Intelligence Feed

3d ago · talos

Cisco Talos identified UAT-11473, a sophisticated APT group, exploiting CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller, to gain unauthorized access. The actor deployed a custom malware framework named 'KeyDrift', which includes components like PolyFlame and LittleFilch, designed to intercept decrypted control traffic, extract data-plane keying material, and establish backdoors. Targeted sectors include space and satellite services, defense, aerospace, and policy research. Talos assesses with high confidence that UAT-11473's infrastructure overlaps with Volt Typhoon’s 'Silent Train' network.

3d ago · talos

Cisco Talos identified a new AI-integrated command-and-control (C2) framework named NIK C2, which enables threat actors to conduct credential theft, keystroke logging, ransomware deployment, and AI-driven data analysis directly from compromised hosts. The malware, written in Go, uses a dual-channel C2 architecture over TLS-secured WebSockets and HTTP polling, with traffic encrypted via AES-256-GCM. A key feature is its integration with OpenAI's API, allowing attackers to route prompts through victim machines using either their own or the victim's API key, thereby obscuring attribution and shifting costs to the victim. The framework supports over 52 commands, including screen-locking ransomware, lateral movement, and bootkit preparation, and has been observed in active infrastructure, confirming it as a functional threat.

2d ago · talos

Cisco Talos discovered a new Go-based Windows implant called NIK C2, which functions as a command-and-control framework integrating AI directly into the attack chain. This malware enables adversaries to dump credentials, stream keystrokes, and deploy screen-locking ransomware, while using a victim's own OpenAI API keys to fund and conceal malicious activity. The integration of AI allows real-time, context-aware payload generation on the compromised host, eliminating traditional detection windows and obscuring attacker infrastructure by leveraging legitimate API usage.

22h ago · talos

VOLTA-AUTODOXER is a sophisticated Windows infostealer that steals credentials, session tokens, cryptocurrency wallets, and other sensitive data, then enriches the stolen data using live API calls to services like Gmail, Discord, and Roblox. It uniquely sends a structured evidence bundle to third-party LLMs via OpenRouter to generate a prioritized, AI-analyzed dossier of the victim's monetizable assets and security posture. The malware uses a fallback chain of LLMs (Claude, Kimi, Gemini) to bypass model refusals and operates without attacker-owned infrastructure, exfiltrating data in encrypted ZIP files to Telegram. It is distributed via a builder model, indicating commoditization and broad accessibility to cybercriminals.

1w ago · talos

Cisco Talos identified a growing trend where attackers abuse legitimate infrastructure, such as order notification systems from Staples and Dell, to deliver malicious content by injecting attacker-controlled phone numbers into transactional email fields. These messages leverage trusted domains and pass standard email authentication (DKIM, DMARC), making them appear legitimate while creating urgency around fake high-value purchases to prompt victims to call malicious helplines. The same abuse pattern extends to list bombing and bounce abuse, where malicious content is reflected through trusted platforms or embedded in delivery status notifications, bypassing traditional security controls by exploiting trust in legitimate services.

1w ago · talos

Two unauthenticated remote code execution (RCE) vulnerabilities in PHP, dubbed 'php2shell', have been identified and are actively exploited. The flaws affect all PHP versions since 5.4, with no patches available for versions 8.1 and older, which are end-of-life. Given PHP's widespread use in platforms like WordPress, Drupal, and WooCommerce, the potential impact is significant across industries. Cisco Talos has released Snort signatures 67359 and 67360 for detection and urges immediate upgrade to PHP 8.2 or later to mitigate risk.

1w ago · talos

Cisco Talos has identified two critical unauthenticated remote code execution (RCE) vulnerabilities in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619, collectively dubbed 'php2shell'. These flaws affect all PHP versions since 5.4 and can be exploited via a plain HTTP request before any application code runs, making them highly dangerous. The vulnerabilities stem from improper handling of out-of-memory conditions and reuse of stale internal state after memory deallocation. While initial exploitation has been limited to scanning and basic payloads, Talos expects more sophisticated campaigns to emerge as threat actors integrate the vulnerabilities into their tooling.

1w ago · talos

Cisco Talos disclosed the compromise of eight intermediate certificates issued by eMudhra due to a flaw in their key generation process, which resulted in weak private keys with only 3–8 bits of entropy instead of the required 384 bits. This vulnerability allows attackers to recover private keys and impersonate legitimate websites or code-signing services. The affected certificates were used for TLS and code signing, with six TLS certificates already blocked by major browsers and two code-signing certificates blocked by Microsoft. The issue has been designated as CVE-2026-111943, and patches have been released in Go versions 1.27.3 and 1.26.10 to filter out certificate chains containing the compromised keys.

