Cisco Talos Intelligence Group

Cisco Talos’ 2025 Year in Review is available to view now! Read the full report here for key trends and defense tips — no annoying forms, just helpful analysis: cs.co/63328B6X0V0

Want to keep attackers guessing? Nick suggests using deception and AI tarpits to slow down adversaries and turn your network into a maze they can’t navigate: cs.co/63322BH9MVi

Make an attacker to regret ever stepping foot in your environment. Craig Jackson joins the show to convince you to double down on segmentation, and discuss the newest industry buzz: AI kill switches. cs.co/63325BHJtft

Join us for the latest episode of Humans of Talos as security researcher and CAIRN creator Ryan Fetterman shares his journey into threat hunting and why a blue collar approach is important for today’s defenders: cs.co/63327BGU7GD

Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Talos observed abuse of more than 25 legitimate collaboration, file-sharing, payment, and other business platforms over the past year: cs.co/63321BH9JDL

Talos engineer Brandon Stultz talks about how a SnortML model, deployed months earlier, detected a novel PHP2Shell payload, without needing a model update youtu.be/TULUMTy3A7s

The Earth is speeding up, leap seconds are being abolished, oh, and there's critical vulnerabilities in PHP. In this week’s Threat Source, Hazel Burton mourns what she could have done with that extra second: cs.co/6016BHZllK

Cisco Talos is aware of eight compromised intermediate certificates belonging to the intermediate certificate authority, eMudhra blog.talosintelligence.com/compromised-...

Watch now: Two critical vulnerabilities in PHP core could affect a wide range of websites and applications. Talos’ Nick Biasini explains what the vulnerabilities allow adversaries to do, how to assess your exposure, and what defenders should prioritize. cs.co/9006BHX6OC

Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset blog.talosintelligence.com/two-critical...

Make an attacker to regret ever stepping foot in your environment. Craig Jackson joins the show to convince you to double down on segmentation, and discuss the newest industry buzz: AI kill switches. cs.co/63325BHJtft

Cisco Talos will never ask you for bitcoin, payment for services, passwords, or any other personal information. If you receive a suspicious request, do not reply, click on any links or open attachments.

cs.co/63321BHpXZc

Why wait for an attack to hit your team when you can trip up adversaries early in the game? Learn how Martin uses creative deceptions, like fake employee profiles and honeypots, to gain the upper hand: cs.co/63328BGtvSw

Is the cybersecurity world really facing a "Bugmageddon?" Thor breaks down the latest CVE and KEV trends in this week’s Threat Source newsletter: cs.co/63325BHGfsf

Azim and Nick join Hazel and Dave this week to discuss the fine art of frustrating adversaries, from ransomware-group paranoia to deception that wastes their time and gives defenders a chance to spot their activity: cs.co/63327BHJKmN

How can you force an attacker into a no-win situation? According to Ryan, by focusing your detections on their unavoidable objectives instead of their constantly changing tools: cs.co/63329BGtvjb

When threat actors leave the door open, we gain a front-row seat to their operations. Talos and Recorded Future tracked the UAT-6275 group’s evolving tactics across the CIS by analyzing their own exposed infrastructure: cs.co/63327BHGtX7

How do you turn your network into a massive headache for attackers? Martin Lee is back on Talos Takes to explain the benefits of wasting an attacker’s time and using decoys that turn their moves into threat intel you can use: cs.co/63324BGLdjw

It’s time for a Talos TL;DR: What do you do with systems that just can't be patched? youtu.be/78DhjzV-91c?...

Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. For details, check out our blog: cs.co/63326BGNPYY

How can you create more friction and risk for an AI-powered adversary? David has some great advice in our Cybersecurity Awareness Month blog, "The Art of Frustrating the Adversary": cs.co/63321BGtvJl

Join us in welcoming Pierre Cadieux to the Threat Source newsletter team! In his debut, Pierre shares a lesson from his 20 years in the trenches on how to keep the checks printing while managing security risks: cs.co/63320BG2NIo

Swipe through to learn Martin's Top Tips on turning your network into an adversary's nightmare from the latest Talos Takes: www.buzzsprout.com/2018149/epis...

