Thorsten takes stock of a rapidly evolving vulnerability landscape: record-setting CVE publication rates, the growing fragmentation of reporting systems, and why consistent tracking and patching remain critical as we move through 2025. This article has been indexed from Cisco Talos…
Tag: Cisco Talos Blog
Asus and Adobe vulnerabilities
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed two vulnerabilities each in Asus Armoury Crate and Adobe Acrobat products. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-party…
Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for July 2025, which includes 132 vulnerabilities affecting a range of products, including 14 that Microsoft marked as “critical.” This article has been indexed from Cisco Talos Blog Read the original article: Microsoft…
PDFs: Portable documents, or perfect deliveries for phish?
A popular social engineering technique returns: callback phishing, or TOAD attacks, which leverage PDFs, VoIP anonymity and even QR code tricks. This article has been indexed from Cisco Talos Blog Read the original article: PDFs: Portable documents, or perfect deliveries…
Getting a career in cybersecurity isn’t easy, but this can help
This week, Joe reflects on his unique path into cybersecurity and shares honest advice for breaking into the field. Plus, learn how cybercriminals are abusing AI to launch more sophisticated attacks and what you can do to stay protected. This…
Decrement by one to rule them all: AsIO3.sys driver exploitation
Cisco Talos uncovered and analyzed two critical vulnerabilities in ASUS’ AsIO3.sys driver, highlighting serious security risks and the importance of robust driver design. This article has been indexed from Cisco Talos Blog Read the original article: Decrement by one to…
Cybercriminal abuse of large language models
Cybercriminals are increasingly gravitating towards uncensored LLMs, cybercriminal-designed LLMs and jailbreaking legitimate LLMs. This article has been indexed from Cisco Talos Blog Read the original article: Cybercriminal abuse of large language models
A week with a “smart” car
In this edition, Thor shares how a week off with a new car turned into a crash course in modern vehicle tech. Surprisingly, it offers many parallels to cybersecurity usability. This article has been indexed from Cisco Talos Blog Read…
When legitimate tools go rogue
Attackers are increasingly hiding in plain sight, using the same tools IT and security teams rely on for daily operations. This blog breaks down common techniques and provides recommendations to defenders. This article has been indexed from Cisco Talos Blog…
Famous Chollima deploying Python version of GolangGhost RAT
Learn how the North Korean-aligned Famous Chollima is using the a new Python-based RAT, “PylangGhost,” to target cryptocurrency and blockchain jobseekers in a campaign affecting users primarily in India. This article has been indexed from Cisco Talos Blog Read the…
Know thyself, know thy environment
In this week’s edition, Bill explores the importance of self-awareness and building repeatable processes to better secure your environment. This article has been indexed from Cisco Talos Blog Read the original article: Know thyself, know thy environment
catdoc zero-day, NVIDIA, High-Logic FontCreator and Parallel vulnerabilities
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three zero-day vulnerabilities in catdoc, as well as vulnerabilities in Parallel, NVIDIA and High-Logic FontCreator 15. This article has been indexed from Cisco Talos Blog Read the original article: catdoc zero-day,…
Microsoft Patch Tuesday for June 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for June 2025, which includes 66 vulnerabilities affecting a range of products, including 10 that Microsoft marked as “critical.” This article has been indexed from Cisco Talos Blog Read the original article: Microsoft…
Everyone’s on the cyber target list
In this week’s newsletter, Martin emphasizes that awareness, basic cyber hygiene and preparation are essential for everyone, and highlights Talos’ discovery of the new PathWiper malware. This article has been indexed from Cisco Talos Blog Read the original article: Everyone’s…
Newly identified wiper malware “PathWiper” targets critical infrastructure in Ukraine
Cisco Talos observed a destructive attack on a critical infrastructure entity within Ukraine, using a previously unknown wiper we are calling “PathWiper.” This article has been indexed from Cisco Talos Blog Read the original article: Newly identified wiper malware “PathWiper”…
A new author has appeared
Talos Content Manager Amy introduces themself, shares her unconventional journey into cybersecurity and reports on threats masquerading as AI installers. This article has been indexed from Cisco Talos Blog Read the original article: A new author has appeared
Cybercriminals camouflaging threats as AI tool installers
Cisco Talos has uncovered new threats, including ransomware like CyberLock and Lucky_Gh0$t, and a destructive malware called Numero, all disguised as legitimate AI tool installers to target victims. This article has been indexed from Cisco Talos Blog Read the original…
Scarcity signals: Are rare activities red flags?
Talos analyzed six months of PowerShell network telemetry and found that rare domains are over three times more likely to be malicious compared to frequently contacted ones. This article has been indexed from Cisco Talos Blog Read the original article:…
Ghosted by a cybercriminal
Hazel observes that cybercriminals often fumble teamwork, with fragile alliances crumbling over missed messages. Plus, how UAT-6382 is exploiting Cityworks and what you can do to stay secure. This article has been indexed from Cisco Talos Blog Read the original…
UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware
Talos has observed exploitation of CVE-2025-0994 in the wild by UAT-6382, a Chinese-speaking threat actor, who then deployed malware payloads via TetraLoader. This article has been indexed from Cisco Talos Blog Read the original article: UAT-6382 exploits Cityworks zero-day vulnerability…