Intelligence Feed

3mo ago · talos

In Q2 2026, phishing remained the dominant initial access vector, accounting for over half of incident response engagements, with attackers increasingly leveraging QR code-embedded PDFs and trusted cloud platforms to bypass defenses. Threat actors, including the newly observed Sinobi ransomware group and Warlock (Storm-2603), weaponized legitimate remote management tools such as trojanized MeshAgent and Zoho Assist for stealthy persistence and lateral movement. Authentication abuse surged, with adversaries bypassing MFA using adversary-in-the-middle proxies, session token theft, and MFA fatigue attacks. The PhaaS platform ARToken was identified, offering a comprehensive toolkit for Microsoft 365 compromise via OAuth-based phishing, highlighting a growing trend in commoditized, sophisticated access-as-a-service operations.

3mo ago · talos

Cisco Talos identified a new attack campaign linked to the DPRK-aligned threat group Famous Chollima, which uses social engineering through fake job offers to distribute trojanized Node.js applications. The campaign leverages malicious npm packages like 'node-nvm-ssh' and combines the BeaverTail and OtterCookie malware tools to steal credentials, cryptocurrency wallets, and system information. Recent evolution includes merged functionality between BeaverTail and OtterCookie, with new capabilities such as keylogging, screenshot capture, and clipboard monitoring delivered via a modular JavaScript-based framework.

3mo ago · talos

The Qilin ransomware group, active since 2022 and operating as a Ransomware-as-a-Service (RaaS), has intensified its global operations in 2025, targeting primarily the manufacturing, professional services, and wholesale trade sectors. The group employs a double-extortion strategy, combining file encryption with data exfiltration, leveraging tools such as Mimikatz, Cyberduck, and Cobalt Strike. Initial access is suspected via compromised credentials on exposed VPNs without MFA, followed by extensive reconnaissance, credential dumping, lateral movement, and deployment of dual encryptors to maximize impact.

3mo ago · talos

Cisco Talos has identified a new Rust-based remote access trojan (RAT) named msaRAT, deployed by the Chaos ransomware group. The malware leverages the Tokio asynchronous runtime and hijacks Chrome or Edge browsers via the Chrome DevTools Protocol (CDP) to establish a covert command-and-control (C2) channel. It is distributed through a deceptive MSI file impersonating a Windows update, enabling in-memory execution and evasion of traditional network detection. The RAT facilitates double-extortion ransomware attacks by enabling persistence and lateral movement.

3mo ago · talos

Cisco Talos is presenting at Black Hat USA 2026, showcasing research on emerging threats involving AI agents, Warlock ransomware, and vulnerability discovery trends. The discussions emphasize the evolving tactics of adversaries using AI-driven tools and prompts to enhance attack efficiency. A main focus is on securing enterprise environments against autonomous systems acting as insider threats and improving defensive strategies using AI in security operations.

3mo ago · talos

Cisco Talos has identified a new Rust-based remote access trojan (RAT) named msaRAT, attributed to the Chaos ransomware group. The malware leverages Chrome DevTools Protocol (CDP) to hijack a browser and establish a covert command-and-control (C2) channel via WebRTC, using Cloudflare Workers and Twilio TURN for signaling and relay. This technique allows the RAT to avoid direct network communication, instead routing traffic through legitimate browser processes to evade detection and firewall rules.

3mo ago · talos

Cisco Talos has identified a new campaign by UAT-11795, a financially motivated Russian-speaking threat actor, targeting users in the U.S. and Europe since at least June 2025. The group uses trojanized installers of legitimate software such as Webex, Zoom, and MobaXterm to deliver a custom Python-based remote access tool called 'Starland RAT'. This tool enables deployment of additional payloads, including the in-memory PowerShell-based 'WLDR agent', CastleStealer, and Remcos RAT, to steal credentials and cryptocurrency.

3mo ago · talos

UAT-11795 is a financially motivated, Russian-speaking threat actor active since June 2025, targeting users in the U.S. and Europe. The group deploys a novel Python-based remote access tool (RAT) named Starland RAT and a bespoke PowerShell-based C2 implant, WLDR, using trojanized installers of legitimate software. The campaign focuses on stealing credentials and cryptocurrency wallets, utilizing a multi-stage infection chain involving HTA downloaders, Telegram beacons, and resilient C2 infrastructure, including a fallback mechanism via a Polygon smart contract.

