Beers with Talos, Ep. #109: We have not secured our society — Or, working out a conference talk in realtime

Beers with Talos BWT Podcast episode No. 109 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. Most of the Beers with Talos guys got a chance to take... This is only the...

Threat Source newsletter (Sept. 2, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. If you haven't seen already, our blog has a lot of cool and new stuff this week. We first dove into the world of proxyware on Tuesday aka internet-sharing applications. Attackers are hiding in this newly popular... This is only the...

Attracting flies with Honey(gain): Adversarial abuse of proxyware

By Edmund Brumaghin and Vitor Ventura. With internet-sharing applications, or "proxyware," users download software that allows them to share a percentage of their bandwidth with other internet users for a fee, with the companies that created this software acting as a go-between.As proxyware has...

Translated: Talos' insights from the recently leaked Conti ransomware playbook

By Caitlin Huey, David Liebenberg, Azim Khodjibaev, and Dmytro Korzhevin. Executive summary Cisco Talos recently became aware of a leaked playbook that has been attributed to the ransomware-as-a-service RaaS group Conti. Talos has a team of dedicated, native-level speakers that translated these...

Threat Roundup for August 20 to August 27

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 20 and Aug. 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Talos Takes Ep: #65: How several RAT campaigns in Latin America are connected

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. As more people around the world start to get vaccinated against COVID-19, travel is becoming easier, especially during...

Threat Source newsletter (Aug. 26, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. We have RATs on RATs on RATs over the past few weeks. And last week, we found a few more heading to Latin America to target users and try to steal their login credentials. The threat actor in this case has some compelling... This i...

Malicious Campaign Targets Latin America: The seller, The operator and a curious link

By Asheer Malhotra and Vitor Ventura, with contributions from Vanja Svajcer. Cisco Talos has observed a new malware campaign delivering commodity RATs, including njRAT and AsyncRAT.The campaign targets travel and hospitality organizations in Latin America.Techniques utilized in this campaign...

Threat Roundup for August 13 to August 20

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 13 and Aug. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Threat Source newsletter (Aug. 19, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. I'm writing this on Tuesday morning on account of vacation again, so apologies if we miss any major stories. You certainly don't want to miss our latest blog post on the Neurevt remote access trojan that's... This is only the...

Neurevt trojan takes aim at Mexican users

By Chetan Raghuprasad, with contributions from Vanja Svajcer. News summaryCisco Talos discovered a new version of the Neurevt trojan with spyware and backdoor capabilities in June 2021 using Cisco Secure Endpoint product telemetry.This version of Neurevt appears to target users of Mexican...

Vulnerability Spotlight: Memory corruption vulnerability in Daemon Tools Pro

Piotr Bania of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered a memory corruption vulnerability in Disc Soft Ltd.'s Daemon Tools Pro. Daemon Tools Pro is a professional emulation software that works with disc images and virtual... This is only the...

Vulnerability Spotlight: Multiple integer overflow vulnerabilities in GPAC Project on Advanced Content

A Cisco Talos team member discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple integer overflow vulnerabilities in the GPAC Project on Advanced Content that could lead to memory corruption. The GPAC Project on Advanced Content is an open-source... This i...

Threat Roundup for August 6 to August 13

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 6 and Aug. 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Talos Takes Ep. #64: Back 2 Skool edition

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. There's no shortage of complications leading into this new school year. Students, parents, teachers and admins alike... Th...

Vice Society Leverages PrintNightmare In Ransomware Attacks

By Edmund Brumaghin, Joe Marshall, and Arnaud Zobec. Executive Summary Another threat actor is actively exploiting the so-called PrintNightmare vulnerability CVE-2021-1675 / CVE-2021-34527 in Windows' print spooler service to spread laterally across a victim's network as part of a recent... This ...

Threat Source newsletter (Aug. 12, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. No, that's not Ratatouille. It's ServHelper, who is much more dangerous albeit just as cute as the cartoon chef. We have a new blog post out today detailing this RAT, run by the threat actor Group TA505, that is... This is only the...

Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT

By Vanja Svajcer. News summaryGroup TA505 has been active for at least seven years, making wide-ranging connections with other threat actors involved in ransomware, stealing credit card numbers and exfiltrating data. One of the common tools in TA505's arsenal is ServHelper. In mid-June, Cisco...

Talos Incident Response quarterly threat report — The top malware families and TTPs used in Q2 2021

By David Liebenberg and Caitlin Huey. Last quarter, ransomware was not the most dominant threat for the first time since we began compiling these reports. We theorized that this was due to a huge uptick in Microsoft Exchange exploitation, which temporarily became a primary focus for Cisco... This...

Microsoft Patch Tuesday for August 2021 — Snort rules and prominent vulnerabilities

By Jon Munshaw, with contributions from Martin Lee. Microsoft released its monthly security update Tuesday, disclosing 44 vulnerabilities in the company’s firmware and software. This is the fewest amount of vulnerabilities Microsoft has patched in a month in more than two years. There... This is...

Vulnerability Spotlight: Multiple vulnerabilities in AT&T Labs’ Xmill utility

Carl Hurd of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple vulnerabilities in AT&T Labs’ Xmill utility. An attacker could take advantage of these issues to carry out a variety of malicious actions, including corrupting the... This is...

Vulnerability Spotlight: Code execution vulnerability in Mozilla Firefox

Marcin “Icewall” Noga of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered a use-after-free vulnerability in Mozilla Firefox that could lead to code execution. Firefox is a widely used web browser available on many operating systems. This... This is...

Talos Takes Ep: #63: Shield your eyes from the Solarmarker

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. Andrew Windsor has been following the Solarmarker threat for months. But it really started to catch his eye when he... Thi...

Threat Roundup for July 30 to August 6

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 30 and Aug. 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Vulnerability Spotlight: Use-after-free vulnerability in tinyobjloader

Lilith of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered that a specific function of tinyobjloader does not properly validate array indexes. An adversary could trick a user into opening a specially crafted file, causing an index... This is only the...

Threat Source newsletter (Aug. 5, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. We hope everyone is enjoying BlackHat and/or DEFCON this week, regardless of if you're attending virtually or in person. In case you missed any of our talks from BlackHat, you can check them out here, along... This is only the...

Beers with Talos, Ep. #108: Kaseya it ain't so

Beers with Talos BWT Podcast episode No. 108 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. Who needed a summer vacation anyway? The whole Beers... This is only the...

Updates to the Cisco Talos Email Status Portal

Cisco Talos is rolling out several changes to the Email Status Portal that adds new features and makes the Portal even easier to use. The Talos Email Status Portal allows users to view mail samples submitted and their statuses, analyze graphical displays of submission metrics, administer... This ...

Threat Roundup for July 23 to July 30

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 23 and July 30. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Threat Source newsletter (July 29, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. Thanks to everyone who joined us live yesterday for our talk on business email compromise. If you missed us live, the recording is up on our YouTube page now. Nick Biasini from Talos Outreach provided some great advice on... This i...

Threat Spotlight: Solarmarker

By Andrew Windsor, with contributions from Chris Neal. Executive summaryCisco Talos has observed new activity from Solarmarker, a highly modular .NET-based information stealer and keylogger.A previous staging module, "d.m," used with this malware has been replaced by a new module dubbed... This i...

Vulnerability Spotlight: Use-after-free vulnerabilities in Foxit PDF Reader

Aleksandar Nikolic of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered multiple use-after-free vulnerabilities in the Foxit PDF Reader. Foxit PDF Reader is one of the most popular PDF document readers currently available. As a... This is only the...

Vulnerability Spotlight: Unsafe deserialization vulnerabilities in CODESYS Development System

Patrick DeSantis discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple vulnerabilities in the CODESYS Development System. The CODESYS Development System is the IEC 61131-3 programming tool for industrial control and automation technology,... This is only...

