity success
  114. Introducing ToyMaker, an initial access broker working in cahoots with double extortion gangs
  115. Year in Review: Attacks on identity and MFA
  116. Unmasking the new XorDDoS controller and infrastructure
  117. Care what you share
  118. Eclipse and STMicroelectronics vulnerabilities
  119. Year in Review: The biggest trends in ransomware
  120. Threat actors thrive in chaos
  121. Unraveling the U.S. toll road smishing scams
  122. Year in Review: Key vulnerabilities, tools, and shifts in attacker email tactics
  123. Microsoft Patch Tuesday for April 2025 — Snort rules and prominent vulnerabilities
  124. One mighty fine-looking report
  125. Available now: 2024 Year in Review
  126. Gamaredon campaign abuses LNK files to distribute Remcos backdoor
  127. Money Laundering 101, and why Joe is worried
  128. UAT-5918 targets critical infrastructure entities in Taiwan
  129. Tomorrow, and tomorrow, and tomorrow: Information security and the Baseball Hall of Fame
  130. Abusing with style: Leveraging cascading style sheets for evasion and tracking
  131. Patch it up: Old vulnerabilities are everyone’s problems
  132. Miniaudio and Adobe Acrobat Reader vulnerabilities
  133. Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities
  134. Unmasking the new persistent attacks on Japan
  135. Who is Responsible and Does it Matter?
  136. Sellers can get scammed too, and Joe goes off on a rant about imposter syndrome
  137. Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools
  138. Your item has sold! Avoiding scams targeting online sellers
  139. Weathering the storm: In the midst of a Typhoon
  140. Efficiency? Security? When the quest for one grants neither.
  141. ClearML and Nvidia vulns
  142. Changing the narrative on pig butchering scams
  143. Microsoft Patch Tuesday for February 2025 — Snort rules and prominent vulnerabilities
  144. Small praise for modern compilers - A case of Ubuntu printing vulnerability that wasn’t
  145. Changing the tide: Reflections on threat data from 2024
  146. Google Cloud Platform Data Destruction via Cloud Build
  147. Talos IR trends Q4 2024: Web shell usage and exploitation of public-facing applications spike
  148. Defeating Future Threats Starts Today
  149. Whatsup Gold, Observium and Offis vulnerabilities
  150. New TorNet backdoor seen in widespread campaign
  151. Seasoning email threats with hidden text salting
  152. Everything is connected to security
  153. Find the helpers
  154. Slew of WavLink vulnerabilities
  155. Microsoft Patch Tuesday for January 2025 — Snort rules and prominent vulnerabilities
  156. Do we still have to keep doing it like this?

2024 161

