Cisco Talos Blog - TheNote.app

Cisco Talos Blog
Follow

Talos Intelligence is a leading threat intelligence and cybersecurity solutions provider. They partner with top-tier organizations to produce actionable threat intelligence that directly impacts our collective security posture. Their blog offers insights into the latest cybersecurity threats and trends, providing their audience with up-to-date information on malware, vulnerabilities, phishing attacks, and more.

Cisco Talos Blog blog.talosintelligence.com

RSS blog.talosintelligence.com

RSS Hunter • Aug 19, 2024

Thread Of Notes

Don’t swing at everything

Thorsten explores Q2 2026 stats, the artificial buffer zone of 2026, and why smart, prioritized patching is more critical than ever.

https://blog.talosintelligence.com/dont-swing-at-everything/ blog.talosintelligence.com

RSS Hunter • Jul 23

Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN.

https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/ blog.talosintelligence.com

RSS Hunter • Jul 23

Preview: Cisco Talos at Black Hat USA 2026

Here’s some of the ways Talos is showing up at Black Hat, alongside our friends at Cisco and Splunk.

https://blog.talosintelligence.com/preview-cisco-talos-at-black-hat-usa-2026/ blog.talosintelligence.com

RSS Hunter • Jul 23

Begun, the Patch Wars have

Long foretold, the Great Patching has begun and it’s a doozy. Buckle in as Joe takes you through the story.

https://blog.talosintelligence.com/begun-the-patch-wars-have/ blog.talosintelligence.com

RSS Hunter • Jul 16

The Hunter's Paradox: Is it time to embrace automated threat hunting?

Humans can no longer keep up with the volume and velocity of security data on their own, but AI can't be fully trusted. David discusses the merits of both and muses on what the future might look like.

https://blog.talosintelligence.com/the-hunters-paradox-is-it-time-to-embrace-automated-threat-hunting/ blog.talosintelligence.com

RSS Hunter • Jul 16

UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.

https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/ blog.talosintelligence.com

RSS Hunter • Jul 16

Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical". Microsoft notes that two of the vulnerabilities disclosed this month have been exploited in the wild. CVE-2026-56155 is an important-

https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/ blog.talosintelligence.com

RSS Hunter • Jul 14

[Video] Where protection starts: Cisco Talos Intelligence Integrations

Every day, defenders make high-consequence decisions with incomplete information. Learn how Cisco Talos Intelligence Integrations help reduce uncertainty by turning the latest threat intelligence into proactive protections across Cisco technologies.

https://blog.talosintelligence.com/video-where-protection-starts-cisco-talos-intelligence-integrations/ blog.talosintelligence.com

RSS Hunter • Jul 14

The serpent’s tongue: Luring the Python out of its den

This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Python environments.

https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ blog.talosintelligence.com

RSS Hunter • Jul 14

WolfSSL, GeoVision, VTK vulnerabilities

Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in WolfSSF, fourteen in GeoVision, and one vulnerability in VTK-DICOM. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco’s third-party vulnerability disclosure policy. For

https://blog.talosintelligence.com/wolfssl-vulnerabilities/ blog.talosintelligence.com

RSS Hunter • Jul 9

Winning 54% of the time

With Wimbledon's help, Hazel argues against the popular myth that "Attackers only need to be right once, but defenders need to be right 100% of the time."

https://blog.talosintelligence.com/winning-54-of-the-time/ blog.talosintelligence.com

RSS Hunter • Jul 9

UAT-7810 continues building ORB networks using new malware

Talos’ latest findings on UAT-7810 indicate that the threat actor continues to develop their custom-made malware.

https://blog.talosintelligence.com/uat-7810/ blog.talosintelligence.com

RSS Hunter • Jul 7

Catan and Mouse

What do board games and cybersecurity have in common? Pattern recognition. Strategy. Adaptation. In this week’s Threat Source Bill explores why curiosity may be a defender’s most valuable skill.

https://blog.talosintelligence.com/catan-and-mouse/ blog.talosintelligence.com

RSS Hunter • Jul 2

Martin Lee: Running through the Arctic (and the threat landscape)

Ever wonder how someone goes from studying human viruses to leading cybersecurity teams? In this Humans of Talos, we’re joined by Martin Lee, EMEA Lead, to talk about his journey into the industry.