2w ago · talos

Cisco Talos and Recorded Future’s Insikt Group identified espionage activity conducted by threat actor UAT-6275 targeting government and critical infrastructure entities in the Commonwealth of Independent States (CIS). The group uses multiple infection chains, including macro-enabled documents, GitHub-hosted scripts, and exploitation of a WinRAR vulnerability, to deploy custom reverse shells. Operational security lapses by the actor allowed researchers to observe their infrastructure and malware development. The group is evolving its tradecraft, leveraging legitimate platforms like GitHub for payload hosting and showing signs of expanding to Linux and internet-facing appliances.

2w ago · talos

UAT-6275, a threat actor with a likely Kazakhstan nexus, has been targeting government organizations across the Commonwealth of Independent States (CIS) since June 2025. The group uses multiple infection chains involving macro-enabled documents, PS2EXE-packaged downloaders, GitHub-hosted PowerShell scripts, and a WinRAR exploit (CVE-2025-8088) to deploy custom reverse shells such as PickleShell, Chvost, and Laplas. Exposure of staging directories and GitHub repositories revealed infrastructure changes, tooling, and preparations for post-compromise operations, including potential targeting of Linux systems. The actor shows interest in diplomatic, energy, and water resource sectors, with activity aligned to regional geopolitical developments.

3w ago · talos

Cisco Talos identifies a new malware archetype, 'A3: AI-Analysis Evasion,' where malware embeds natural-language instructions to manipulate AI-based analysis systems. This technique exploits ambiguity in AI pipelines by injecting prompts that attempt to mislead models into classifying malicious files as benign or refusing analysis. Four malware families—FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE—demonstrate evolving tactics including template spraying across multiple LLM formats, intimidation messages, and false claims of intellectual property or government affiliation. These evasion methods are detectable due to their plaintext nature, and while simple instructions can influence AI verdicts, more complex attempts often backfire or have limited impact.

3w ago · talos

Cisco Talos has identified a growing trend called 'A3: AI-Analysis Evasion', where malware authors embed natural-language instructions in code to manipulate AI-based analysis systems. These techniques range from simple comments to advanced template spraying designed to deceive large language models (LLMs), with a success rate of approximately 35% in skewing AI verdicts. The evasion methods are used in conjunction with serious threats, such as MANTLEMAZE malware, which abuses vulnerable drivers to disable EDR from kernel space. Since the instructions must be in plaintext, defenders can detect them by monitoring for imperative language in binaries, treating such text as evidence rather than system directives.

3w ago · talos

Cisco Talos identified an APT spear-phishing campaign, tracked as UAT-11985, targeting Taiwan-based research organizations using AI-assisted content generation to create highly personalized and credible phishing emails. The campaign leveraged legitimate event themes and impersonated reputable academic institutions, embedding malicious QR codes in posters (quishing) and using deceptive hyperlinks that mimic legitimate Google Forms URLs to redirect victims to phishing pages. The phishing infrastructure employs a real-time adversary-in-the-middle (AitM) framework with a hybrid HTTP and WebSocket architecture to intercept Google credentials and bypass MFA by dynamically mirroring authentication flows. Technical analysis suggests the phishing kit was developed primarily in Simplified Chinese, indicating a developer with mainland Chinese linguistic patterns.

4w ago · talos

Cisco Talos identified a threat actor group, UAT-11587, linked to China, targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia. The campaign delivers a previously undocumented backdoor named 'Antino', identified from developer artifacts. The actors are using targeted malware deployments, with specific malicious files observed in telemetry. This activity represents a focused espionage effort against high-value geopolitical targets.

1mo ago · talos

The article is a commentary on social engineering tactics targeting cybersecurity professionals through fake consultancy offers and job scams, emphasizing the importance of trust in the industry. It does not describe a specific malware, vulnerability, or attack campaign with technical indicators. The piece also promotes a new open-source toolkit, CAIRN, and includes general security news summaries without detailed technical analysis or IoCs tied to a single threat event.

1mo ago · talos

CLOSEDQUORUM is a Windows-based malware implant that uses commercial large language models (LLMs) from DeepSeek, Qwen, Mistral, and Google Gemini as an autonomous command and control (C2) infrastructure. It delegates tactical decisions such as credential theft, process injection, and persistence to a panel of LLMs, which vote on the next action via a structured JSON schema. The malware targets user credentials and cryptocurrency wallets, exfiltrating stolen data via an operator-controlled Discord webhook using AES-256-GCM encryption and Base64 encoding. While the distributed version contains placeholder keys and is non-functional, development builds suggest a 'credentials-as-a-service' model where customized binaries are provided to operators.

