The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

Welcome to this week's edition of the Threat Source newsletter. I've been following a lot of sometimes heated threads and discussions lately about the current vulnerability landscape. I learned new words/phrases such as Summer of Hell although I'm writing this with 1°C/34°F outside, Vulnpocalypse...

Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

This research was conducted jointly with Julian-Ferdinand V ogele of Recorded Future's Insikt Group. Details of the joint research and presentation are available here . Cisco Talos identified UAT-6275 TAG-193 by Recorded Future activity targeting government organizations across the Commonwealth o...

Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild CVE-2026-969...

Making sure the checks get printed

Welcome to this week's edition of the Threat Source newsletter. My name is Pierre Cadieux, and I'll be helping contribute to these newsletters. A little about me: I've been working in the cybersecurity industry in many roles over the past 20+ years, first focusing on endpoint security, policies,...

UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing

Cisco Talos identified an advanced persistent threat APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. The...

Ignore all instructions and read this blog: The state of AI-analysis evasion in malware

"AI-analysis evasion" encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis. This technique is cheap to add but inconsistently impactful -- the best techniques steered the outcome in the attacker's favor in about...

Microsoft, Adobe, Apple, and Foxit vulnerabilities

Cisco Talos' Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco 's third-party vulnerability disclosure policy...

One breach, please, and make no mistakes

For some time now, the cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure to name a few, Hugging Face, DSEWiki, and RubyGems. Of course, frontier labs have built-in security to prevent these attacks from occurring, but every now a...

Give yourself room to be human

Welcome to this week's edition of the Threat Source newsletter. Fall is officially here in Maryland, and I can't be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook. Beyond that, though, can I say that I'm...

The Fine Art of Frustrating the Adversary

For Cybersecurity Awareness Month, eight Cisco Talos researchers share practical ways defenders can frustrate adversaries at different stages of an operation. Deception techniques such as honeypot accounts, false infrastructure, and tarpits can slow adversaries down while giving defenders earlier...

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as "Antino" in developer artifacts. Talos first observe...

Securing the keys to the kingdom: Announcing Executive Threat Detection

Attackers are using greater sophistication to gain access to high-yield targets like executives, and company-wide security measures can easily miss these subtle, personal attacks. Executive Threat Detection offers protection for up to 10 principals, with monthly custom threat hunts and reports...

Trust and the enticing consultancy offer

Welcome to this week's edition of the Threat Source newsletter. In the cybersecurity industry, trust is the invisible currency. Every practitioner carries the implicit trust not to abuse privileged access or knowledge of vulnerabilities in each employment or engagement. This trust is valued by...

The Closed Quorum: Inside the first reported autonomous AI C2 implant

CLOSEDQUORUM, a malware binary discovered through Cisco Talos' CAIRN project, exhibits fully autonomous command and control C2. While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to...

Introducing CAIRN: Frontier tracking for AI-integrated malware

A cairn is a marker left behind on a trail, a deliberately placed stack of stones that helps hikers find their way when the path is unclear. Attackers building AI-integrated malware unintentionally and inevitably leave behind markers of their own: prompt templates, provider endpoints, API keys,...

Should you care about an “AI slowdown?”

Welcome to this week's edition of the Threat Source newsletter. There's been a lot of talk recently about slowing down the pace of AI development. And yes, there are legitimate moral, ethical, geopolitical, and safety concerns with the use of AI. It's not clear yet whether an AI slowdown could...

Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use

Compared with the same period last year, ransomware incidents in Japan increased slightly by approximately 4.7%, indicating that ransomware continues to pose a significant threat. In Japan, The Gentlemen was the most active ransomware group in the first half of 2026. Attackers continue to primari...

Securing the unpatchable in an age of AI-driven vulnerabilities

AI is accelerating vulnerability discovery, leaving unpatchable operational technology OT systems at risk. Hoping for the best is not a viable anti-exploitation strategy. Deploying next-generation firewalls directly upstream allows for virtual patching through deep packet inspection. These system...