Threat Roundup for July 16 to July 23

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 16 and July 23. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Talos Takes Ep: #62: Don't sleep on business email compromise

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. Business email compromise may seem like last decade’s threat, but it’s still just as prevalent as ever. A recent FBI... Th...

Security implications of misconfigurations

By Jaeson Schultz. When defenders regularly monitor their organization's Domain Name System DNS queries, they can often snuff out potential attacks before they happen. At the very least, it's important to identify and fix configuration mistakes that could lead to nasty security breaches. ... This...

Threat Source newsletter (July 22, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. I'm compiling this Tuesday for vacation reasons, so apologies for any major stories I'm missing here. This week's Beers with Talos podcast hits the seas again. And although we've covered sea shanties in the past, this... This is on...

Beers with Talos, Ep. #107: Sailing the high seas in search of privateer groups

Beers with Talos BWT Podcast episode No. 107 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. You're not going to believe this, but everyone... This is only the...

Threat Roundup for July 9 to July 16

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 9 and July 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Talos Takes Ep: #61: SideCopy sounds so familiar, but I just can't put my finger on it...

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. Asheer Malhotra of Talos Outreach has spent the past few months tracking APTs all along the same line. APT 36, aka... This...

Vulnerability Spotlight: Multiple vulnerabilities in D-LINK DIR-3040

Dave McDaniel discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple vulnerabilities in the D-LINK DIR-3040 wireless router. The DIR-3040 is an AC3000-based wireless internet router. These vulnerabilities could allow an attacker to carry out a... This is...

Threat Source newsletter (July 15, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. The value of cryptocurrency is all over the place. Elon Musk's tweets can send Dogecoin rising and falling. And Monero, the most popular currency for cryptominers, has gone all over the place this year. So does that have... This is...

Vulnerability Spotlight: Multiple vulnerabilities in Advantech R-SeeNet

The Talos vulnerability research team discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple vulnerabilities in the Advantech R-SeeNet monitoring software. R-SeeNet is the software system used for monitoring Advantech routers. It continuously... This is on...

Following the Money: Comparing cryptocurrency value to illicit mining activity

By Nick Biasini In the age of meme stocks, Robinhood and Elon Musk's tweets influencing the global economy, cryptocurrency mining has not seemed as fringe as it once did. Mining has been around as long as these crytocurrencies have, but only really started to gather the attention of criminals in...

Microsoft Patch Tuesday for July 2021 — Snort rules and prominent vulnerabilities

By Jon Munshaw, with contributions from Jaeson Schultz. Microsoft released its monthly security update Tuesday, disclosing 117 vulnerabilities across its suite of products, by far the most in a month this year. Today’s Patch Tuesday includes three vulnerabilities that Microsoft states are... This...

Threat Roundup for July 2 to July 9

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 2 and July 9. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

Talos Takes Ep. #60: Everything you need to know about the Kaseya situation

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. In this special "XL edition" of Talos Takes, we're bringing you the audio version of our live stream this week... This is...

PrintNightmare: Here’s what you need to know and Talos’ coverage

Over the past several weeks, there's been a lot of discussion about a particular privilege escalation vulnerability in Windows affecting the print spooler, dubbed PrintNightmare. The vulnerability CVE-2021-1675/CVE-2021-34527 has now been patched multiple times but is believed to still be... This...

Threat Source newsletter (July 8, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. Just like everyone else in the security world, our week's been dominated by the Kaseya supply chain attack. We went live on pretty much every social media platform we could think of yesterday to update everyone on the... This is on...

Vulnerability Spotlight: Information disclosure, privilege escalation vulnerabilities in IOBit Advanced SystemCare Ultimate

Cory Duplantis of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered multiple vulnerabilities in IOBit Advanced SystemCare Ultimate. IOBit Advanced SystemCare Ultimate is a system optimizer that promises to remove unwanted files and... This is only the...