Avatar

Talos Group

Talos Security Intelligence & Research Group

The Talos Security Intelligence and Research Group (Talos) is made up of leading threat researchers supported by sophisticated systems to create threat intelligence for Cisco products that detects, analyzes and protects against both known and emerging threats. Talos maintains the official rule sets of Snort.org, ClamAV, SenderBase.org and SpamCop. This blog profile is managed by multiple authors with expertise that spans software development, reverse engineering, vulnerability triage, malware investigation and intelligence gathering.

Talos is the primary team that contributes threat information to the Cisco Collective Security Intelligence (CSI) ecosystem. Cisco CSI is shared across multiple security solutions and provides industry-leading security protections and efficacy. In addition to threat researchers, CSI is driven by intelligence infrastructure, product and service telemetry, public and private feeds and the open source community.

Articles

April 12, 2019

THREAT RESEARCH

Threat Roundup for April 5 to April 12

Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between Apr. 5 and Apr. 12. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavioral c…

April 11, 2019

THREAT RESEARCH

Sextortion Profits Decline Despite Higher Volume, New Techniques

Post authored by Nick Biasini and Jaeson Schultz. Sextortion spammers continue blasting away at high volume. The success they experienced with several high-profile campaigns last year has led these attackers to continue transmitting massive amounts of sextortion email. These sextortion spammers have…

April 9, 2019

THREAT RESEARCH

Gustuff banking botnet targets Australia

Cisco Talos has uncovered a new Android-based campaign targeting Australian financial institutions. As the investigation progressed, Talos came to understand that this campaign was associated with the “ChristinaMorrow” text message spam scam previously spotted in Australia. Although this…

April 5, 2019

THREAT RESEARCH

Threat Roundup for March 29 to April 5

Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between Mar. 29 and Apr. 5. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavioral c…

April 5, 2019

THREAT RESEARCH

Hiding in Plain Sight

This blog was written by Jon Munshaw and Jaeson Schultz. Cisco Talos is continually working to ensure that our threat intelligence not only accounts for the latest threats but also new versions of old threats, such as spam. This often means pursuing cybercriminals wherever they congregate. However,…

March 29, 2019

THREAT RESEARCH

Threat Roundup for March 22 to March 29

Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between Mar. 22 and Mar. 29. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavioral…

March 22, 2019

THREAT RESEARCH

Threat Roundup for March 15 to March 22

Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between Mar. 15 and Mar. 22. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavioral…

March 20, 2019

THREAT RESEARCH

Ransomware or Wiper? LockerGoga Straddles the Line

Executive Summary Ransomware attacks have been in the news with increased frequency over the past few years. This type of malware can be extremely disruptive and even cause operational impacts in critical systems that may be infected. LockerGoga is yet another example of this sort of malware. Locker…

March 19, 2019

THREAT RESEARCH

Vulnerability Spotlight: Multiple Vulnerabilities in CUJO Smart Firewall, Das U-Boot, OCTEON SDK, Webroot BrightCloud

Claudio Bozzato of Cisco Talos discovered these vulnerabilities. Executive summary CUJO AI produces the CUJO Smart Firewall, a device that provides protection to home networks against a myriad of threats such as malware, phishing websites and hacking attempts. Cisco Talos recently discovered 11 vuln…