3mo ago · talos

The article discusses the 'Hunter's Paradox' in cybersecurity, where human analysts can no longer keep up with the volume, velocity, and complexity of modern threats, necessitating the use of AI-driven threat hunting. However, AI systems are vulnerable to deception by attackers who operate through lies and obfuscation, making full trust in AI problematic. The author argues for redefining threat hunting as a reasoning-driven process rather than a human-only activity, advocating for a balanced approach where AI executes hunts under human-defined strategies and constraints. The path forward involves careful implementation of AI with guardrails, graduated autonomy, and continued human oversight in creative and strategic aspects.

3mo ago · talos

Microsoft's July 2026 Patch Tuesday addresses 622 vulnerabilities, including 57 rated critical, with two already exploited in the wild. Critical vulnerabilities include remote code execution (RCE), elevation of privilege, spoofing, and security feature bypass flaws across Windows, Office, SharePoint, and cloud services. Cisco Talos has released Snort rules to detect exploitation attempts for several of these vulnerabilities, particularly focusing on RCE and privilege escalation issues.

3mo ago · talos

The article discusses the evolving challenges in cybersecurity, where attackers are increasingly leveraging AI to dynamically alter malicious commands and adapt malware behavior. Cisco Talos Intelligence Integrations aims to help defenders by applying real-time threat intelligence across Cisco’s security technologies to identify and block malicious activity. The integrations assist in answering critical security questions, such as identifying malicious domains or unusual user behavior, by leveraging up-to-date threat intelligence. The article highlights the importance of visibility and context in defending against modern threats.

3mo ago · talos

Threat actors are increasingly targeting Python developers through malicious packages and supply chain attacks, leveraging trusted ecosystems like PyPI to distribute payloads. These attacks exploit native Python features such as setup.py, .pth files, and site hooks to execute arbitrary code during installation or runtime, achieving persistence or conditional execution. Techniques include build hook abuses and package content manipulation, enabling adversaries to hijack legitimate binaries, override functions, or exfiltrate data. The blog highlights defensive strategies including dependency auditing, version pinning, and isolated build environments to mitigate these risks.

3mo ago · talos

Cisco Talos identified multiple vulnerabilities in WolfSSL, GeoVision, and VTK-DICOM software. The vulnerabilities include improper input validation, integer underflow, memory corruption, OS command injection, buffer overflows, privilege escalation, XSS, and encryption weaknesses. These issues have been patched by the vendors, and Snort rules are available to detect potential exploitation attempts.

3mo ago · talos

Cisco Talos has identified activity from the China-nexus threat actor UAT-7810, which is expanding its Operational Relay Box (ORB) networks using custom malware to exploit vulnerabilities in unpatched Ruckus and ASUS routers. The group has deployed updated backdoors, including LONGLEASH and DOGLEASH, to create covert proxy infrastructure used by other APT groups. This infrastructure enables threat actors to mask their origins and bypass traditional defenses by routing traffic through compromised edge devices.

3mo ago · talos

UAT-7810, a China-nexus advanced persistent threat (APT) actor, continues to expand its Operational Relay Box (ORB) networks by deploying new malware variants including LONGLEASH, DOGLEASH, and JARLEASH. The group exploits known vulnerabilities in Ruckus and ASUS routers to compromise devices and establish backdoors. These backdoors enable remote command execution, file management, and network tunneling, supporting further exploitation by secondary threat actors. Cisco Talos has identified new infrastructure and malware samples associated with ongoing campaigns.

4mo ago · talos

Cisco Talos has expanded its Threat Hunting program to proactively identify advanced adversaries leveraging AI to evade traditional detection. The initiative recently uncovered a KongTuke command-and-control (C2) infrastructure, highlighting the need for hypothesis-driven threat hunting. As attackers increasingly use AI and legitimate tools to stay under the radar, Talos emphasizes continuous monitoring across endpoint, network, and identity data to detect sophisticated intrusions before signatures are available.