https://blog.talosintelligence.com/martin-lee-running-through-the-arctic-and-the-threat-landscape/ blog.talosintelligence.com

RSS Hunter • Jul 1

ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365

Talos has identified "ARToken," a phishing-as-a-service platform that targets Microsoft 365. The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token persistence, email access, BEC operations, and SharePoint exfiltration.

https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/ blog.talosintelligence.com

RSS Hunter • Jul 1

Beyond IOCs: AI-enabled threat intelligence

In this week’s newsletter, Martin considers how AI will help threat intelligence by creating an easily queryable data source of intelligence reports.

https://blog.talosintelligence.com/beyond-iocs-ai-enabled-threat-intelligence/ blog.talosintelligence.com

RSS Hunter • Jun 25

Introduction to COM usage by Windows threats

Component Object Model (COM) is a fundamental Windows technology used by legitimate applications for object activation, inter-process communication, automation and language-independent component reuse. Those same qualities make it useful to threat actors.

https://blog.talosintelligence.com/introduction-to-com-usage-by-windows-threats/ blog.talosintelligence.com

RSS Hunter • Jun 25

Close Encounters of the Human Kind

In the latest Threat Source, Hazel channels her inner Spielberg to explore why humans are delightfully irrational, reminding us that while security best practices are simple in theory, they’re a lot harder to pull off when you’re busy dealing with real life.

https://blog.talosintelligence.com/close-encounters-of-the-human-kind/ blog.talosintelligence.com

RSS Hunter • Jun 18

Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model

Cisco Talos detailed a new approach to reverse engineering that pairs local AI agents with traditional analysis tools like the VB6 disassembler vbdec. Instead of awkwardly bolting AI onto the software, vbdec exposes its parsed data through a live COM interface.

https://blog.talosintelligence.com/scripting-the-disassembler/ blog.talosintelligence.com

RSS Hunter • Jun 18

A tale of two eras

In this week’s newsletter, Amy reminisces on the tech toys of their childhood, inspired by a hilarious lesson about why your digital privacy shouldn't be left on an open channel.

https://blog.talosintelligence.com/a-tale-of-two-eras/ blog.talosintelligence.com

RSS Hunter • Jun 11

Microsoft Patch Tuesday for June 2026 — Snort rules and prominent vulnerabilities

Microsoft Patch Tuesday details for June 2026.

https://blog.talosintelligence.com/microsoft-patch-tuesday-for-june-2026-snort-rules-and-prominent-vulnerabilities/ blog.talosintelligence.com

RSS Hunter • Jun 9

Reporting from Vegas: Networking, AI, and good boys

Joe’s on-the-ground report from Cisco Live U.S. is here, complete with therapy dog pictures and tips on handling conference overstimulation.

https://blog.talosintelligence.com/reporting-from-vegas-networking-ai-and-good-boys/ blog.talosintelligence.com

RSS Hunter • Jun 4

Winning the cyber marathon with Tony Giandomenico

Tony Giandomenico, Senior Director of Product Management, joins Amy to discuss the Talos Threat Hunting launch what he's excited about for the future of cybersecurity, and, of course, his Ironman triathlons.

https://blog.talosintelligence.com/winning-the-cyber-marathon-with-tony-giandomenico/ blog.talosintelligence.com

RSS Hunter • Jun 4

Hypotheses, telemetry, and human judgment: Inside Cisco Talos Threat Hunting

Learn how Cisco Talos Threat Hunting uses hypothesis-driven methods and multi-domain telemetry correlation to find stealthy threats operating below automated detection thresholds.

https://blog.talosintelligence.com/hypotheses-telemetry-and-human-judgment-inside-cisco-talos-threat-hunting/ blog.talosintelligence.com

RSS Hunter • Jun 4

Less panic patching, more precision

In this newsletter, Thor breaks down why you should stop relying solely on CVSS and start using EPSS and GCVE to focus your patching efforts on the threats that actually matter.

https://blog.talosintelligence.com/less-panic-patching-more-precision/ blog.talosintelligence.com

RSS Hunter • May 28

DICOM, Pydicom, GDCM, and Orthanc: A technical tour of what really happens in the heap

This white paper presents a concrete case study demonstrating the creation of a heap overflow vulnerability through the exploitation of the DICOM file format.

https://blog.talosintelligence.com/dicom-pydicom-gdcm-and-orthanc-a-technical-tour-of-what-really-happens-in-the-heap/ blog.talosintelligence.com

