Threat Roundup for June 16 to June 23

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between June 16 and June 23. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Cybersecurity hotlines at colleges could go a long way toward filling the skills gap

Welcome to this weeks edition of the Threat Source newsletter. I recently stumbled upon news that the University of Texas at Austin is launching a new cybersecurity clinic run by faculty and students studying security and IT at the university. This clinic offers pro-bono cybersecurity services --...

Video: How Talos’ open-source tools can assist anyone looking to improve their security resilience

Cisco Talos remit is not just to protect our customers from cyber attacks. We also strive to make the internet a better and safer place. Thats one of the reasons why we create and release open-source software, for free. These tools are available to anyone in the security community to enhance thei...

Two remote code execution vulnerabilities disclosed in Microsoft Excel

Cisco Talos recently discovered two vulnerabilities in the Microsoft Excel spreadsheet management software that could allow a malicious actor to execute arbitrary code on the targeted machine. Microsoft disclosed these issues and patched them as part of Junes monthly security release for the...

Microsoft discloses 5 critical vulnerabilities in June's Patch Tuesday, no zero-days

Microsoft released its monthly security update Tuesday, disclosing 69 vulnerabilities across its suite of products and software. Five of these vulnerabilities are considered to be critical, 45 of them are listed as being high severity, 17 of them are medium severity and two are of low severity. F...

Threat Roundup for June 2 to June 9

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between June 2 and June 9. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Threat Roundup for May 19 to May 26

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between May 19 and May 26. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Memory corruption vulnerability in Mitsubishi PLC could lead to DoS, code execution

Cisco Talos recently discovered a memory corruption vulnerability in the Mitsubishi MELSEC iQ-F FX5U programmable logic controller that is caused by a buffer overflow condition. The iQ-F FX5U is one offering in Mitsubishis MELSEC PLC line of hardware that comes with a built-in processor, power...

Predator Android Spyware: Researchers Uncover New Data Theft Capabilities

Security researchers have detailed the inner workings of the commercial Android spyware called Predator, which is marketed by the Israeli company Intellexa previously Cytrox. Predator was first documented by Google's Threat Analysis Group TAG in May 2022 as part of attacks leveraging five differe...

invscout RPM Privilege Escalation

This module exploits a command injection vulnerability in IBM AIX invscout set-uid root utility present in AIX 7.2 and earlier. The undocumented -rpm argument can be used to install an RPM file; and the undocumented -o argument passes arguments to the rpm utility without validation, leading to...

Leaked Babuk ransomware builder code lives on as RA Group

The bones of long gone ransomware group Babuk continue to rattle in the breeze, in the form of reused code. Researchers from Cisco Talos have named this new team the "RA Group", a ransomware collective which may have only been up and running since last month. Babuk famously threatened to leak law...

Newly identified RA Group compromises companies in U.S. and South Korea with leaked Babuk source code

Cisco Talos recently discovered a new ransomware actor called RA Group that has been operating since at least April 22, 2023. The actor is swiftly expanding its operations. To date, the group has compromised three organizations in the U.S. and one in South Korea across several business verticals,...

Threat Roundup for May 5 to May 12

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between May 5 and May 12. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Vulnerability Spotlight: Authentication bypass, use-after-free vulnerabilities found in a library for the µC/OS open-source operating system

Kelly Leuschner of Cisco Talos discovered these vulnerabilities. Cisco Talos recently discovered two vulnerabilities in a library for µC/OS, an open-source operating system developed by Micrium. µC/OS is an embedded operating system that supports TCP/IP, USB, CAN bus and Modbus. The two...

Researcher Spotlight: Jacob Finn creates his own public-private partnership at Talos

After working in government for several years, this Talos threat hunter is diving into the dark web Growing up, Jacob Finn says he wanted to be a detective or maybe a veterinarian, but theres still plenty of time for that. Today with Talos, hes a detective. And while hes still hunting for bad...

Threat Roundup for April 28 to May 5

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between April 28 and May 5. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Threat Source newsletter (May 4, 2023) — Recapping the biggest headlines to come out of RSA

Welcome to this weeks edition of the Threat Source newsletter. I didnt attend the RSA Conference in person, and on top of that, I was at the NFL Draft while the conference was going on. Im behind on the biggest talks, panels and presentations that came out during the annual security conference, s...

Threat Roundup for April 21 to April 28

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between April 21 and April 28. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Vulnerability Spotlight: Vulnerabilities in IBM AIX could lead to command injection with elevated privileges

Tim Brown of Cisco Security Advisory EMEA discovered these vulnerabilities and contributed to this blog post. A Cisco security researcher recently discovered two vulnerabilities in the IBM AIX Unix platforms that could be exploited to inject commands and logs into targeted systems with elevated...

Threat Roundup for April 14 to April 21

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between April 14 and April 21. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...