4mo ago · talos

Microsoft's June 2026 Patch Tuesday addresses 206 vulnerabilities, including 32 critical, with a focus on remote code execution (RCE) flaws in Windows services, Microsoft Office, and Azure components. Several vulnerabilities are deemed more likely to be exploited, including CVE-2026-42985 in Remote Desktop Client and CVE-2026-47291 in the HTTP Protocol Stack. Talos has released Snort rules to detect exploitation attempts, emphasizing proactive defense against potential attacks targeting these critical flaws.

4mo ago · talos

Cisco Talos intelligence highlights the growing threat of AI-driven vulnerability discovery, which is outpacing human patching capabilities and enabling rapid exploitation of zero-day vulnerabilities. Organizations are urged to move beyond patch-reliant strategies and adopt a resilient security posture centered on foundational controls, behavioral detection, and incident response readiness. The report emphasizes that some breaches are inevitable, making detection and response capabilities as critical as prevention.

4mo ago · talos

The article discusses a novel approach to reverse engineering VB6 binaries by leveraging vbdec's live COM object model, enabling AI agents to automate analysis without modifying the core tool. By exposing its parsed project data through the Windows Running Object Table (ROT), vbdec allows local AI agents like Claude Code to interact with and query the disassembler programmatically. This method supports scalable, repeatable, and exhaustive analysis tasks such as decompilation, call graph generation, and database export, all performed locally without uploading sensitive binaries. The technique demonstrates how existing tools can be transformed into queryable services through structured data exposure and simple scripting interfaces.

4mo ago · talos

Cisco Talos observed a large-scale credential-harvesting campaign targeting over 30,000 Fortinet devices across nearly 200 countries. The campaign leverages known vulnerabilities in Fortinet firewalls and VPN gateways to steal credentials and maintain persistent access. Additionally, fileless variants of Phantom Stealer malware are being used to target browser credentials, employing anti-analysis techniques to evade detection. These threats highlight ongoing exploitation of internet-facing infrastructure and the need for robust patching and multi-factor authentication.

4mo ago · talos

Component Object Model (COM) is a foundational Windows technology increasingly exploited by threat actors for malicious purposes such as persistence, lateral movement, execution, and evasion. Malware families like Qakbot, Gh0stRAT, and WarmCookie leverage COM interfaces to interact with Windows services including Task Scheduler, WMI, and BITS, often bypassing traditional detection mechanisms. These threats use indirect vtable calls and DCOM for stealthy operations, making static analysis more complex. Understanding COM usage is critical for effective threat hunting and reverse engineering.

4mo ago · talos

Cisco Talos highlights the increasing abuse of Windows Component Object Model (COM) by malware families such as Qakbot and WarmCookie for lateral movement, persistence, and evasion. COM's use of opaque GUIDs and indirect vtable calls complicates manual analysis and static detection, allowing attackers to blend malicious activities with legitimate system processes. Defenders are advised to enhance their ability to detect and interpret COM-related artifacts to uncover hidden stages of the infection chain.

4mo ago · talos

Cisco Talos identified ARToken, a phishing-as-a-service (PhaaS) platform affiliated with the EvilTokens infrastructure, targeting Microsoft 365 users via sophisticated device code phishing. The platform offers affiliates a comprehensive toolkit for token theft, persistence via Primary Refresh Tokens (PRT), business email compromise (BEC), and SharePoint/OneDrive exfiltration. ARToken leverages advanced anti-analysis techniques including client-side behavioral verification and XOR-encrypted payloads to evade detection, while operating through Cloudflare Workers and a React-based dashboard for management.

4mo ago · talos

Martin Lee, EMEA Lead at Talos, shares his journey from academic research in human virology to leading cybersecurity initiatives. He reflects on the early days of the internet, the evolution of cyber threats, and the accidental discovery of advanced persistent threats (APT) while developing early spam filters. His current role focuses on analyzing the threat landscape and communicating insights to customers and partners. The discussion highlights the importance of curiosity and adaptability in cybersecurity careers.

4mo ago · talos

Cisco Talos has identified ARToken, a sophisticated phishing-as-a-service (PhaaS) platform, which provides a wide range of capabilities including device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC), and SharePoint exfiltration. The platform shares infrastructure and operational patterns with the previously documented EvilTokens platform. ARToken features a React-based dashboard and exposes over 80 API endpoints, indicating it is a mature BEC operations environment rather than a simple phishing kit.