RSS Hunter • May 28

MediaArea heap-based buffer overflow vulnerabilities

Talos researchers find 4 heap-based buffer overflow vulnerabilities in MediaArea's MediaInfoLib.

https://blog.talosintelligence.com/mediaarea-heap-based-buffer-overflow-vulnerabilities/ blog.talosintelligence.com

RSS Hunter • May 27

Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake

EvidenceForge generates high-quality, realistic, and consistent datasets across multiple log formats, enabling teams to effectively train personnel and validate detection models without the need for complex manual simulations.

https://blog.talosintelligence.com/introducing-evidenceforge-synthetic-security-logs-that-dont-look-as-fake/ blog.talosintelligence.com

RSS Hunter • May 27

The art of being ungovernable

In this edition of the Threat Source newsletter, William explores the value of being "ungovernable" in a professional setting, sharing how challenging the status quo and seeking out the smartest people in the room can lead to a more fulfilling and successful career.

https://blog.talosintelligence.com/the-art-of-being-ungovernable/ blog.talosintelligence.com

RSS Hunter • May 21

TP-Link, Photoshop, OpenVPN, Norton VPN vulnerabilities

Cisco Talos’ Vulnerability Discovery & Research team recently disclosed eight vulnerabilities in TP-Link, and one each in Adobe Photoshop, OpenVPN, and Gen Digital's Norton VPN. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco’s third-party vulnerability

https://blog.talosintelligence.com/tp-link-photoshop-openvpn-norton-vpn-vulnerabilities/ blog.talosintelligence.com

RSS Hunter • May 19

From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat

Cisco Talos has uncovered a BadIIS variant — identifiable by its embedded "demo.pdb" strings — that functions as commodity malware, likely sold or shared among multiple Chinese-speaking cyber crime groups operating under a malware-as-a-service (MaaS) model for continuous monetization.

https://blog.talosintelligence.com/from-pdb-strings-to-maas-tracking-a-commodity-badiis-ecosystem/ blog.talosintelligence.com

RSS Hunter • May 19

The time of much patching is coming

In this week’s newsletter, Martin reflects on what the next iteration of AI tools means for vulnerability discovery and our ability to manage large-scale patch releases.

https://blog.talosintelligence.com/the-time-of-much-patching-is-coming/ blog.talosintelligence.com

RSS Hunter • May 14

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage.

https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/ blog.talosintelligence.com

RSS Hunter • May 14

Breaking things to keep them safe with Philippe Laulheret

Philippe shares his unique journey from French engineering school to the front lines of cybersecurity, explaining how his lifelong love for solving puzzles helps him uncover critical security flaws before they can be exploited.

https://blog.talosintelligence.com/breaking-things-to-keep-them-safe-with-philippe-laulheret/ blog.talosintelligence.com

RSS Hunter • May 13

Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for May 2026, which includes 112 vulnerabilities affecting a range of products, including 16 that Microsoft marked as “critical”.

https://blog.talosintelligence.com/microsoft-patch-tuesday-may-2026/ blog.talosintelligence.com

RSS Hunter • May 12

State-sponsored actors, better known as the friends you don’t want

Responding to a state-sponsored threat is nothing like responding to ransomware, and the differences can make or break the outcome. Learn why your IR plan might need revisiting, and the factors you should consider.

https://blog.talosintelligence.com/state-sponsored-actors-better-known-as-the-friends-you-dont-want/ blog.talosintelligence.com

RSS Hunter • May 12

Unplug your way to better code

Cybersecurity concepts — logs, packets, DNS exfiltration, and more — are usually intangible, and its practitioners are prone to mental fatigue, Amy takes a second to yell at you to go touch grass.

https://blog.talosintelligence.com/unplug-your-way-to-better-code/ blog.talosintelligence.com

RSS Hunter • May 7

Insights into the clustering and reuse of phone numbers in scam emails

Talos has recently started to collect and gather intelligence around phone numbers within emails as an additional indicator of compromise (IOC). In this blog, we discuss new insights into in-the-wild phone number reuse in scam emails.

https://blog.talosintelligence.com/insights-into-the-clustering-and-reuse-of-phone-numbers-in-scam-emails/ blog.talosintelligence.com

RSS Hunter • May 6

UAT-8302 and its box full of malware

Cisco Talos is disclosing UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025.