  1. Exploring vulnerable Windows drivers
  2. Acrobat out-of-bounds and Foxit use-after-free PDF reader vulnerabilities found
  3. Welcome to the party, pal!
  4. The evolution and abuse of proxy networks
  5. Something to Read When You Are On Call and Everyone Else is at the Office Party
  6. Microsoft Patch Tuesday for December 2024 contains four critical vulnerabilities
  7. MC LR Router and GoCast unpatched vulnerabilities
  8. The adventures of an extroverted cyber nerd and the people Talos helps to fight the good fight
  9. Finding vulnerabilities in ClipSp, the driver at the core of Windows’ Client License Platform
  10. Bidirectional communication via polyrhythms and shuffles: Without Jon the beat must go on
  11. Malicious QR Codes: How big of a problem is it, really?
  12. New PXA Stealer targets government and education sectors for sensitive information
  13. November Patch Tuesday release contains three critical remote code execution vulnerabilities
  14. Unwrapping the emerging Interlock ransomware attack
  15. Threat actors use copyright infringement phishing lure to deploy infostealers
  16. NVIDIA shader out-of-bounds and eleven LevelOne router vulnerabilities
  17. Writing a BugSleep C2 server and detecting its traffic with Snort
  18. How LLMs could help defenders write better and faster detection
  19. Talos IR trends Q3 2024: Identity-based operations loom large
  20. Highlighting TA866/Asylum Ambuscade Activity Since 2021
  21. Threat Spotlight: WarmCookie/BadSpace
  22. Threat actor abuses Gophish to deliver new PowerRAT and DCRAT
  23. Akira ransomware continues to evolve
  24. UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants
  25. What I’ve learned in my first 7-ish years in cybersecurity
  26. Protecting major events: An incident response blueprint
  27. Ghidra data type archive for Windows driver functions
  28. What NIST’s latest password standards mean, and why the old ones weren’t working
  29. Vulnerability in popular PDF reader could lead to arbitrary code execution; Multiple issues in GNOME project
  30. Largest Patch Tuesday since July includes two exploited in the wild, three critical vulnerabilities
  31. Threat actor believed to be spreading new MedusaLocker variant since 2022
  32. CISA is warning us (again) about the threat to critical infrastructure networks
  33. Simple Mail Transfer Pirates: How threat actors are abusing third-party infrastructure to send spam
  34. Are hardware supply chain attacks “cyber attacks?”
  35. Talos discovers denial-of-service vulnerability in Microsoft Audio Bus; Potential remote code execution in popular open-source PLC
  36. Talk of election security is good, but we still need more money to solve the problem
  37. We can try to bridge the cybersecurity skills gap, but that doesn’t necessarily mean more jobs for defenders
  38. Vulnerability in Acrobat Reader could lead to remote code execution; Microsoft patches information disclosure issue in Windows API
  39. DragonRank, a Chinese-speaking SEO manipulator service provider
  40. Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score
  41. Vulnerability in Tencent WeChat custom browser could lead to remote code execution
  42. The 2024 Threat Landscape State of Play
  43. The best and worst ways to get users to improve their account security
  44. Watch our new documentary, "The Light We Keep: A Project PowerUp Story"
  45. Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads
  46. What kind of summer has it been?
  47. BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks
  48. Fuzzing µC/OS protocol stacks, Part 3: TCP/IP server fuzzing, implementing a TAP driver
  49. Fuzzing µC/OS protocol stacks, Part 1: HTTP server fuzzing
  50. Fuzzing µCOS protocol stacks, Part 2: Handling multiple requests per test case
  51. The vulnerabilities we uncovered by fuzzing µC/OS protocol stacks
  52. No, not every Social Security number in the U.S. was stolen
  53. MoonPeak malware from North Korean actors unveils new details on attacker infrastructure
  54. How multiple vulnerabilities in Microsoft apps for macOS pave the way to stealing permissions
  55. AI, election security headline discussions at Black Hat and DEF CON
  56. Talos discovers 11 vulnerabilities between Microsoft, Adobe software disclosed on Patch Tuesday
  57. A refresher on Talos’ open-source tools and the importance of the open-source community
  58. Talos discovers Microsoft kernel mode driver vulnerabilities that could lead to SYSTEM privileges; Seven other critical issues disclosed
  59. The top stories coming out of the Black Hat cybersecurity conference
  60. Ryan Pentney reflects on 10 years of Talos and his many roles from the Sourcefire days
  61. There is no real fix to the security issues recently found in GitHub and other similar software
  62. Where to find Talos at BlackHat 2024
  63. Detecting evolving threats: NetSupport RAT campaign
  64. APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike
  65. "There is no business school class that would ever sit down and design Talos"
  66. Out-of-bounds read vulnerability in NVIDIA driver; Open-source flashcard software contains multiple security issues
  67. IR Trends: Ransomware on the rise, while technology becomes most targeted sector
  68. The massive computer outage over the weekend was not a cyber attack, and I’m not sure why we have to keep saying that
  69. A (somewhat) complete timeline of Talos’ history
  70. It's best to just assume you’ve been involved in a data breach somehow
  71. Impact of data breaches is fueling scam campaigns
  72. Checking in on the state of cybersecurity and the Olympics
  73. Inside the ransomware playbook: Analyzing attack chains and mapping common TTPs
  74. Hidden between the tags: Insights into spammers’ evasion techniques in HTML Smuggling
  75. 15 vulnerabilities discovered in software development kit for wireless routers
  76. How do cryptocurrency drainer phishing scams work?
  77. Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities
  78. Snowflake isn’t an outlier, it’s the canary in the coal mine
  79. We’re not talking about cryptocurrency as much as we used to, but there are still plenty of scammers out there
  80. Multiple vulnerabilities in TP-Link Omada system could lead to root access
  81. SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques
  82. Unveiling SpiceRAT: SneakyChef's latest tool targeting EMEA and Asia
  83. Tabletop exercises are headed to the next frontier: Space
  84. How are attackers trying to bypass MFA?
  85. Exploring malicious Windows drivers (Part 2): the I/O system, IRPs, stack locations, IOCTLs and more
  86. Operation Celestial Force employs mobile and desktop malware to target Indian entities
  87. How we can separate botnets from the malware operations that rely on them
  88. Only one critical issue disclosed as part of Microsoft Patch Tuesday
  89. The sliding doors of misinformation that come with AI-generated search results
  90. DarkGate switches up its tactics with new payload, email templates
  91. New banking trojan “CarnavalHeist” targets Brazil with overlay attacks
  92. LilacSquid: The stealthy trilogy of PurpleInk, InkBox and InkLoader
  93. Attackers are impersonating a road toll payment processor across the U.S. in phishing attacks
  94. Out-of-bounds reads in Adobe Acrobat; Foxit PDF Reader contains vulnerability that could lead to SYSTEM-level privileges
