https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Cisco.Sun, 26 Jul 2026 22:32:51 GMThttps://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channelcst-3081Cisco Talos discovered msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that establishes command-and-control communications exclusively through Chrome DevTools Protocol rather than direct network connections. The malware is delivered via a malicious MSI installer disguised as a Windows update and leverages the browser, Cloudflare Workers, and Twilio TURN relays to create a covert WebRTC DataChannel for C2 communications. Chaos is a ransomware-as-a-service group active since February 2025 that uses phishing, vishing, and legitimate tools for post-compromise activities before deploying encryption.Thu, 23 Jul 2026 10:00:38 GMThttps://blog.talosintelligence.com/preview-cisco-talos-at-black-hat-usa-2026cst-3082Cisco Talos will present research and demonstrations at Black Hat USA 2026, including lightning talks on threat actor use of AI prompts, the Warlock ransomware group, zero trust agent identity, and vulnerability discovery trends. The group will deliver a main stage keynote on securing enterprises with AI agents, plus two workshops focused on integrating AI into security operations and monitoring autonomous systems as potential insider threats. Talos threat intelligence is embedded across the Cisco security portfolio and will be showcased at booth 2633.Thu, 23 Jul 2026 10:00:14 GMThttps://bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-trafficcst-3068Chaos ransomware operators deployed a new backdoor called msaRAT that conceals command-and-control traffic by routing it through Chrome or Edge browsers. This technique allows attackers to blend malicious communications with legitimate browser traffic, making detection more difficult.Thu, 23 Jul 2026 10:00:00 GMThttps://securityweek.com/cisco-launches-low-cost-ai-models-for-source-code-securitycst-2955Cisco has released open-weight Antares artificial intelligence (AI) models designed to detect known vulnerabilities in source code with improved speed and reduced cost compared to larger AI models.Tue, 21 Jul 2026 17:44:33 GMThttps://helpnetsecurity.com/2026/07/21/cisco-antares-vulnerability-localization-releasedcst-2910Cisco released Antares, a family of open-weight small language models designed to accelerate the initial triage phase of vulnerability management by automating the task of locating vulnerabilities within unfamiliar codebases. The models address the time-intensive process of pinpointing vulnerable files across large repositories with inconsistent naming conventions. This approach reduces the manual expertise and hours previously required for this foundational security analysis step.Tue, 21 Jul 2026 13:01:57 GMThttps://bleepingcomputer.com/news/security/russian-hackers-trojanize-webex-zoom-apps-to-push-starland-malwarecst-2650A Russian financially motivated threat actor identified as UAT-11795 is distributing trojanized versions of WebEx and Zoom applications to deliver Starland RAT, a new backdoor designed to steal credentials and cryptocurrency.Thu, 16 Jul 2026 10:19:34 GMThttps://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaigncst-2666Cisco Talos identified UAT-11795, a Russian-speaking financially motivated threat actor conducting campaigns since at least June 2025 against victims in the U.S. and Europe. The group deploys Starland RAT, a Python-based remote access tool, alongside WLDR, a sophisticated PowerShell-based command-and-control implant featuring encrypted beaconing and task queuing capabilities. The actor distributes trojanized installers of legitimate software such as MobaXterm, WebEx, Zoom, and DBeaver to establish persistence and steal credentials and cryptocurrency assets.Thu, 16 Jul 2026 10:00:01 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5099539-extended-security-updatecst-2513Microsoft released Windows 10 KB5099539, an extended security update containing July 2026 Patch Tuesday fixes for 570 vulnerabilities and additional security patches. This update addresses a substantial volume of identified flaws across the Windows 10 platform.Tue, 14 Jul 2026 18:49:28 GMThttps://blog.talosintelligence.com/video-where-protection-starts-cisco-talos-intelligence-integrationscst-2489Cisco Talos Intelligence Integrations apply threat intelligence across Cisco's security and enterprise technologies to identify and block malicious activity. The integrations help security teams answer critical questions about newly registered domains, outbound connections, and unusual user behavior in their environments. A new video introduces the team and explains how