https://blog.talosintelligence.com/uat-8302/ blog.talosintelligence.com

RSS Hunter • May 5

CloudZ RAT potentially steals OTP messages using Pheno plugin

Cisco Talos discovered an intrusion, active since at least January 2026, where an unknown attacker implanted a CloudZ remote access tool (RAT) and a previously undocumented plugin called “Pheno.”

https://blog.talosintelligence.com/cloudz-pheno-infostealer/ blog.talosintelligence.com

RSS Hunter • May 5

Great responsibility, without great power

In this week’s newsletter, Hazel uses International Superhero Day as a springboard to explore why empathy — rather than just technical prowess — is the most essential, underrated superpower for navigating the human side of cybersecurity.

https://blog.talosintelligence.com/great-responsibility-without-great-power/ blog.talosintelligence.com

RSS Hunter • Apr 30

AI-powered honeypots: Turning the tables on malicious AI agents

Just as AI brings time-saving advantages to our lives, it brings similar advantages to threat actors. We can take the advantage back. This blog shows how generative AI can be used to rapidly deploy adaptive honeypot systems.

https://blog.talosintelligence.com/ai-powered-honeypots-turning-the-tables-on-malicious-ai-agents/ blog.talosintelligence.com

RSS Hunter • Apr 29

Five defender priorities from the Talos Year in Review

With attackers moving faster than ever, it’s easy to feel overwhelmed. This blog breaks down five practical priorities from the Cisco Talos 2025 Year in Review to help defenders focus and prioritize, amidst all the noise.

https://blog.talosintelligence.com/five-defender-priorities-from-the-talos-year-in-review/ blog.talosintelligence.com

RSS Hunter • Apr 28

It pays to be a forever student

In this newsletter, Joe discusses why understanding other disciplines can often flow back into the macro and micro of cybersecurity, especially in a world of AI.

https://blog.talosintelligence.com/it-pays-to-be-a-forever-student/ blog.talosintelligence.com

RSS Hunter • Apr 23

UAT-4356's Targeting of Cisco Firepower Devices

Cisco Talos is aware of UAT-4356's continued active targeting of Cisco Firepower devices’ Firepower eXtensible Operating System (FXOS). UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.

https://blog.talosintelligence.com/uat-4356-firestarter/ blog.talosintelligence.com

RSS Hunter • Apr 23

IR Trends Q1 2026: Phishing reemerges as top initial access vector, as attacks targeting public administration persist

Phishing reemerged as the most observed means of gaining initial access, accounting for over a third of the engagements where initial access could be determined. Phishing has not been the top vertical for initial access since Q2 2025.

https://blog.talosintelligence.com/ir-trends-q1-2026/ blog.talosintelligence.com

RSS Hunter • Apr 22

[Podcast] It's not you, it's your printer: State-sponsored and phishing threats in 2025

In this episode of Talos Takes, Amy and Martin Lee unpack state-sponsored and phishing trends from the 2025 Talos Year in Review.

https://blog.talosintelligence.com/podcast-its-not-you-its-your-printer-state-sponsored-and-phishing-threats-in-2025/ blog.talosintelligence.com

RSS Hunter • Apr 21

Phishing and MFA exploitation: Targeting the keys to the kingdom

In 2025, attackers increasingly targeted weaknesses in multi-factor authentication (MFA) workflows, and phishing attacks leveraged valid, compromised credentials to launch lures from trusted accounts. The trends focused entirely on trust, or the lack thereof, in everyday business operations.

https://blog.talosintelligence.com/phishing-and-mfa-exploitation-targeting-the-keys-to-the-kingdom/ blog.talosintelligence.com

RSS Hunter • Apr 21

Bad Apples: Weaponizing native macOS primitives for movement and execution

Cisco Talos documents several macOS living-off-the-land (LOTL) techniques, demonstrating that native pathways for movement and execution remain accessible to those who understand the underlying architecture.

https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ blog.talosintelligence.com

RSS Hunter • Apr 21

Foxit, LibRaw vulnerabilities

Cisco Talos’ Vulnerability Discovery & Research team recently disclosed one Foxit Reader vulnerability, and six LibRaw file reader vulnerabilities. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-party vulnerability disclosure policy. For

https://blog.talosintelligence.com/foxit-libraw-vulnerabilities/ blog.talosintelligence.com

RSS Hunter • Apr 16