Avatar

Talos Group

Talos Security Intelligence & Research Group

The Talos Security Intelligence and Research Group (Talos) is made up of leading threat researchers supported by sophisticated systems to create threat intelligence for Cisco products that detects, analyzes and protects against both known and emerging threats. Talos maintains the official rule sets of Snort.org, ClamAV, SenderBase.org and SpamCop. This blog profile is managed by multiple authors with expertise that spans software development, reverse engineering, vulnerability triage, malware investigation and intelligence gathering.

Talos is the primary team that contributes threat information to the Cisco Collective Security Intelligence (CSI) ecosystem. Cisco CSI is shared across multiple security solutions and provides industry-leading security protections and efficacy. In addition to threat researchers, CSI is driven by intelligence infrastructure, product and service telemetry, public and private feeds and the open source community.

Articles

April 15, 2019

THREAT RESEARCH

New HawkEye Reborn Variant Emerges Following Ownership Change

HawkEye is another example of malware being marketed across various hacking forums. Talos observed ongoing malware distribution campaigns attempting to leverage the latest version of the HawkEye keylogger/stealer, HawkEye Reborn v9, against organizations to steal sensitive information and account credentials for use in additional attacks and account compromise.

April 15, 2019

THREAT RESEARCH

Vulnerability Spotlight: Multiple vulnerabilities in Shimo VPN’s helper tool

Cisco Talos is disclosing a series of vulnerabilities found in the Shimo VPN Helper Tool. Shimo VPN is a popular VPN client for MacOS that can be used to connect...

April 12, 2019

THREAT RESEARCH

Threat Roundup for April 5 to April 12

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Apr. 5 and Apr. 12. As with previous roundups, this post isn't meant to be an...

April 11, 2019

THREAT RESEARCH

Sextortion Profits Decline Despite Higher Volume, New Techniques

Sextortionists are doing everything to evade spam filters and convince potential victims that perceived threats are real. Here are some recent changes we’ve seen in the sextortion email landscape.

April 9, 2019

THREAT RESEARCH

Gustuff banking botnet targets Australia

Cisco Talos has uncovered a new Android-based campaign targeting Australian financial institutions. As the investigation progressed, Talos came to understand that this campaign was associated with the "ChristinaMorrow" text message...

April 5, 2019

THREAT RESEARCH

Threat Roundup for March 29 to April 5

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Mar. 29 and Apr. 5. As with previous roundups, this post isn't meant to be an...

April 5, 2019

THREAT RESEARCH

Hiding in Plain Sight

Talos has compiled a list of 74 groups on Facebook promising to carry out an array of cyber dirty deeds, and we are tracking their potential impact on Cisco customers.

March 29, 2019

THREAT RESEARCH

Threat Roundup for March 22 to March 29

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Mar. 22 and Mar. 29. As with previous roundups, this post isn't meant to be an...

March 22, 2019

THREAT RESEARCH

Threat Roundup for March 15 to March 22

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Mar. 15 and Mar. 22. As with previous roundups, this post isn't meant to be an...