JEDI-SEC | Security Research & Digital Defense

Tag: Threat Source newsletter

  • A quiet week in infosec

    A quiet week in infosec

    A quiet week in infosec <.<

    Welcome to this week’s edition of the Threat Source newsletter.

    “The darkest period of my life, so far, arrived the summer I was pregnant with my eldest son. The future was growing in me with all of its terrifying unpredictability, and I found myself anxious, unable to work and woefully at sea.” — Lauren Groff  

    I doubt Lauren had this maniacal infosec news cycle in mind when she wrote about the terrifyingly unpredictable future, but honestly, she’s got our current careers down cold. Let he who is not woefully at sea cast the first water balloon? I’ll work on it.  
      
    Here we are with PHP taking up every available ounce of oxygen, Node.js adding its own spice to the sauce… and here’s me, staring my screen blankly, waiting for an original thought to leak out and onto this page. Not to worry, none have. There is simply nothing novel to say because the entire internet has it covered. In triplicate. With graphs and compelling statistics and AI-generated evil bad guy images galore.  

    These vulnerabilities are serious, and the remediations matter. Teams need to know what they run, find the affected systems, and get them patched and determine ways to secure systems that can’t be patched. I’m simply not going to add another dramatic headline to the stack or pretend there’s a clever new angle hiding in the margins. The thing I keep looping on is that the work underneath the headlines is familiar and it’s the real story. To defend your environment, you need a team that knows that environment, has enough time and expertise to investigate the telemetry, that can tell an anomaly from the usual benign noise, and take action. Yes, the right tools help, and without them you can’t do it — but the people doing the work are still what make those tools useful.  

    Give smart people enough room to do smart people stuff. This is the entire ballgame. Read it again: Give smart people enough room to do smart people stuff. Because a good response starts way before the headline. Know what you own, who owns it, what version is running, whether it can be reached from the internet, what identities can do what task on the device, etc. When a fix is available, make sure it actually reaches the system you meant to fix. If a system cannot be updated yet, give that exception an owner and a deadline. Reduce its exposure, add monitoring, and keep checking until the fix is in place. “We’ll get to it” is not a plan.   

    So, there may be nothing new to say about PHP this week, but the work is still worth talking about: Know your environment, take care of your team members, and keep paying attention when the weird thing stops being weird and starts becoming evidence. When the next headline arrives, help your teammate do the same.  

    “The only thing that makes life possible is permanent, intolerable uncertainty: not knowing what comes next.” — Ursula K. Le Guin 

    The one big thing  

    Cisco Talos has recently discovered “NIK C2,” a new command-and-control framework that integrates AI directly into its attack chain. This Go-based Windows implant allows adversaries to dump credentials, stream keystrokes, and deploy screen-locking ransomware. It also uses an integrated OpenAI model to analyze harvested data on the fly. By hijacking the victim’s own API keys to fund these requests, NIK C2 collapses data collection and exploitation into a single, continuous session. 

    Why do I care? 

    By embedding a live AI pipeline directly into the C2 loop, NIK C2 turns a compromised host into an active operational asset rather than a passive foothold. Because it processes data and generates context-aware payloads locally, it erases the offline processing delays that historically gave defenders a critical detection window. Furthermore, by piggybacking on the victim’s OpenAI account, threat actors completely mask their infrastructure, leaving no attributable trace and complicating incident response. 

    So now what? 

    Defenders must embrace continuous behavioral vigilance. Ensure endpoint solutions monitor for unusual local proxy routing, unexpected PowerShell executions, and unauthorized access to browser databases or crypto wallets. Update your defenses using the ClamAV signature and indicators of compromise (IOCs) provided in the full blog. 

    Top security headlines of the week 

    CISA gives agencies days to patch critical PHP bugs 
    CISA added the two vulnerabilities in the PHP open-source scripting software to the Known Exploited Vulnerabilities (KEV) catalog Monday. (Federal News Network) 

    Node2Shell: Brotli flaw triggers patching across Microsoft, Node.js, Python packages
    An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution. (SecurityWeek) 

    Gheist uses stolen GitHub tokens to steal private repository secrets via Actions logs 
    Each workflow sits on a new branch named ci-sync- followed by six random characters. Deleting a branch, or the run it started, does not undo the exposure. (The Hacker News) 

    Japan internet giant GMO says hackers posted stolen customer data 
    GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders. (TechCrunch) 

    Third Serengeti sweep tops 1,400 arrests as investigations mature 
    Interpol’s annual Operation Serengeti, now on its third iteration, led to 1,462 arrests across 20 African countries and the U.S., recovering $105 million in stolen funds. (Dark Reading)

    Can’t get enough Talos? 

    Stealing AI secrets and breaking EDRs 
    Phishing may have dropped from last quarter’s highs, but ransomware engagements climbed as attackers shifted their focus toward disabling EDR systems and scraping AI credentials. The financial sector also returned as a top target. 

    From federal SOCs to Talos: Ryan Fetterman on practical security research 
    What does it mean to be “blue collar” for the blue team? Amy sat down with security researcher Ryan Fetterman to discuss his journey from federal agency work to his new role at Talos. 

    The Guy Who Invented Pain (plus first reactions to PHP2Shell) 
    David Bianco built the Pyramid of Pain, so we offered him some more. David joins the Beers with Talos crew for a conversation how AI changes about his famous model, how EvidenceForge creates simulated incidents for research and training, and why his red-team entrance exam didn’t go to plan. 

    Compromised eMudhra intermediate certificates 
    Cisco Talos is aware of eight compromised intermediate certificates belonging to the intermediate certificate authority. eMudhra has revoked the certificates and stopped issuing new certificates under its G3 root. 

