threat intelligence
Who Wasn’t Responsible for Olympic Destroyer?
This blog post is authored by Paul Rascagneres and Martin Lee. Summary Absent contributions from traditional intelligence capacities, the available evidence linking the Olympic Destroyer malware to a specific threat actor group is contradictory, and does not allow for unambiguous attribution. The th…
Demystifying the API (Using Threat Grid as an Example)
Let’s talk about API usage. An API is a means of interacting with a program via another program. Just like a UI is a User Interface, an API is an Application Program Interface. Cisco is committed to providing practical, robust, scalable APIs across the Advanced Threat Solutions product space,…
Explore the Threat Intelligence Capabilities in the Threat Grid API
Cisco Threat Grid offers a powerful combination of automated malware analysis and advanced threat intelligence. Threat Grid is the file analysis backend of all Cisco Advanced Threat Solutions (ATS) products, and is directly usable via a portal account in the cloud deployment or portal access to a lo…
#CiscoChat Podcast: Cisco and INTERPOL Join Forces to Fight Cybercrime
On 21 November 2017, Cisco and INTERPOL announced an agreement to share threat intelligence as the first step in jointly fighting cybercrime. In this podcast, I talk about the significance of this global agreement signed out of Singapore and how Cisco’s level of security expertise will help law enfo…
What’s in a Name? Threat Intelligence, Artificial Intelligence, and Extreme Snack Foods
What is in a name? A lot, actually. A rose by any other name would certainly smell just as sweet. But if I sold you a dozen dandelions, calling them roses, as the perfect Valentine’s Day gift for your sweetheart, neither of you would be none too pleased, would you? It makes me think of the early day…
Open Source Threat Intel: GOSINT
It’s our pleasure to announce the public availability of GOSINT – the open source intelligence gathering and processing framework. GOSINT allows a security analyst to collect and standardize structured and unstructured threat intelligence. Applying threat intelligence to security operati…
Protecting against the latest variant of H1N1
This is the third and final installment in our technical analysis of the H1N1 loader. In case you missed it, my colleague Josh Reynolds peeled apart the latest variant of H1N1 and analyzed its obfuscation tactics and techniques in the first blog, and in the second blog provides deep technical analys…
Ransomware: Past, Present, and Future
The rise of ransomware over the past year is an ever growing problem. Business often believe that paying the ransom is the most cost effective way of getting their data back – and this may also be the reality. The problem we face is that every single business that pays to recover their files,…
Malware Word Search: Identifying Angler’s Dictionary
This post authored by Steve Poulson with contributions from Nick Biasini. Exploit kits are constantly evolving and changing. We recently wrote about some subtle Angler changes but then Angler changed drastically on March 8. In this blog post, we will briefly cover these changes, examining different…