Attackers use trusted tools for data theft, making traditional detection unreliable. The Exfiltration Framework enables defenders to spot exfiltration by focusing on behavioral signals across endpoints, networks, and cloud environments rather than static tool indicators. This article has been indexed…
Tag: Cisco Talos Blog
Transparent COM instrumentation for malware analysis
In this article, Cisco Talos presents DispatchLogger, a new open-source tool that delivers high visibility into late-bound IDispatch COM object interactions via transparent proxy interception. This article has been indexed from Cisco Talos Blog Read the original article: Transparent COM instrumentation for malware analysis
This one’s for you, Mom
This week, Joe talks about allyship and how being aware of an issue is the first step in helping to fix it. This article has been indexed from Cisco Talos Blog Read the original article: This one’s for you, Mom
DirectX, OpenFOAM, Libbiosig vulnerabilities
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in the BioSig Project Libbiosig library and OpenCFD OpenFOAM, as well as an unpatched vulnerability in Microsoft DirectX. The vulnerabilities mentioned in this blog post have been patched by their…
Spinning complex ideas into clear docs with Kri Dontje
The episode features Kri Dontje discussing her role in translating complex technical cybersecurity topics into clear, accessible documentation, emphasizing the importance of consistency, accuracy, and collaboration with subject matter experts. This article has been indexed from Cisco Talos Blog Read…
Agentic AI security: Why you need to know about autonomous agents now
There are many benefits and security risks of deploying agentic AI within organizations. This blog emphasizes the importance of robust risk management and threat modeling to defend against both internal operational errors and potential malicious exploitation. This article has been…
Microsoft Patch Tuesday for March 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for March 2026 which includes 79 vulnerabilities, including three that Microsoft marked as “critical.” This article has been indexed from Cisco Talos Blog Read the original article: Microsoft Patch Tuesday for March 2026 — Snort rules and prominent vulnerabilities
Patch, track, repeat: The 2025 CVE retrospective
Thor analyzes CVE data from 2025 and provides recommendations for where and how organizations should strengthen their defenses. This article has been indexed from Cisco Talos Blog Read the original article: Patch, track, repeat: The 2025 CVE retrospective
UAT-9244 targets South American telecommunication providers with three new malware implants
Cisco Talos is disclosing UAT-9244, who we assess with high confidence is a China-nexus advanced persistent threat (APT) actor closely associated with Famous Sparrow. This article has been indexed from Cisco Talos Blog Read the original article: UAT-9244 targets South…
Talos on the developing situation in the Middle East
Cisco Talos continues to monitor the ongoing conflict in the Middle East. As always, we will be watching closely for any cyber-related incidents that are tied to the conflict. This article has been indexed from Cisco Talos Blog Read the…
Henry IV, Hotspur, Hal, and hallucinations
In this edition of the Threat Source newsletter, William draws parallels between Shakespeare’s Hotspur and the challenges of cybersecurity and AI, emphasizing the importance of risk-taking, learning from failure, and surrounding yourself with smart people. This article has been indexed…
New Dohdoor malware campaign targets education and health care
Cisco Talos discovered an ongoing malicious campaign since at least as early as December 2025 by a threat actor we track as “UAT-10027,” delivering a previously undisclosed backdoor dubbed “Dohdoor.” This article has been indexed from Cisco Talos Blog Read…
Active exploitation of Cisco Catalyst SD-WAN by UAT-8616
Cisco Talos is tracking the active exploitation of CVE-2026-20127, a vulnerability in Cisco Catalyst SD-WAN Controller, formerly vSmart, that allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges. This article has been indexed from Cisco Talos Blog…
Using AI to defeat AI
In this week’s newsletter Martin considers how defenders can turn offensive AI tools against themselves. This article has been indexed from Cisco Talos Blog Read the original article: Using AI to defeat AI
“Good enough” emulation: Fuzzing a single thread to uncover vulnerabilities
A Talos researcher used targeted emulation of the Socomec DIRIS M-70 gateway’s Modbus thread to uncover six patched vulnerabilities, showcasing efficient tools and methods for IoT security testing. This article has been indexed from Cisco Talos Blog Read the original…
Hand over the keys for Shannon’s shenanigans
In this week’s newsletter, Amy examines the rise of Shannon, an autonomous AI penetration testing tool, and what it means for security teams and risk management. This article has been indexed from Cisco Talos Blog Read the original article: Hand…
Ryan Liles, master of technical diplomacy
Ryan Liles reveals how he bridges the gap between Cisco’s product teams and third-party testing labs, mastering the art of technical diplomacy while driving industry standards forward and keeping the internet’s defenders ahead of the game. This article has been…
Microsoft Patch Tuesday for February 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for February 2026, which includes 55 vulnerabilities affecting a range of products, including one (CVE-2025-59498) that Microsoft marked as “Critical”. This article has been indexed from Cisco Talos Blog Read the original article: Microsoft Patch Tuesday for February…
New threat actor, UAT-9921, leverages VoidLink framework in campaigns
Cisco Talos recently discovered a new threat actor, UAT-9221, leveraging VoidLink in campaigns. Their activities may go as far back as 2019, even without VoidLink. This article has been indexed from Cisco Talos Blog Read the original article: New threat…
All gas, no brakes: Time to come to AI church
This week, Joe cautions the rush to adopt AI tools rife with truly awful security vulnerabilities. This article has been indexed from Cisco Talos Blog Read the original article: All gas, no brakes: Time to come to AI church