  95. New Generative AI category added to Talos reputation services
  96. Apple and Google are taking steps to curb the abuse of location-tracking devices — but what about others?
  97. From trust to trickery: Brand impersonation over the email attack vector
  98. Talos releases new macOS open-source fuzzer
  99. Rounding up some of the major headlines from RSA
  100. Talos joins CISA to counter cyber threats against non-profits, activists and other at-risk communities
  101. Only one critical vulnerability included in May’s Microsoft Patch Tuesday; One other zero-day in DWN Core
  102. A new alert system from CISA seems to be effective — now we just need companies to sign up
  103. Talos discloses multiple zero-day vulnerabilities, two of which could lead to code execution
  104. What can we learn from the passwords used in brute-force attacks?
  105. Vulnerabilities in employee management system could lead to remote code execution, login credential theft
  106. Cisco Talos at RSAC 2024
  107. James Nutland studies what makes threat actors tick, growing our understanding of the current APT landscape
  108. Talos IR trends: BEC attacks surge, while weaknesses in MFA persist
  109. The private sector probably isn’t coming to save the NVD
  110. ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices
  111. Suspected CoralRaider continues to expand victimology using three information stealers
  112. What’s the deal with the massive backlog of vulnerabilities at the NVD?
  113. Could the Brazilian Supreme Court finally hold people accountable for sharing disinformation?
  114. OfflRouter virus causes Ukrainian users to upload confidential documents to VirusTotal
  115. Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials
  116. The internet is already scary enough without April Fool’s jokes
  117. Vulnerability in some TP-Link routers could lead to factory reset
  118. Starry Addax targets human rights defenders in North Africa with new malware
  119. April’s Patch Tuesday includes 150 vulnerabilities, 60 which could lead to remote code execution
  120. CoralRaider targets victims’ data and social media accounts
  121. There are plenty of ways to improve cybersecurity that don’t involve making workers return to a physical office
  122. Adversaries are leveraging remote access tools now more than ever — here’s how to stop them
  123. Enter the substitute teacher
  124. “Pig butchering” is an evolution of a social engineering tactic we’ve seen for years
