Cisco Talos Archives • Page 2 of 2 • Daily CyberSecurity

China-Nexus Actor UAT-7290 Caught Targeting Telecoms in South Asia and Europe illegal streaming networks complex criminal enterprises UAT-7290 China-nexus Espionage Adversarial Misuse of Generative AI

illegal streaming networks complex criminal enterprises UAT-7290 China-nexus Espionage Adversarial Misuse of Generative AI

China-Nexus Actor UAT-7290 Caught Targeting Telecoms in South Asia and Europe

Do Son January 12, 2026

Cisco Talos has pulled the curtain back on UAT-7290, a threat actor operating out of the China-nexus...

Cisco SD-WAN Vulnerability CVE-2026-20133 FortiGate Compromise Ivanti EPMM Zero-Day CVE-2026-1281 SmarterMail Vulnerability Storm-2603 WatchGuard Zero-Day, IKEv2 Out-of-Bounds Write Cisco Zero-Day, UAT-9686 Chinese APT FortiWeb RCE Exploitation CVE-2025-58034 VMware Zero-Day, Privilege Escalation Sitecore, remote code execution CVE-2025-53690 Windows CLFS, Privilege Escalation CVE-2024-47575 & CVE-2024-11120 CVE-2025-24983 vulnerability

Cisco Zero-Day Siege: Chinese Group UAT-9686 Deploys ‘Aqua’ Malware via CVSS 10 Root Exploit

Do Son December 18, 2025

A critical zero-day vulnerability in Cisco’s secure email appliances is under active siege by a sophisticated Chinese...

UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft

Do Son October 3, 2025

Cisco Talos researchers have detailed the activities of UAT-8099, a Chinese-speaking cybercrime group leveraging compromised Microsoft IIS...

Cisco Uncovers New PlugX Backdoor Linked to Chinese APTs CVE-2024-41988 & CVE-2024-41987

Cisco Uncovers New PlugX Backdoor Linked to Chinese APTs

Do Son September 24, 2025

Researchers at Cisco Talos have uncovered a long-running espionage campaign active since 2022, targeting the telecommunications and...

Inside UAT-7237, a Chinese APT Group Targeting Taiwan Chinese APT, cyberespionage

Inside UAT-7237, a Chinese APT Group Targeting Taiwan

Do Son August 18, 2025

Cisco Talos has published a detailed report exposing a newly designated threat group, UAT-7237, a Chinese-speaking advanced...

PS1Bot Malware Campaign Unleashes Modular PowerShell Framework with Stealthy New Tricks ahost.exe DLL Sideloading Signed Application Abuse PS1Bot, malware ransomware attacks bill

ahost.exe DLL Sideloading Signed Application Abuse PS1Bot, malware ransomware attacks bill

PS1Bot Malware Campaign Unleashes Modular PowerShell Framework with Stealthy New Tricks

Do Son August 14, 2025

Cisco Talos has uncovered an ongoing and highly active malware campaign deploying a sophisticated, modular framework dubbed...

Cisco Talos Q2 Report: Phishing & Ransomware Dominate, with Qilin Using Deprecated PowerShell 1.0 Qilin Ransomware, Phishing & Ransomware

Cisco Talos Q2 Report: Phishing & Ransomware Dominate, with Qilin Using Deprecated PowerShell 1.0

Do Son August 1, 2025

Cisco Talos has released its latest Threat Intelligence Report for Q2 2025, revealing a threat landscape increasingly...

GitHub Abused in Amadey MaaS Campaign: Talos Uncovers Malware-as-a-Service Network Leveraging Public Repositories GitHub MaaS, Emmenhtal Loader

GitHub Abused in Amadey MaaS Campaign: Talos Uncovers Malware-as-a-Service Network Leveraging Public Repositories

Do Son July 18, 2025

Cisco Talos has uncovered a multi-pronged Malware-as-a-Service (MaaS) operation exploiting public GitHub repositories to distribute a wide...

PylangGhost: North Korean APT Deploys Python-Based RAT to Target Crypto Professionals North Korean APT, PylangGhost

PylangGhost: North Korean APT Deploys Python-Based RAT to Target Crypto Professionals

Do Son June 20, 2025

Recently, Cisco Talos unveiled a new Python-based remote access trojan (RAT) dubbed PylangGhost, used exclusively by a...

PathWiper: Russia-Linked APT Deploys New Wiper Malware Against Ukrainian Infrastructure PathWiper, Ukraine Cyberattack

PathWiper: Russia-Linked APT Deploys New Wiper Malware Against Ukrainian Infrastructure

Do Son June 5, 2025

In a sobering development that underscores the continued cyber threat to Ukrainian critical infrastructure, Cisco Talos has...

ToyMaker’s Playbook: Cisco Talos Exposes IAB Tactics Leading to Cactus Ransomware ToyMaker Initial Access Broker Ransomware

ToyMaker’s Playbook: Cisco Talos Exposes IAB Tactics Leading to Cactus Ransomware

Do Son April 25, 2025

Cisco Talos’ 2023 incident response report unveils the operations of “ToyMaker,” a financially motivated Initial Access Broker...

XorDDoS Evolves: Cisco Talos Uncovers “VIP” Controller Fueling Global DDoS Campaigns

Do Son April 19, 2025

A new report from Cisco Talos Intelligence Group reveals the continued global spread and evolution of the...

Nationwide Smishing Scam Targets Toll Road Users, Stealing Payment Data Sample phishing SMS messages

Nationwide Smishing Scam Targets Toll Road Users, Stealing Payment Data

Do Son April 14, 2025

A widespread and persistent SMS phishing (smishing) campaign, uncovered by the Cisco Talos team, has been targeting...

Critical Alert 1 Active Exploit Detected Today