Cisco Talos
talos · B · active
https://blog.talosintelligence.com/
Cisco's threat intelligence team. Has previously returned HTTP 403 on the routine UA (last seen 2026-05-06; recovered 2026-05-07 and confirmed working 2026-05-08). If WebFetch returns 403 again, route through `python3 tools/fetch_source.py url https://blog.talosintelligence.com/` rather than retrying. RSS at /rss/ also works. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch (listing) https://blog.talosintelligence.com/ then webfetch per-article slug URL; if WebFetch 403s, route bridge: python3 tools/fetch_source.py url https://blog.talosintelligence.com/ ; RSS at /rss/ also works. AVOID: Has intermittently 403'd the routine UA in the past, if WebFetch returns 403, go straight to the bridge rather than retrying the same UA.. | 2026-07-05 admiralty audit: B, original Cisco threat-research lab; live. Keep active. | 2026-09-30 intel run: RSS returns 15 dated items on the direct transport.
Cited in 25 entries
Citation cadence
Citation days per ISO week (26 weeks of coverage span, total 23).
- NIK C2: Talos documents a Go Windows implant that sends operator prompts to the OpenAI API from the infected host and falls back to the victim's own API key2026-11-02
- ANNUAL REPORT: Cisco Talos Incident Response trends Q3 2026: public administration tied with finance as the most targeted sector, help-desk vishing into remote-management tools, and ransomware operators uninstalling and killing EDR2026-10-30
- KeyDrift: Talos reports UAT-11473 exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN controllers to run an implant inside the control-plane daemon that collects data-plane keys, with infrastructure overlapping Volt Typhoon's Silent Train network2026-10-29
- Cisco Talos: malware now embeds natural-language instructions aimed at LLM triage pipelines, from a copied comment to template-sprayed prompts across four families, and a Russia-aligned group uses it too2026-10-09
- UAT-11587: a China-nexus cluster spear-phishes Asian government and policy bodies with Antino, a Rust backdoor whose only command channel is Microsoft 365 through Microsoft Graph2026-10-02
- CLOSEDQUORUM: Cisco Talos documents what it calls, to its knowledge, the first publicly documented Windows implant that lets a panel of four commercial LLMs vote on its next action instead of a human operator2026-09-24
- The Gentlemen's open-directory attack toolchain: mounting a victim's own VHDX backup files to pull ntds.dit and SAM offline, then chunked-rclone exfil to Wasabi2026-09-21
- Talos finds AI-generated Python wiper and mass-deployment scripts in a Qilin-affected environment, identified by step-numbered comments and consistent per-step logging2026-09-21
- An intrusion crew's AI-written playbook records why time-based blind testing fails against ViewState deserialization, and that a successful exploit returns HTTP 500, which is what most error-rate alerting is tuned to ignore2026-08-23
- SPECTRE unlinks EDR's kernel callbacks one at a time using a two-driver BYOVD toolkit and an offset table for thirteen Windows builds, and its Linux half hides through ftrace rather than the syscall table2026-08-23
- JWR: a phishing kit that puts a live operator on an encrypted WebSocket into the victim's session, reading card and code digits as they are typed and choosing which one-time-code channel to demand2026-08-15
- Talos analyses threat actors' own AI coding-assistant prompt logs: guardrails fell to unverified permission claims, and the operator's skill (not model access) decided what got built2026-08-05
- CVE-2026-20079, Cisco Secure Firewall Management Center: unauthenticated authentication bypass to root, unpatched for five months and only exploitable in a post-boot window (CVSS 10.0)2026-08-04
- Talos IR Trends Q2 2026: ransomware operators ran their command-and-control through legitimate RMM agents, authentication abuse hit two-thirds of engagements, and missing logs stopped root-cause determination outright2026-07-29
- msaRAT: Chaos ransomware's Rust RAT builds C2 through the Chrome DevTools Protocol so the malware process never opens a socket2026-07-24
- Cisco Talos: UAT-11795 deploys the Python-based Starland RAT and a bespoke PowerShell C2 implant (WLDR), resolving fallback C2 through a Polygon blockchain dead-drop2026-07-17
- Cisco Talos maps the full taxonomy of Python-package build-time and import-time code execution ("The Serpent's Tongue")2026-07-14
- FSB Centre 16 (Static Tundra) router-hijacking campaign: 19-agency joint advisory, formal Poland energy-grid attribution and first joint EU/UK cyber sanctions2026-07-13
- Cisco Talos batch disclosure: wolfSSL PKI name-constraint bypasses, GeoVision command injection, and a VTK-DICOM heap overflow (41 CVEs)2026-07-09
- Cisco Talos: China-nexus UAT-7810 expands its ORB network with LONGLEASH/DOGLEASH/JARLEASH via unpatched Ruckus and ASUS routers2026-07-08
- Cisco Talos: "ARToken" exposes a full BEC-as-a-service toolkit on top of Microsoft 365 device-code phishing2026-07-02
- Cisco Talos: a field guide to Windows COM abuse, ITaskService, BITS, WMI and DCOM as EDR-evasion primitives2026-06-28
- Cisco Talos maps the DICOM-format attack surface against Orthanc PACS, network-ingested medical images as a heap out-of-bounds-write primitive2026-05-31
- Cisco Talos: the "demo.pdb" BadIIS variant is commodity IIS-module malware for SEO fraud, likely sold among Chinese-speaking crime groups and built by the author "lwxat"2026-05-20
- CVE-2026-20182: Cisco Catalyst SD-WAN peering authentication bypass (CVSS 10.0) exploited by UAT-8616; affects Controller, Manager and Validator2026-05-15