The year was characterized by an unending beat-down on infrastructure that relied on older enmeshed dependencies (e.g., Log4j and PHPUnit), while React2Shell rocketed to the highest percentage of attacks for the entire year within the last three weeks of 2025. This article has been…
Category: Cisco Talos Blog
The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines
Cisco Talos has recently observed an increase in activity that is leveraging notification pipelines in popular collaboration platforms to deliver spam and phishing emails. This article has been indexed from Cisco Talos Blog Read the original article: The Trojan horse of cybercrime: Weaponizing SaaS…
Axios NPM supply chain incident
Overview of the recent Axios NPM supply chain incident including details of the payloads delivered from actor-controlled infrastructure. This article has been indexed from Cisco Talos Blog Read the original article: Axios NPM supply chain incident
Do not get high(jacked) off your own supply (chain)
In the span of just a few weeks, we have observed a dizzying array of major supply chain attacks. Prominent examples include the malicious modification of Axios, a popular HTTP client library for JavaScript, as well as cascading compromises from…
Axois NPM Supply Chain Incident
Overview of the recent Axios NPM supply chain incident including details of the payloads delivered from actor-controlled infrastructure. This article has been indexed from Cisco Talos Blog Read the original article: Axois NPM Supply Chain Incident
The democratisation of business email compromise fraud
This week, Martin tells the story of a crime he encountered and how it shows that the threat landscape is changing. This article has been indexed from Cisco Talos Blog Read the original article: The democratisation of business email compromise…
[Video] The TTP Ep 21: When Attackers Become Trusted Users
An episode of the Talos Threat Perspective on the 2025 Year in Review trends. We explore how identity is being used to gain, extend, and maintain access inside environments. This article has been indexed from Cisco Talos Blog Read the…
An overview of ransomware threats in Japan in 2025 and early detection insights from Qilin cases
There were 134 ransomware incidents reported in Japan in 2025, representing a 17.5% year-over-year increase from 2024. This article has been indexed from Cisco Talos Blog Read the original article: An overview of ransomware threats in Japan in 2025 and…
Inside the Talos 2025 Year in Review: A discussion on what the data means for defenders
A conversation between Cisco Talos and Cisco Security leaders on the 2025 threat landscape, from identity attacks and legacy vulnerabilities to AI-driven threats, and what defenders should prioritize now. This article has been indexed from Cisco Talos Blog Read the…
Qilin EDR killer infection chain
This blog provides an in-depth analysis of the malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems. This article has been indexed from Cisco Talos Blog Read the original article: Qilin EDR killer…
UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications
Talos is disclosing a large-scale automated credential harvesting campaign carried out by a threat cluster we currently track as UAT-10608. The campaign is primarily leveraging a collection framework dubbed “NEXUS Listener.” This article has been indexed from Cisco Talos Blog Read the original article: UAT-10608: Inside a…
Ransomware in 2025: Blending in is the strategy
A summary of the top ransomware trends from the Talos 2025 Year in Review, with a focus on identity, attacker tactics, and practical defenses. This article has been indexed from Cisco Talos Blog Read the original article: Ransomware in 2025:…
TP-Link, Canva, HikVision vulnerabilities
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed a vulnerability in HikVision, as well as 10 in TP-Link, and 19 in Canva. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence…
A puppet made me cry and all I got was this t-shirt
In this week’s newsletter, Amy draws parallels between the collaborative themes of “Project Hail Mary” and the massive team effort behind the newly released Talos Year in Review report. This article has been indexed from Cisco Talos Blog Read the…
Talos Takes: 2025 insights from Talos and Splunk
This episode of Talos Takes breaks down the 2025 Year in Review as well as Splunk’s Top 50 Cybersecurity Threats report. This article has been indexed from Cisco Talos Blog Read the original article: Talos Takes: 2025 insights from Talos…
2025 Talos Year in Review: Speed, scale, and staying power
The 2025 Talos Year in Review is available now. Understand evolving adversary playbooks and how to strengthen your organization’s defenses. This article has been indexed from Cisco Talos Blog Read the original article: 2025 Talos Year in Review: Speed, scale,…
Beers with Talos breaks down the 2025 Talos Year in Review
The Beers with Talos team unpack the biggest cybersecurity threats of 2025, from React2Shell to ransomware and identity abuse, and what it all means for defenders going forward. This article has been indexed from Cisco Talos Blog Read the original…
Beers with Talos breaks down the 2025 Talos Year in Review
The Beers with Talos team unpack the biggest cybersecurity threats of 2025, from React2Shell to ransomware and identity abuse, and what it all means for defenders going forward. This article has been indexed from Cisco Talos Blog Read the original…
2025 Talos Year in Review: Speed, scale, and staying power
The 2025 Talos Year in Review is available now. Understand evolving adversary playbooks and how to strengthen your organization’s defenses. This article has been indexed from Cisco Talos Blog Read the original article: 2025 Talos Year in Review: Speed, scale,…
You have to invite them in
While a garlic and wooden stakes keep the vampires at bay in movies, they won’t save your network once an attacker has been “invited in.” Discover why identity is the new frontier of cyber horror in this week’s edition. This…