We've got one word for it, and it's usually the wrong one

Welcome to this week's edition of the Threat Source newsletter. Ask anybody in this industry what the work does to the health of the people who do it and you get one word back: burnout. It's a fine word, in and of itself. It's easy to reach for, understandable to everyone… and it's the wrong one,...

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco's Secure Firewall Management Center FMC Software. First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco's Secure FMC Software, which allows an unauthenticated, remote attack...

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." Microsoft notes that 2 of the vulnerabilities disclosed this month have been exploited in the wild:...

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Cisco Talos began an investigation after observing a DLL named "verification.google" executing from WebDAV at a Ukrainian government organization. We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and...

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control C2, retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session. The actors use a variation on...

The story behind the intelligence

Welcome to this week's edition of the Threat Source newsletter. Our goal is to get accurate threat intelligence to our audience as quickly as possible, with all the context you need to ask the right questions of your own environment: How at risk are we from this threat? Are we prepared for it? An...

“Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend

Welcome to this week's edition of the Threat Source newsletter. Hello, everyone. Long time reader, first time writer here at the Threat Source newsletter! I wanted to start out by introducing myself. My colleague and friend Mick Baccio set the bar pretty high last week, so I was planning to tell...

JavaScript obfuscation: From party trick to phishing kit

We open a JavaScript artifact hoping for code, and instead get string arrays, strangely named functions, encoded URLs, runtime decoders, and eval statements. That is the point where "reading the script" stops being enough. Obfuscated JavaScript is still code, but it is code with the useful contex...

Choose your fighter: Balancing competing requirements to select models for your AI SOC

Selecting a model for your security operations center SOC and digital forensics and incident response DFIR tasks is important, but selecting the best one is more involved than you might think. SOC tasks rely on a combination of model efficacy, analysis time, cost, and consistency of results. Cisc...

The safety penalty: Reclaiming operational sovereignty in the age of AI

As frontier models advance in cyber capability, their guardrails also become more restrictive. Defenders relying on these models to power core SOC processes cannot afford to pay the "safety penalty" of being blocked by these safeguards. Organizations should monitor model refusal rates and use the...

Is Cyber missing the Marque?

Welcome to this week 's edition of the Threat Source newsletter. Hello friend. I'm Mick. This is my first Threat Source newsletter, so I should probably introduce myself before I start telling you all the things I think you should be paying attention to. With assistance from an unnamed LLM, my bi...

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

UAT-10147 is a highly capable Chinese-speaking intrusion actor operating a multi-platform post-exploitation ecosystem targeting IIS and Linux servers, combining search engine optimization SEO fraud monetization with advanced persistence and defense evasion techniques. The newly identified SPECTRE...

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos identified UAT-10147 targeting Windows and Linux web servers globally, impacting organizations in government, education, media, technology, and gaming sectors. The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale. UAT-10147 integrated AI-driven toolin...

Describing attacks with crime script analysis

Crime script analysis is a narrative-driven technique that can be used alongside, or as an alternative to, tactics, techniques, and procedures TTPs -- creating human-readable stories that describe attacks in a way non-technical audiences can understand. By analyzing the attacker's workflow, we ca...

Curiouser and Curiouser

Welcome to this week's edition of the Threat Source newsletter. " Experiment is the mother of knowledge." ― Madeleine L'Engle, A Wrinkle in Time " Don't slide down the rabbit hole. The way down is a breeze, but climbing back's a battle." ― Kate Morton, The Clockmaker's Daughter Hacker Summer Camp...

Dissecting the JWR phishing framework

Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms. The client engine of the JWR phishing framework is a real-time, operator-driven...

Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for August 2026, which includes 421 vulnerabilities affecting a range of products, including 62 that Microsoft marked as "critical." Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild CVE-2026-68820...

