Just as AI brings time-saving advantages to our lives, it brings similar advantages to threat actors. We can take the advantage back. This blog shows how generative AI can be used to rapidly deploy adaptive honeypot systems. This article has been…
Tag: Cisco Talos Blog
Five defender priorities from the Talos Year in Review
With attackers moving faster than ever, it’s easy to feel overwhelmed. This blog breaks down five practical priorities from the Cisco Talos 2025 Year in Review to help defenders focus and prioritize, amidst all the noise. This article has been…
It pays to be a forever student
In this newsletter, Joe discusses why understanding other disciplines can often flow back into the macro and micro of cybersecurity, especially in a world of AI. This article has been indexed from Cisco Talos Blog Read the original article: It…
UAT-4356’s Targeting of Cisco Firepower Devices
Cisco Talos is aware of UAT-4356’s continued active targeting of Cisco Firepower devices’ Firepower eXtensible Operating System (FXOS). UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices. This article has been indexed from Cisco Talos…
IR Trends Q1 2026: Phishing reemerges as top initial access vector, as attacks targeting public administration persist
Phishing reemerged as the most observed means of gaining initial access, accounting for over a third of the engagements where initial access could be determined. Phishing has not been the top vertical for initial access since Q2 2025. This article has been indexed from Cisco…
[Podcast] It’s not you, it’s your printer: State-sponsored and phishing threats in 2025
In this episode of Talos Takes, Amy and Martin Lee unpack state-sponsored and phishing trends from the 2025 Talos Year in Review. This article has been indexed from Cisco Talos Blog Read the original article: [Podcast] It’s not you, it’s…
Phishing and MFA exploitation: Targeting the keys to the kingdom
In 2025, attackers increasingly targeted weaknesses in multi-factor authentication (MFA) workflows, and phishing attacks leveraged valid, compromised credentials to launch lures from trusted accounts. The trends focused entirely on trust, or the lack thereof, in everyday business operations. This article…
Bad Apples: Weaponizing native macOS primitives for movement and execution
Cisco Talos documents several macOS living-off-the-land (LOTL) techniques, demonstrating that native pathways for movement and execution remain accessible to those who understand the underlying architecture. This article has been indexed from Cisco Talos Blog Read the original article: Bad Apples:…
Foxit, LibRaw vulnerabilities
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed one Foxit Reader vulnerability, and six LibRaw file reader vulnerabilities. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-party vulnerability…
The Q1 vulnerability pulse
Thor provides an overview of the Q1 2026 vulnerability statistics, highlighting key trends in legacy CVEs and the evolving impact of AI on the threat landscape. This article has been indexed from Cisco Talos Blog Read the original article: The…
More than pretty pictures: Wendy Bishop on visual storytelling in tech
Wendy shares the unique challenges and rewards of bridging the gap between artistic expression and highly technical research. This article has been indexed from Cisco Talos Blog Read the original article: More than pretty pictures: Wendy Bishop on visual storytelling…
PowMix botnet targets Czech workforce
Cisco Talos discovered an ongoing malicious campaign, operating since at least December 2025, affecting a broader workforce in the Czech Republic with a previously undocumented botnet we call “PowMix.” This article has been indexed from Cisco Talos Blog Read the original article: PowMix botnet targets Czech…
The n8n n8mare: How threat actors are misusing AI workflow automation
Cisco Talos research has uncovered agentic AI workflow automation platform abuse in emails. Recently, we identified an increase in the number of emails that abuse n8n, one of these platforms, from as early as October 2025 through March 2026. This article has been indexed from Cisco Talos Blog Read the original article:…
Microsoft Patch Tuesday for April 2026 – Snort Rule and Prominent Vulnerabilities
Overview of patch tuesday release from Microsoft for April 2026. This article has been indexed from Cisco Talos Blog Read the original article: Microsoft Patch Tuesday for April 2026 – Snort Rule and Prominent Vulnerabilities
State-sponsored threats: Different objectives, similar access paths
A look at 2025 state-sponsored threats, exploring how actors linked to China, Russia, North Korea, and Iran use vulnerabilities, identity, and trusted access paths to achieve their goals. This article has been indexed from Cisco Talos Blog Read the original…
[Video] The TTP Ep. 22: The Collapse of the Patch Window
In this episode of The Talos Threat Perspective, we discuss how vulnerability exploitation is accelerating, and why attacker speed, AI, and exposed systems are affecting the patch window. This article has been indexed from Cisco Talos Blog Read the original…
The threat hunter’s gambit
Bill discusses why obsessing over strategy games is actually a secret weapon to outsmart threat actors. This article has been indexed from Cisco Talos Blog Read the original article: The threat hunter’s gambit
From the field to the report and back again: How incident responders can use the Year in Review
The Year in Review distills Talos IR’s observations into structured intelligence, but defenders should also be feeding this report back into their own preparation cycles. Here’s how. This article has been indexed from Cisco Talos Blog Read the original article:…
New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations
Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities to deliver a newly identified malware family, “LucidRook.” This article has been indexed from Cisco Talos Blog Read the original article: New Lua-based malware…
Talos Takes: 2025’s ransomware trends and zombie vulnerabilities
In this episode of Talos Takes, Amy and Pierre Cadieux unpack the ransomware and vulnerability trends that defined 2025. This article has been indexed from Cisco Talos Blog Read the original article: Talos Takes: 2025’s ransomware trends and zombie vulnerabilities