these integrations work.Tue, 14 Jul 2026 10:47:18 GMThttps://cyberscoop.com/russian-fsb-cisco-joint-cybersecurity-advisorycst-2419Russian FSB Center 16 (tracked under multiple names including Berserk Bear and Dragonfly) has conducted sustained targeting of critical infrastructure globally by exploiting poorly configured and outdated networking devices, particularly Cisco routers with default credentials and unpatched vulnerabilities. A joint cybersecurity advisory from the United States and 12 allied nations on Monday detailed the group's tactics and recommended defenses including disabling Cisco Smart Install, enforcing strong authentication, and monitoring local account activity. The warning follows a December 2025 attack attributed to FSB Center 16 on Poland's energy grid and comes nearly a year after similar alerts.Mon, 13 Jul 2026 15:23:46 GMThttps://securityweek.com/cybersecurity-ma-roundup-37-deals-announced-in-june-2026cst-2402A total of 37 cybersecurity mergers and acquisitions were announced during June 2026, involving major companies including 1Password, Accenture, Cisco, F5, Rubrik, and SailPoint. The article provides a roundup of these transaction announcements in the cybersecurity sector.Mon, 13 Jul 2026 12:20:14 GMThttps://blog.talosintelligence.com/wolfssl-vulnerabilitiescst-2273Cisco Talos disclosed three vulnerabilities in WolfSSL (two improper input validation issues and one integer underflow), fourteen advisories covering 37 CVEs in GeoVision's camera and monitoring solutions (spanning memory corruption, command injection, buffer overflow, privilege escalation, and authentication issues), and one heap-based buffer overflow in VTK-DICOM. All vulnerabilities have been patched by their respective vendors, and Snort rules are available for detection.Thu, 09 Jul 2026 18:52:29 GMThttps://blog.talosintelligence.com/uat-7810cst-516Cisco Talos is tracking UAT-7810, a China-nexus APT actor that builds and maintains Operational Relay Box (ORB) networks for use by secondary threat actors. UAT-7810 has developed and deployed new malware variants including LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST, targeting Linux and embedded devices across multiple architectures. The group exploits known vulnerabilities in Ruckus wireless routers and ASUS AiCloud routers from infrastructure in Eastern Europe and Hong Kong.Tue, 07 Jul 2026 10:00:05 GMThttps://bleepingcomputer.com/news/security/artoken-phaas-exposes-eviltokens-microsoft-365-phishing-toolkitcst-6Researchers discovered ARToken, a phishing-as-a-service (PhaaS) platform operating as an affiliate of the EvilTokens phishing platform, which provides an extensive toolkit for targeting Microsoft 365 accounts. The discovery reveals the organized infrastructure and business model behind credential theft attacks against enterprise email systems.Fri, 03 Jul 2026 14:12:22 GMThttps://blog.talosintelligence.com/catan-and-mousecst-348Cisco Talos published research on ARToken, a phishing-as-a-service (PhaaS) operator panel that shares infrastructure and patterns with the previously documented EvilTokens platform. The panel provides 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC) operations, and SharePoint exfiltration through a React-based dashboard, indicating a mature BEC operations environment rather than a basic phishing kit.Thu, 02 Jul 2026 18:00:34 GMThttps://bleepingcomputer.com/news/security/cisco-finally-confirms-attackers-exploiting-unified-cm-flawcst-12Cisco confirmed that attackers are actively exploiting a vulnerability in Unified Communications Manager that the company patched in early June. The exploitation indicates the flaw has moved from theoretical to real-world attacks following the patch release.Thu, 02 Jul 2026 11:35:25 GMThttps://cyberscoop.com/artoken-bec-platform-cisco-taloscst-143Cisco Talos discovered ARToken, an operator panel that functions as a business email compromise-as-a-service platform affiliated with the EvilTokens phishing-as-a-service operation. ARToken includes advanced capabilities beyond typical phishing kits, such as inbox rule manipulation and shared access links, along with a seven-layer anti-analysis system for evasion. The platform targets specific organizations with customized lures that impersonate legitimate vendors, such as spoofed accounts-payable communications designed to trigger fraudulent payment requests.Wed, 01 Jul 2026 10:00:00 GMThttps://darkreading.com/identity-access-management-security/cisco-adds-nhi-security-stack-with-astrix-widefieldcst-100Cisco has acquired Astrix and WideField to expand its security platform with capabilities for managing identity in agentic environments, reflecting