1mo ago · talos

Cisco Talos reports on a rising ransomware threat landscape in Japan, with a nearly 5% increase in incidents in the first half of 2026. Two prominent ransomware actors, 'The Gentlemen' and 'Qilin', are driving this surge. Qilin leverages generative AI to accelerate attacks by creating destructive scripts, while The Gentlemen uses legitimate red-teaming tools like AdaptixC2 to blend in and evade detection. Both groups target small- and medium-sized enterprises using double-extortion tactics, emphasizing the need for improved credential management, MFA enforcement, and updated defenses using available Snort rules.

1mo ago · talos

In the first half of 2026, ransomware incidents in Japan increased slightly by 4.7%, with The Gentlemen emerging as the most active group, responsible for 14 incidents. The group operates via a Ransomware-as-a-Service (RaaS) model and uses a double-extortion tactic, leveraging infrastructure including AdaptixC2 for command-and-control. Evidence from Russian-language artifacts in scripts and bash history suggests Russian-speaking actors are involved. Qilin, the second most active group, showed signs of using generative AI in developing attack scripts, with code exhibiting structured, LLM-like patterns in tools for deploying ransomware and wiping backups.

1mo ago · talos

Cisco Talos identified a complex WebDAV-based infection chain used in an attack against a Ukrainian government organization. The campaign is attributed to the Russian threat actor UAT-10820 and delivers multiple payloads, including the Amatera stealer, ZigCryptoStealer, and NetSupport Manager. The attackers abuse legitimate infrastructure such as the BNB Smart Chain for hosting and use fake CAPTCHA prompts to evade detection. The operation is assessed as opportunistic, focused on stealing cryptocurrency and credentials, with techniques including memory-resident malware, DLL sideloading via 'rundll32.exe', and use of vulnerable drivers to disable EDR solutions.

1mo ago · talos

Cisco Talos is tracking active exploitation of two vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software: CVE-2026-20079, a critical authentication bypass flaw, and CVE-2026-20316, which allows login via a low-privileged account. Three distinct threat clusters have been identified: UAT-12197 deployed a JSP web shell and a JAR-based command executor; UAT-11823, linked to Sandworm, used CVE-2026-20079 and CVE-2026-20316 to deploy Cyclops Blink malware via a Netcat reverse shell; and UAT-11988, a Qilin ransomware operator, leveraged static credentials to conduct reconnaissance, deploy tunneling tools, and execute ransomware. Customers are urged to apply available patches immediately.

1mo ago · talos

Cisco Talos identified a cryptocurrency theft campaign dubbed ClickFix that abuses legitimate services, particularly the Google Visualization API, for command and control (C2). The attackers use social engineering to trick victims into pasting malicious JavaScript into their browser or installing it via the Tampermonkey browser extension, enabling persistent access. The malicious script acts as a web skimmer, intercepting and altering cryptocurrency deposit addresses in real time, hijacking clipboard content, and injecting fake UI elements to deceive users into believing they are receiving transaction bonuses. The campaign primarily targets cryptocurrency traders through lures distributed on Telegram, DarkForums, and paste sites, using Google Sheets to host obfuscated payloads and evade detection.

1mo ago · talos

Cisco Talos identified a multi-stage WebDAV-based infection chain dubbed ClearFake, delivering the Amatera stealer and secondary payloads including ZigCryptoStealer and NetSupport Manager. The attack begins with malicious JavaScript injected via a compromised site and Cloudflare Worker, retrieving code from BNB Smart Chain contracts, leading to a fake CAPTCHA prompt that tricks users into executing a malicious command. This command retrieves a disguised DLL over WebDAV and executes it via rundll32.exe. Two distinct loader variants—'pf.ch' and 'verification.google'—were observed, both delivering Amatera stealer with different secondary payloads based on C2 instructions. The 'pf.ch' chain delivers ZigCryptoStealer and a Go reverse proxy, while the 'verification.google' chain installs an unauthorized NetSupport Manager instance, indicating a Russian threat actor.

2mo ago · talos

Cisco Talos identified a Chinese-speaking threat actor, UAT-10147, conducting a global campaign targeting Windows and Linux web servers in government, education, media, technology, and gaming sectors. The actor leverages publicly disclosed vulnerabilities for initial access, including CVE-2022-27925, CVE-2021-23758, and CVE-2019-18935, and uses AI-driven tooling to automate exploitation, reconnaissance, payload generation, and validation. Post-compromise, the actor deploys malware such as QuasarRAT, Gh0stCringe, and SPECTRE, establishes persistence via scheduled tasks and rogue user accounts, and uses AI-generated scripts to refine attacks and bypass defenses. A misconfigured command-and-control server at 139.180.197[.]150 exposed operational details, including a target list of 170,000 URLs and AI-assisted attack workflows.

