The 2023 Talos Year in Review is full of insights on how the threat landscape has evolved. But what does that mean for defenders? This blog contains recommendations on how to gain more visibility across your network. This article has…
Category: Cisco Talos Blog
Microsoft releases lightest Patch Tuesday in three years, no zero-days disclosed
The company’s regular set of advisories has included a vulnerability that’s been actively exploited in the wild in 10 months this year. This article has been indexed from Cisco Talos Blog Read the original article: Microsoft releases lightest Patch Tuesday…
Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang
By Jung soo An, Asheer Malhotra and Vitor Ventura. Cisco Talos recently discovered a new campaign conducted by the Lazarus Group we’re calling “Operation Blacksmith,” employing at least three new DLang-based malware families, two of which are remote access trojans…
Video: Talos 2023 Year in Review highlights
In this video, experts from across Cisco Talos came together to discuss the 2023 Talos Year in Review. We chat about what’s new, what’s stayed the same, and how the geopolitical environment has affected the threat landscape. This article has…
Cybersecurity considerations to have when shopping for holiday gifts
When searching for holiday gifts online, make sure you’re buying from a trusted vendor, or if you haven’t heard of the vendor before, take a few extra minutes just to look them up and read their app’s privacy policy. This…
Remote code execution vulnerabilities found in Buildroot, Foxit PDF Reader
Cisco Talos has disclosed 10 vulnerabilities over the past two weeks, including nine that exist in a popular online PDF reader that offers a browser plugin. This article has been indexed from Cisco Talos Blog Read the original article: Remote…
Beers with Talos episode 141: The TurkeyLurkey Man wants YOU to read Talos’ Year in Review report
The team recaps the top malware and attacker trends from 2023, as well as create a new mascot to save Thanksgiving. This article has been indexed from Cisco Talos Blog Read the original article: Beers with Talos episode 141: The…
The malware, attacker trends and more that shaped the threat landscape in 2023
The second annual Cisco Talos Year in Review draws on a massive amount of threat data to analyze the major trends that shaped the threat landscape in 2023. This article has been indexed from Cisco Talos Blog Read the original…
Project PowerUp – Helping to keep the lights on in Ukraine in the face of electronic warfare
Project PowerUp is the story of how Cisco Talos worked with a multi-national, multi-company coalition of volunteers and experts to help “keep the lights on” in Ukraine, by injecting a measure of stability in Ukraine’s power transmission grid. This article…
$19 Stanely cups, fake Amazon Prime memberships all part of holiday shopping scams circulating
Fake Facebook ads seem to be the flavor of the month for scammers. This article has been indexed from Cisco Talos Blog Read the original article: $19 Stanely cups, fake Amazon Prime memberships all part of holiday shopping scams circulating
New SugarGh0st RAT targets Uzbekistan government and South Korea
Cisco Talos recently discovered a malicious campaign that likely started as early as August 2023, delivering a new remote access trojan (RAT) we dubbed “SugarGh0st.” This article has been indexed from Cisco Talos Blog Read the original article: New SugarGh0st…
What is threat hunting?
Many organizations are curious about the idea of threat hunting, but what does this really entail? In this video, four experienced security professionals from across Cisco recently sat down to discuss the basics of threat hunting, and how to go about…
Vulnerabilities in Adobe Acrobat, Microsoft Excel could lead to arbitrary code execution
Adobe recently patched two use-after-free vulnerabilities in its Acrobat PDF reader that Talos discovered, both of which could lead to arbitrary code execution. This article has been indexed from Cisco Talos Blog Read the original article: Vulnerabilities in Adobe Acrobat,…
Understanding the Phobos affiliate structure and activity
Cisco Talos identified the most prolific Phobos variants, TTPs and affiliate structure, based on their activity and analysis of over 1,000 samples from VirusTotal dating back to 2019. We assess with moderate confidence Eking, Eight, Elbie, Devos and Faust are…
A deep dive into Phobos ransomware, recently deployed by 8Base group
Cisco Talos has recently observed an increase in activity conducted by 8Base, a ransomware group that uses a variant of the Phobos ransomware and other publicly available tools to facilitate their operations. This article has been indexed from Cisco Talos…
We all just need to agree that ad blockers are good
YouTube’s new rules may not be around for long anyway, because they might run afoul of European Union regulations This article has been indexed from Cisco Talos Blog Read the original article: We all just need to agree that ad…
7 common mistakes companies make when creating an incident response plan and how to avoid them
Avoiding some of these common mistakes ensures your organization’s plan will be updated faster and is more thorough, so you are ready to act when, not if, an incident happens. This article has been indexed from Cisco Talos Blog Read…
Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday update, three other zero-days
In all, this set of vulnerabilities Microsoft patched includes 57 vulnerabilities, 54 of which are considered “important.” This article has been indexed from Cisco Talos Blog Read the original article: Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday…
Threat Roundup for November 3 to November 10
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 3 and Nov. 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've…
A new video series, Google Forms spam and the various gray areas of cyber attacks
It can be easy to get caught up in the “big” questions in cybersecurity, like how to stop ransomware globally or keep hospitals up and running when they’re targeted by data theft extortion. This article has been indexed from Cisco…
What is NIS2, and how can you best prepare for the new cybersecurity requirements in the EU?
Given the increased geopolitical importance of cybersecurity, NIS2 is a logical step in creating more harmonized and stronger defense capabilities across the European Union. This article has been indexed from Cisco Talos Blog Read the original article: What is NIS2,…
Spammers abuse Google Forms’ quiz to deliver scams
Cisco Talos has recently observed an increase in spam messages abusing a feature of quizzes created within Google Forms. This article has been indexed from Cisco Talos Blog Read the original article: Spammers abuse Google Forms’ quiz to deliver scams
Threat Roundup for October 27 to November 3
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 27 and Nov. 3. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've…
You’d be surprised to know what devices are still using Windows CE
The Arid Viper threat actor is actively trying to install spyware on targeted devices in the Middle East, using fake dating apps as lures. This article has been indexed from Cisco Talos Blog Read the original article: You’d be surprised…
Attackers use JavaScript URLs, API forms and more to scam users in popular online game “Roblox”
Online video games often make use of in-game virtual currency and give players the ability to purchase, trade or sell items. While these features are often selling points for players and potential revenue streams for the companies that make them,…
Arid Viper disguising mobile spyware as updates for non-malicious Android applications
Since April 2022, Cisco Talos has been tracking a malicious campaign operated by the espionage-motivated Arid Viper advanced persistent threat (APT) group targeting Arabic-speaking Android users. This article has been indexed from Cisco Talos Blog Read the original article: Arid…
Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan
Cisco Talos assesses with high confidence that YoroTrooper, an espionage-focused threat actor first active in June 2022, likely consists of individuals from Kazakhstan based on their use of Kazakh currency and fluency in Kazakh and Russian. This article has been…
9 vulnerabilities found in VPN software, including 1 critical issue that could lead to remote code execution
Attackers could exploit these vulnerabilities in the SoftEther VPN solution for individual and enterprise users to force users to drop their connections or execute arbitrary code on the targeted machine. This article has been indexed from Cisco Talos Blog Read…
How helpful are estimates about how much cyber attacks cost?
New YoroTrooper research, the latest on the Cisco IOS vulnerability, and more. This article has been indexed from Cisco Talos Blog Read the original article: How helpful are estimates about how much cyber attacks cost?