Why metaphor may dictate your security strategy

Welcome to this week's edition of the Threat Source newsletter. Metaphor is a powerful tool for understanding emerging issues in cybersecurity. Framing the unfamiliar in terms of the well understood helps us remove the burden of extraneous detail to draw focus to the real issues. Recent reports o...

“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

Actor usage of AI is exploding. By analyzing artifacts left behind, Talos has created a detailed analysis of how we are seeing adversaries leverage the technology to include development, force multiplication, and vulnerability research. Based on the evidence Talos gathered, guardrails did not...

[Webinar] Tales from the Frontlines: An exclusive briefing on Q2 incidents

!\Webinar\ Tales from the Frontlines: An exclusive briefing on Q2 incidentshttps://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/08/2-1-no-copy.jpg Have you ever read the Talos IR Quarterly Trends report and wondered, "How did that phishing or ransomware campai...

You were onto something with “It’s the Climb,” Miley

Welcome to this week's edition of the Threat Source newsletter. For my fiancee's 30th birthday, I took her on a weekend trip to Shenandoah National Park - a favorite of ours since we went to a wedding there several years back. We've done several incredible hikes over the years, but one in...

Black Hat special: Rewind and revisit

Cybersecurity is rarely a straight line. In this special Black Hat edition of Humans of Talos, Amy looks back at the incredible journeys that brought past guests to the world of threat intelligence. From forensic labs and newsrooms to the kitchen line, we're revisiting the stories and lessons tha...

IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

Phishing was the primary means of gaining initial access this quarter, appearing in over half of all Cisco Talos Incident Response Talos IR engagements - an increase from approximately a third of engagements last quarter. Attackers continued to innovate their delivery methods to evade defenses,...

Don’t swing at everything

Welcome to this week's edition of the Threat Source newsletter. Lately I've found myself thinking a lot about the Australian TV series Mr. Inbetween IMDb 8.7/10 -- not because I'm a hitman for hire, but because I literally feel in-between. Specifically, in-between what I'd call the "pre-Mythos" a...

Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

Cisco Talos has discovered a new Rust-based remote access trojan RAT we call "msaRAT" attributed to the Chaos ransomware group. The name is derived from the binding names found in the binary: "msaOpen," "msaClose," "msaError," and "msaMessage". msaRAT is implemented using the Tokio asynchronous...

Preview: Cisco Talos at Black Hat USA 2026

We're looking forward to having some great conversations with those of you heading to the desert for Hacker Summer Camp 2026. We have a presence within the Cisco and Splunk booth 2633 during Black Hat where you can chat to us about our latest threat research, incident response, and how Talos powe...

Begun, the Patch Wars have

Welcome to this week's edition of the Threat Source newsletter. We all knew, to some degree or another, that this summer was going to a hot mess. I don't mean FIFA drama or record setting heat waves. I mean the slow but steady momentum that AI frontier models were accruing for vulnerability...

The Hunter's Paradox: Is it time to embrace automated threat hunting?

Should we let AI run our threat hunts? The debate usually splits into two camps. One says, "Yes, obviously! The sheer scale of our security telemetry is impossible for humans to deal with." The other says, "Absolutely not! You can't trust an AI with something this important." The thing is, I thin...

UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. Talos has discovered that the actor in this campaign delivers a Python-based remot...

Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical." Microsoft notes that two of the vulnerabilities disclosed this month have been exploited in the wild. CVE-2026-5615...

[Video] Where protection starts: Cisco Talos Intelligence Integrations

!\Video\ Where protection starts: Cisco Talos Intelligence Integrationshttps://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/07/Talosintegrationsheader-2.jpg Cybersecurity has always involved elements of uncertainty. Every day, security teams are asked to make...

The serpent’s tongue: Luring the Python out of its den

Python's popularity, readable syntax, and extensive third-party library ecosystem make it an attractive target for threat actors seeking to compromise developer devices and infrastructure. Malicious packages and supply-chain attacks are increasingly common, exploiting the trust built into Python'...