2mo ago · talos

UAT-10147, a Chinese-speaking threat actor, is deploying a new cross-platform backdoor named SPECTRE that targets both Windows and Linux systems. The implant includes advanced capabilities such as process injection, credential theft, anti-analysis routines, and EDR evasion via Bring Your Own Vulnerable Driver (BYOVD) techniques. On Linux, SPECTRE deploys a kernel rootkit called Specter, disguised as 'acpi_pad.ko', which uses ftrace-based hooking to hide processes, modules, and enable UID 0 escalation. The actor also leverages SEO fraud tools like BadIIS and a custom ASHX web handler targeting Vietnamese users, along with multiple backdoors including Meterpreter, Noodle RAT, QuasarRAT, and Gh0stCringe for persistence.

2mo ago · talos

UAT-10147, a Chinese-speaking cybercrime group, is leveraging agentic AI to automate and scale sophisticated post-compromise operations across global web servers. The group uses AI to generate operational playbooks, customize malware, and dynamically validate exploit paths, including through stolen ASP.NET MachineKeys for ViewState deserialization attacks. A newly identified backdoor called SPECTRE features a cross-platform capability with a custom Linux kernel rootkit and Bring Your Own Vulnerable Driver (BYOVD) techniques designed to evade endpoint detection and response (EDR) solutions. Defenders are advised to patch internet-facing applications, secure MachineKeys, block vulnerable drivers, and monitor for anomalous HTTP 500 errors used during exploitation.

2mo ago · talos

Microsoft's August 2026 Patch Tuesday addresses 421 vulnerabilities across various products, including 62 labeled as 'critical'. One actively exploited vulnerability, CVE-2026-68820, is an elevation of privilege issue in the Windows Ancillary Function Driver for WinSock. Multiple remote code execution vulnerabilities are present in Windows, SharePoint, Office, Azure, and other Microsoft services, with several rated high or critical severity. Cisco Talos has released Snort rules to detect exploitation attempts against some of these vulnerabilities, emphasizing those deemed more likely to be exploited, such as CVE-2026-62893 in Windows Deployment Services and CVE-2026-65665 in SharePoint Server.

2mo ago · talos

Cisco Talos discovered 'JWR', a previously undocumented real-time phishing framework and likely variant of the 'The Outsider' phishing-as-a-service platform. JWR uses open WebSocket connections to enable attackers to monitor victim keystrokes in real time and dynamically guide them through fake login and checkout flows. The campaign is currently distributed via SMS lures impersonating regional toll and postal authorities, allowing threat actors to steal payment data, two-factor authentication (2FA) codes, identity documents, and device fingerprints.

2mo ago · talos

Cisco Talos identified a new phishing framework named JWR, likely a variant of the 'Outsider' PhaaS platform, used in active smishing campaigns targeting users in Southeast Asia and the Middle East. The framework enables real-time, operator-driven session manipulation via AES-CTR encrypted WebSocket connections, allowing threat actors to harvest payment data, login credentials, 2FA codes, identity documents, and full device fingerprints. The client engine uses Vue.js to render 44 phishing pages and supports live keystroke streaming, enabling actors to monitor victim input as it is typed. The campaign delivers the phishing kit via SMS lures impersonating toll, postal, and courier services, with operator interfaces in Simplified Chinese, indicating a Chinese-speaking actor.

2mo ago · talos

Cisco Talos researchers analyzed how adversaries are weaponizing AI across multiple attack vectors, including malicious software development, criminal force multiplication, and vulnerability research. Threat actors with varying skill levels are using AI to create DDoS tools, bulk-email validation platforms, credential harvesters, and cryptojacking fleets, often bypassing model guardrails through simple evasion techniques like ownership claims or CTF labeling. A francophone actor developed an automated 'Token Pipeline' to exploit React2Shell vulnerabilities and harvest credentials from exposed Git configurations, while a Turkish-speaking actor leveraged AI to manage a Monero-mining operation via compromised torrent clients. Spanish and Russian-speaking actors used AI to conduct autonomous pentesting, build scam chatbots, and target Telegram Mini Apps for cryptocurrency theft.

3mo ago · talos

In Q2 2026, Talos observed a significant increase in phishing attacks and authentication abuse, with over half of incident responses linked to phishing campaigns leveraging QR codes and platforms like ARToken to bypass multi-factor authentication (MFA). Ransomware actors are increasingly abusing legitimate remote management tools such as MeshAgent and Zoho Assist to establish stealthy, persistent access within networks. A new malware named msaRAT, used by the Chaos ransomware group, hijacks browsers to create covert command-and-control (C2) channels via WebRTC over TURN, enabling remote command execution while concealing attacker infrastructure.