industry momentum toward identity-centric security controls.Fri, 26 Jun 2026 17:31:04 GMThttps://blog.talosintelligence.com/beyond-iocs-ai-enabled-threat-intelligencecst-351Large language models can improve threat intelligence operations by indexing and cross-referencing unstructured strategic and operational reports that traditional indicator-based systems struggle to handle. The approach could enable faster retrieval of relevant threat intelligence and generation of tailored advice, while defenders must address data veracity and query confidentiality concerns. Additionally, malware families increasingly abuse Windows COM (Component Object Model) for lateral movement and evasion, making detection labor-intensive without specialized analysis techniques.Thu, 25 Jun 2026 18:00:26 GMThttps://darkreading.com/cyberattacks-data-breaches/attackers-hit-cisco-sd-wan-flaw-2-months-before-disclosurecst-111Attackers exploited a Cisco SD-WAN vulnerability to gain administrative and root-level access to victim devices using rogue peering techniques, beginning approximately two months before the flaw was publicly disclosed. The attackers leveraged this early window to establish unauthorized access before patches were available. This incident highlights the risk posed by zero-day-like vulnerabilities when disclosure lags behind active exploitation.Wed, 24 Jun 2026 21:16:41 GMThttps://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploitation-cisco-catalyst-sd-wan-managercst-306Mandiant identified threat actors exploiting a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager to escalate from compromised administrative accounts to root-level access via malicious file uploads. The attackers established initial access through unauthorized peering connections, manipulated credentials, and employed extensive anti-forensic techniques to cover their tracks. The vulnerability stems from inadequate filtering in the device's file upload feature, affecting SD-WAN infrastructure used by distributed organizations like banks, retail, and healthcare providers.Wed, 24 Jun 2026 11:00:00 GMThttps://blog.talosintelligence.com/close-encounters-of-the-human-kindcst-353The article is primarily a philosophical commentary on human decision-making and information processing in cybersecurity contexts, using a Spielberg film as a framing device. It argues that knowing what security controls to implement (patching, MFA, segmentation, backups) is easier than actually executing them due to competing priorities and resource constraints. The piece includes a brief technical note about Cisco Talos presenting a new reverse engineering approach that integrates AI agents with traditional disassembly tools through a COM interface to automate analysis workflows locally.Thu, 18 Jun 2026 18:00:24 GMThttps://recordedfuture.com/blog/may-2026-cve-landscapecst-1953In May 2026, Insikt Group identified 41 high-impact vulnerabilities requiring prioritized remediation, representing an 11% increase from April. These vulnerabilities affected 20 vendors, with 21 included in CISA's Known Exploited Vulnerabilities catalog, 19 detected via honeypot data, and one reported by a vendor. Notably, 12 vulnerabilities enabled remote code execution, public proof-of-concept exploits were available for 32 of them, and five were first disclosed between 2008 and 2010, demonstrating continued exploitation of long-standing weaknesses.Mon, 08 Jun 2026 00:00:00 GMThttps://blog.talosintelligence.com/reporting-from-vegas-networking-ai-and-good-boyscst-356This article is a first-person account from Cisco Live U.S. in Las Vegas covering conference observations, including the prevalence of AI infrastructure and security discussions among attendees. The author also highlights Cisco Talos' expansion of its Threat Hunting program, which uses AI-driven analysis combined with human expertise to identify advanced threats that evade traditional detection methods.Thu, 04 Jun 2026 18:00:59 GMThttps://blog.talosintelligence.com/winning-the-cyber-marathon-with-tony-giandomenicocst-357Tony Giandomenico, Senior Director of Product Management at Cisco Talos, discusses how frontier AI models are reshaping cybersecurity and describes the newly launched Cisco Talos Threat Hunting service, which combines AI and human analysis to detect threats bypassing existing security controls. The conversation also explores Giandomenico's leadership philosophy and how he balances intense product work with personal endurance pursuits.Thu, 04 Jun 2026 12:05:31 GMThttps://blog.talosintelligence.com/hypotheses-telemetry-and-human-judgment-inside-cisco-talos-threat-huntingcst-358Cisco Talos Threat Hunting uses hypothesis-driven