  125. New details on TinyTurla’s post-compromise activity reveal full kill chain
  126. Dissecting a complex vulnerability and achieving arbitrary code execution in Ichitaro Word
  127. Netgear wireless router open to code execution after buffer overflow vulnerability
  128. The LockBit story: Why the ransomware affiliate model can turn takedowns into disruptions
  129. Not everything has to be a massive, global cyber attack
  130. Threat actors leverage document publishing sites for ongoing credential and session token theft
  131. Another Patch Tuesday with no zero-days, only two critical vulnerabilities disclosed by Microsoft
  132. The 3 most common post-compromise tactics on network infrastructure
  133. You’re going to start seeing more tax-related spam, but remember, that doesn’t actually mean there’s more spam
  134. GhostSec’s joint ransomware operation and evolution of their arsenal
  135. Badgerboard: A PLC backplane network visibility module
  136. Heather Couk is here to keep your spirits up during a cyber emergency, even if it takes the “Rocky” music
  137. Why Apple added protection against quantum computing when quantum computing doesn’t even exist yet
  138. Stop running security in passive mode
  139. Multiple vulnerabilities in Adobe Acrobat Reader could lead to remote code execution
  140. TimbreStealer campaign targets Mexican users with financial lures
  141. TinyTurla-NG in-depth tooling and command and control analysis
  142. TikTok’s latest actions to combat misinformation shows it’s not just a U.S. problem
  143. How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity
  144. Astaroth, Mekotio & Ousaban abusing Google Cloud Run in LATAM-focused malware campaigns
  145. TinyTurla Next Generation - Turla APT spies on Polish NGOs
  146. Why the toothbrush DDoS story fooled us all
  147. How are attackers using QR codes in phishing emails and lure documents?
  148. First Microsoft Patch Tuesday zero-day of 2024 disclosed as part of group of 75 vulnerabilities
  149. New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization
  150. Spyware isn’t going anywhere, and neither are its tactics
  151. How are user credentials stolen and used by threat actors?
  152. The many ways electric cars are vulnerable to hacks, and whether that matters in a real-world
  153. OAS Engine Deep Dive: Abusing low-impact vulnerabilities to escalate privileges
  154. Why is the cost of cyber insurance rising?
  155. IR Q4 2023 trends: Significant increase in ransomware activity found in engagements, while education remains one of the most-targeted sectors
  156. Exploring malicious Windows drivers (Part 1): Introduction to the kernel and drivers
  157. What to do with that fancy new internet-connected device you got as a holiday gift
  158. Critical vulnerability in ManageEngine could lead to file creation, dozens of other vulnerabilities disclosed by Talos to start 2024
  159. New decryptor for Babuk Tortilla ransomware variant released
  160. Microsoft starts off new year with relatively light Patch Tuesday, no zero-days
  161. Video series discussing the major threat actor trends from 2023

2023 62

  1. Intellexa and Cytrox: From fixer-upper to Intel Agency-grade spyware
  2. Year in Malware 2023: Recapping the major cybersecurity stories of the past year
  3. Recommendations that defenders can use from Talos’ Year in Review Report
  4. A personal Year in Review to round out 2023
  5. Microsoft releases lightest Patch Tuesday in three years, no zero-days disclosed
  6. Video: Talos 2023 Year in Review highlights
  7. Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang
  8. Cybersecurity considerations to have when shopping for holiday gifts
  9. Beers with Talos episode 141: The TurkeyLurkey Man wants YOU to read Talos' Year in Review report
  10. Remote code execution vulnerabilities found in Buildroot, Foxit PDF Reader
  11. The malware, attacker trends and more that shaped the threat landscape in 2023
  12. Project PowerUp – Helping to keep the lights on in Ukraine in the face of electronic warfare
  13. New SugarGh0st RAT targets Uzbekistan government and South Korea
  14. $19 Stanely cups, fake Amazon Prime memberships all part of holiday shopping scams circulating
  15. What is threat hunting?
  16. Vulnerabilities in Adobe Acrobat, Microsoft Excel could lead to arbitrary code execution
  17. A deep dive into Phobos ransomware, recently deployed by 8Base group
  18. Understanding the Phobos affiliate structure and activity
  19. 7 common mistakes companies make when creating an incident response plan and how to avoid them
  20. We all just need to agree that ad blockers are good
  21. Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday update, three other zero-days
  22. What is NIS2, and how can you best prepare for the new cybersecurity requirements in the EU?
  23. Spammers abuse Google Forms’ quiz to deliver scams
  24. Threat Roundup for November 3 to November 10
  25. A new video series, Google Forms spam and the various gray areas of cyber attacks
  26. Threat Roundup for October 27 to November 3
  27. Attackers use JavaScript URLs, API forms and more to scam users in popular online game “Roblox”
  28. You’d be surprised to know what devices are still using Windows CE
  29. Arid Viper disguising mobile spyware as updates for non-malicious Android applications
  30. How helpful are estimates about how much cyber attacks cost?
  31. Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan
  32. 9 vulnerabilities found in VPN software, including 1 critical issue that could lead to remote code execution
  33. Attacks on web applications spike in third quarter, new Talos IR data shows
  34. Threat Roundup for October 13 to October 20
  35. More helpful resources for users of all skill levels to help you Take a Security Action
  36. What is Cracktivator software?
  37. Snapshot fuzzing direct composition with WTF
  38. Why logging is one of the most overlooked aspects of incident response, and how Cisco Talos IR can help
  39. Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities
  40. Top resources for Cybersecurity Awareness Month
  41. Microsoft patches 12 critical vulnerabilities, nine of which are in Layer 2 Tunneling Protocol
  42. 10 zero-day vulnerabilities in industrial cell router could lead to code execution, buffer overflows
  43. What to know about the HTTP/2 Rapid Reset DDoS attacks
  44. How looking at decades of spam led Jaeson Schultz from Y2K to the metaverse and cryptocurrency
  45. Qakbot-affiliated actors distribute Ransom Knight malware despite infrastructure takedown
  46. Is it bad to have a major security incident on your résumé? (Seriously I don’t know)
  47. What is the dark web?
  48. Threat Roundup for September 22 to September 29
  49. The security pitfalls of social media sites offering ID-based authentication
  50. 10 new vulnerabilities disclosed by Talos, including use-after-free issue in Google Chrome
  51. ICS protocol coverage using Snort 3 service inspectors
  52. What’s the point of press releases from threat actors?
  53. New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel Implants
  54. How Cisco Talos IR helped a healthcare company quickly resolve a Qakbot attack
  55. Turns out even the NFL is worried about deepfakes
  56. Microsoft Patch Tuesday for September 2023 — Unusually low 5 critical vulnerabilities included in Microsoft Patch Tuesday, along with two zero-days
  57. You can try to hide your firmware from Kelly Patterson, but she’ll find it (and break it)
  58. Cybercriminals target graphic designers with GPU miners
  59. A secondhand account of the worst possible timing for a scammer to strike
  60. Eight vulnerabilities in Open Automation Software Platform could lead to information disclosure, improper authentication
  61. SapphireStealer: Open-source information stealer enables credential and data theft
  62. New open-source infostealer, and reflections on 2023 so far

Undated 6

  1. Intelligence Center
  2. Microsoft Advisories
  3. Incident Response
  4. Open Source Security Tools
  5. Secure Endpoint Naming Reference
  6. Careers