How do defender LLMs react when malware tries to talk its way out of an analysis? Our latest CAIRN deep dive examines the progression of A3 anti-analysis techniques: cs.co/63325BG2s6x

While today’s AI attacks resemble loud, high-volume penetration tests, the true danger lies in the shift toward stealthy, persistent red team operations. Read the full blog: cs.co/63326BGFPlo

How do you turn your network into a massive headache for attackers? Martin Lee is back on Talos Takes to explain the benefits of wasting an attacker’s time and using decoys that turn their moves into threat intel you can use: cs.co/63324BGLdjw

Mastering the fine art of frustrating the adversary is about knowing their next move before they make it. Swipe through our gallery to explore the ransomware attack chain and learn how to proactively obstruct every step.

We have some very special guests joining our next Beers with Talos episode, and we'll be sharing stories about our favorite ways of frustrating and stopping adversaries. What would you like to ask the crew? Drop your questions below!

Do you have questions about CAIRN, CLOSEDQUORUM, AI-integrated malware, or threat hunting? Ryan Fetterman is doing an AMA on Wednesday, October 7 at 12:00 p.m. ET here: cs.co/63322BGt7qE

If you’ve experienced a layoff, the pressure to prove your worth can feel overwhelming. In the latest Threat Source, Amy reflects on breaking that cycle and extending the same grace to ourselves that we offer our teammates during difficult times: cs.co/63328BGQOzk

Grab a drink and tune in as we break down AI-integrated threats with Ryan Fetterman, the human side of IR with Joe, and the usual team chaos on the latest Beers with Talos: cs.co/63325BGt0jS

In recognition of Defenders Day, we’re proud to highlight how Talos researchers like Dmytro Korzhevin are working to bolster Ukraine’s cyber defense. Dmytro recently joined a roundtable in Washington to discuss operational blockers and risks to strengthening civilian cyber infrastructure.

Happy Cybersecurity Awareness Month! This October, we're exploring “The Fine Art of Frustrating the Adversary.” To kick things off, we asked eight Talos researchers for their best practical tips on how to stay one step ahead of attackers: cs.co/63328BGsoz4

Announcing Executive Threat Detection, a Talos IR service that offers protection for up to 10 principals, with monthly custom threat hunts and reports relevant to their corporate systems: cs.co/63325BGUIUb

If that "quick $300 consultation" offer in your DMs feels too good to be true, your gut is likely right. Check out Martin’s latest Threat Source newsletter: cs.co/63322BGgBFr

Join Cisco’s Jessica Oppenheimer inside the Black Hat NOC to see how AI agents are investigating threats in the world’s most hostile network, and why human oversight remains essential: youtu.be/-NcisdnpTR8

Get up to speed on CAIRN and CLOSEDQUORUM with our latest Talos TL;DR: youtube.com/shorts/Wbtbe...

ICYMI: The Beers with Talos team caught up with Martin Lee to discuss why he swapped human virus research for the internet, how ultra-running keeps him sane, and exactly how many Lamborghinis it takes to sink a $245M crypto theft: cs.co/63326BG5V08

Join us for the latest episode of Talos Takes as Vanja Svajcer breaks down a multi-stage infection chain that leverages ClickFix social engineering and EtherHiding to store malicious code on the blockchain: cs.co/63327BGjDOt

Our first findings from the CAIRN project analyze CLOSEDQUORUM, the first documented autonomous AI C2 implant to demonstrate "effort displacement." Read our latest blog to understand how this architecture allows AI to execute attack phases independently: cs.co/63328BGb7JC

Take a brief video tour of CAIRN, Cisco Talos’ new open-source research toolkit for investigating AI-integrated malware. See how researchers can surface samples, uncover connections between them, and identify similarities that conventional code comparison may miss: cs.co/6043BGdufP

Cisco Talos is proud to introduce CAIRN, a new metadata-first research toolkit designed to scale the hunting and classification of AI-integrated malware without defenders needing to download binaries: cs.co/63323BGbAwP

Does an AI slowdown really matter for cybersecurity? In the latest newsletter, David breaks down why your best defense isn't chasing the next big model, but doubling down on the security fundamentals that keep your environment safe: cs.co/63329BGTZ4v

From the rise of newer threat groups like "The Gentlemen" to Qilin’s AI usage, our latest blog post examines the shifting ransomware landscape across Japan during the first half of 2026: cs.co/63327BGTdX1

We might not be able to prevent the discovery of vulnerabilities in “unpatchable” systems, but we can ensure that attackers do not have an easy path to exploit them in the field. Read the blog: cs.co/63323BGRFM3