Cisco Talos discovered an ongoing malicious campaign, operating since at least December 2025, affecting a broader workforce in the Czech Republic with a previously undocumented botnet we call “PowMix.” This article has been indexed from Cisco Talos Blog Read the original article: PowMix botnet targets Czech…
Tag: Cisco Talos Blog
The n8n n8mare: How threat actors are misusing AI workflow automation
Cisco Talos research has uncovered agentic AI workflow automation platform abuse in emails. Recently, we identified an increase in the number of emails that abuse n8n, one of these platforms, from as early as October 2025 through March 2026. This article has been indexed from Cisco Talos Blog Read the original article:…
Microsoft Patch Tuesday for April 2026 – Snort Rule and Prominent Vulnerabilities
Overview of patch tuesday release from Microsoft for April 2026. This article has been indexed from Cisco Talos Blog Read the original article: Microsoft Patch Tuesday for April 2026 – Snort Rule and Prominent Vulnerabilities
State-sponsored threats: Different objectives, similar access paths
A look at 2025 state-sponsored threats, exploring how actors linked to China, Russia, North Korea, and Iran use vulnerabilities, identity, and trusted access paths to achieve their goals. This article has been indexed from Cisco Talos Blog Read the original…
[Video] The TTP Ep. 22: The Collapse of the Patch Window
In this episode of The Talos Threat Perspective, we discuss how vulnerability exploitation is accelerating, and why attacker speed, AI, and exposed systems are affecting the patch window. This article has been indexed from Cisco Talos Blog Read the original…
The threat hunter’s gambit
Bill discusses why obsessing over strategy games is actually a secret weapon to outsmart threat actors. This article has been indexed from Cisco Talos Blog Read the original article: The threat hunter’s gambit
From the field to the report and back again: How incident responders can use the Year in Review
The Year in Review distills Talos IR’s observations into structured intelligence, but defenders should also be feeding this report back into their own preparation cycles. Here’s how. This article has been indexed from Cisco Talos Blog Read the original article:…
New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations
Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities to deliver a newly identified malware family, “LucidRook.” This article has been indexed from Cisco Talos Blog Read the original article: New Lua-based malware…
Talos Takes: 2025’s ransomware trends and zombie vulnerabilities
In this episode of Talos Takes, Amy and Pierre Cadieux unpack the ransomware and vulnerability trends that defined 2025. This article has been indexed from Cisco Talos Blog Read the original article: Talos Takes: 2025’s ransomware trends and zombie vulnerabilities
Year in Review: Vulnerabilities old and new and something React2
The year was characterized by an unending beat-down on infrastructure that relied on older enmeshed dependencies (e.g., Log4j and PHPUnit), while React2Shell rocketed to the highest percentage of attacks for the entire year within the last three weeks of 2025. This article has been…
The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines
Cisco Talos has recently observed an increase in activity that is leveraging notification pipelines in popular collaboration platforms to deliver spam and phishing emails. This article has been indexed from Cisco Talos Blog Read the original article: The Trojan horse of cybercrime: Weaponizing SaaS…
Axios NPM supply chain incident
Overview of the recent Axios NPM supply chain incident including details of the payloads delivered from actor-controlled infrastructure. This article has been indexed from Cisco Talos Blog Read the original article: Axios NPM supply chain incident
Do not get high(jacked) off your own supply (chain)
In the span of just a few weeks, we have observed a dizzying array of major supply chain attacks. Prominent examples include the malicious modification of Axios, a popular HTTP client library for JavaScript, as well as cascading compromises from…
Axois NPM Supply Chain Incident
Overview of the recent Axios NPM supply chain incident including details of the payloads delivered from actor-controlled infrastructure. This article has been indexed from Cisco Talos Blog Read the original article: Axois NPM Supply Chain Incident
The democratisation of business email compromise fraud
This week, Martin tells the story of a crime he encountered and how it shows that the threat landscape is changing. This article has been indexed from Cisco Talos Blog Read the original article: The democratisation of business email compromise…
[Video] The TTP Ep 21: When Attackers Become Trusted Users
An episode of the Talos Threat Perspective on the 2025 Year in Review trends. We explore how identity is being used to gain, extend, and maintain access inside environments. This article has been indexed from Cisco Talos Blog Read the…
An overview of ransomware threats in Japan in 2025 and early detection insights from Qilin cases
There were 134 ransomware incidents reported in Japan in 2025, representing a 17.5% year-over-year increase from 2024. This article has been indexed from Cisco Talos Blog Read the original article: An overview of ransomware threats in Japan in 2025 and…
Inside the Talos 2025 Year in Review: A discussion on what the data means for defenders
A conversation between Cisco Talos and Cisco Security leaders on the 2025 threat landscape, from identity attacks and legacy vulnerabilities to AI-driven threats, and what defenders should prioritize now. This article has been indexed from Cisco Talos Blog Read the…
Qilin EDR killer infection chain
This blog provides an in-depth analysis of the malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems. This article has been indexed from Cisco Talos Blog Read the original article: Qilin EDR killer…
UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications
Talos is disclosing a large-scale automated credential harvesting campaign carried out by a threat cluster we currently track as UAT-10608. The campaign is primarily leveraging a collection framework dubbed “NEXUS Listener.” This article has been indexed from Cisco Talos Blog Read the original article: UAT-10608: Inside a…