investigation combined with AI and human expertise to identify threats that evade traditional detection rules. Rather than waiting for known-bad patterns to trigger alerts, analysts form theories about adversary behavior based on threat intelligence and telemetry from 50 million sensors, then search proactively for those indicators. The approach enables detection of novel techniques before formal signatures exist and has successfully identified threats like KongTuke C2 by correlating data across multiple security domains.Thu, 04 Jun 2026 12:05:05 GMThttps://blog.talosintelligence.com/less-panic-patching-more-precisioncst-359The article discusses optimizing patch prioritization by combining CVSS (severity) scores with EPSS (Exploit Prediction Scoring System), which estimates the probability of exploitation within 30 days based on real-world signals. It recommends supplementing the centralized KEV catalog with GCVE (Global CVE), a decentralized approach that provides faster enrichment and broader exploitation signals from multiple sources. The piece emphasizes that proper triage logic can reduce patch backlogs without weakening security posture as a surge in patching demand approaches.Thu, 28 May 2026 18:00:27 GMThttps://blog.talosintelligence.com/mediaarea-heap-based-buffer-overflow-vulnerabilitiescst-361Cisco Talos disclosed four heap-based buffer overflow vulnerabilities in MediaArea's MediaInfoLib library version 26.01, all of which can lead to arbitrary code execution. The vulnerabilities are triggered by providing malicious media files and have been patched by the vendor. Talos has published Snort detection rules and vulnerability advisories for these issues.Wed, 27 May 2026 14:00:14 GMThttps://greynoise.io/blog/the-internet-changes-before-the-advisory-dropscst-1850A GreyNoise study found that malicious targeting activity on the internet typically begins 11 days before vendors publicly disclose vulnerabilities, with the pattern observed across 33 CVEs from 16 vendors. The research showed eight distinct attack surges against a Cisco CVSS 10.0 zero-day compressed from 39 days to just 2 days before disclosure, suggesting attackers gain knowledge of flaws before official advisories.Mon, 20 Apr 2026 00:00:00 GMThttps://recordedfuture.com/blog/march-2026-cve-landscapecst-1981Insikt Group identified 31 high-impact vulnerabilities actively exploited in March 2026, with 29 rated as very critical. The affected products span major vendors including Cisco, Microsoft, Google, ConnectWise, Citrix, and others, with Microsoft and Apple accounting for approximately 32% of the total. Notable findings include the Interlock ransomware group exploiting a Cisco Firewall Management Center zero-day, the continued exploitation of a nine-year-old Hikvision vulnerability, and public proof-of-concept exploits available for 10 of the 31 vulnerabilities.Mon, 13 Apr 2026 00:00:00 GMThttps://greynoise.io/blog/credential-based-campaign-cisco-palo-alto-networks-vpn-gatewayscst-1868GreyNoise has identified a coordinated, automated campaign attempting to compromise enterprise VPN gateways through credential-based attacks targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect services. The campaign appears to be systematically probing authentication infrastructure across multiple organizations.Wed, 17 Dec 2025 00:00:00 GMThttps://greynoise.io/blog/scanning-surge-cisco-asa-devicescst-1888GreyNoise detected two spikes in scanning activity targeting Cisco Adaptive Security Appliance (ASA) devices in late August, with one surge involving over 25,000 unique IP addresses. This represents a dramatic increase from the typical baseline of fewer than 500 daily scans, suggesting potential reconnaissance before a vulnerability disclosure.Thu, 04 Sep 2025 00:00:00 GMThttps://greynoise.io/blog/greynoise-observes-active-exploitation-of-cisco-vulnerabilities-tied-to-salt-typhoon-attackscst-1919GreyNoise detected active exploitation attempts against two Cisco vulnerabilities, CVE-2023-20198 and CVE-2018-0171, with over 110 malicious IP addresses targeting the former vulnerability from multiple countries. The vulnerabilities were mentioned in recent Salt Typhoon reporting but GreyNoise has not attributed the observed exploitation to the Chinese state-sponsored group.Mon, 24 Feb 2025 00:00:00 GMThttps://wiz.io/blog/cisco-and-wiz-help-customers-modernize-cybersecuritycst-1496Cisco and Wiz have announced an enhanced collaboration to strengthen cloud security capabilities for their joint customers. The partnership aims to make security solutions more accessible across cloud-based businesses and improve overall cybersecurity posture.Wed, 12 Feb 2025 11:29:11 GMT