    Two critical RCEs in PHP core 
    Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. This blog explains what we know so far, and details the Snort coverage available. 

    Upcoming events where you can find Talos 

    Most prevalent malware files from Talos telemetry over the past week  

    SHA256: 73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d 
    MD5: 0cf0271c3564881fce95f44c649bd745 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=73a25ff8893260418c2271b863c567e40e842adbab3c57023cb72de590ea377d 
    Example Filename: KMSAuto++.exe 
    Detection Name: HackTool:WZTeam-tpd 

    SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
    MD5: 2915b3f8b703eb744fc54c81f4a9c67f 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
    Example Filename: sample.exe 
    Detection Name: W32.9F1F11A708-100.SBX.TG** 

    SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f 
    MD5: cca616647db9370c88998ae25da6997f 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f 
    Example Filename: cca616647db9370c88998ae25da6997f.exe 
    Detection Name: Win.Tool.Kmsauto::1201 

    SHA256: 58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 
    MD5: f1fe671bcefd4630e5ed8b87c9283534 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 
    Example Filename: KMSAuto Net.exe 
    Detection Name: W32.58D6FEC4BA-95.SBX.TG 

    SHA256: fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f 
    MD5: 207d9d891ac756b2bfad88aba5682c65 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f 
    Example Filename: sample.exe 
    Detection Name: W32.FED979F93B-95.SBX.TG

    Source: Cisco Talos Intelligence · 2026-10-29

  • I had plans for that second

    I had plans for that second

    I had plans for that second

    Welcome to this week’s edition of the Threat Source newsletter. 

    Here for the latest on the PHP vulnerabilities? Head on down to ‘The One Big Thing’. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset. 

    But if you want a bit of levity, here’s what I wrote before everything kicked off yesterday: 

    Ever feel like the world is moving too fast to keep up? Well, I bring you scientific proof that it’s not just you. 

    For millions of years, the moon has been slowing down the Earth’s rotation. But over the past decade, we’ve been speeding up (I KNEW I was aging faster than before). Apparently, changes in the Earth’s core are involved (either that, or the 1978 Superman film was a documentary). 

    This is all causing massive headaches for the people responsible for keeping time. They’re officially called “The International Bureau of Weights and Measures”, but I’m going to call them “The Time-Keepers”. For nerd reasons).  

    The issue is that the atomic clocks that power so many of our systems, and the rotation of our planet, don’t always agree. Atomic clocks keep extremely consistent time, while each Earth day is rarely the same length as the next. Atomic timekeeping absolutely cannot stand that level of flexibility (have a watch of our “The Light We Keep” documentary to see the importance that accurate clocks have on critical infrastructure).  

    To keep Coordinated Universal Time (UTC), which is based on atomic clocks, aligned with Earth’s rotation, we introduced a “leap second” in 1972. This system allows for an extra second to be added, or taken away, when we stray too far from atomic time. 

    A few days ago, The Time-Keepers voted to officially abolish the leap second. Why? Well, there’s a few parts to it. 

    For the past 54 years, we’ve never once had a second removed from our lives. They’ve always been added (27 of them to be precise). I myself have experienced 20 of these extra seconds. If I’d have known that, I’d have used them more wisely. Like thinking before saying, “Love you too!” to the post-person this morning. 

    That added time, while it seems nice to have on the surface, can wreak havoc with our modern technology systems. In 2012, the extra second caused so much confusion that it crashed Reddit, among other systems. 

    The recent speeding-up of the Earth’s rotation complicates things further. If we keep going at this rate, it could result in the world’s first ever “negative second”. If you thought our technology systems struggled with added time, there are a lot of sciency brains who are very worried about the impact of taking time away. One of those concerns being… it’s never been done before.  

    So, what’s The Time-Keeper’s solution? Invent more time! Woooo. 

    Starting next May, the leap second will be replaced with a “leap hour,” allowing UTC to diverge from Earth’s rotation by up to an hour before a correction is made.  None of us will get to experience that extra hour in our lifetimes, but our Great, Great, Great, Great, Great, Great, Great, Great, Great, Great, Great grandchildren are going to have one hell of a party. 

    For us current mortals, we’re all getting a little less time, and we’re hurtling through space a little faster. Happy Thursday! 

    But I guess I do want to make the point that I’m glad the risk has been thoroughly assessed ahead of, ahem, time. The Time-Keepers have decided that the world’s infrastructure should not have to find out how it handles a missing second by collectively experiencing one.  

    And I don’t even want to think about how all the AIs would cope with a negative second… 

    There’s something here for incident response planning. “It’s never happened before” is an excellent reason to test whether you’re ready for it. Run the exercise. Find out which part of your plan depends on something that, in this scenario, is also broken. Preferably before an adversary gets to supervise the practical demonstration. 

    Now, if only the Time-Keepers can abolish Daylight Savings Time next… 

    The one big thing  

    Two unauthenticated remote code execution (RCE) flaws were discovered in PHP, rocking the internet. Dubbed “php2shell” and triggered by a simple HTTP request, this vulnerability affects every build since 5.4. Talos assesses that all industries running PHP applications are at risk for exploitation if systems remain unpatched.

    Why do I care? 

    PHP runs WordPress, Drupal, Magento, Shopware, WooCommerce, and many other ubiquitous internet staples, so the possible blast radius is enormous. Older branches are end of life (EOL) and will not receive patches; these could account for around 50% of use cases.

    So now what? 

    Cisco customers are covered with the Cisco Talos Network Intrusion Prevention (SNORT®) signatures 67359 and 67360. If your organization is running PHP 8.1 or older, Talos very strongly advises immediate update to PHP 8.2 or later. There is no patch for PHP 8.1 or older. See the article for more specific coverage and detection guidance.

    See an interview with Nick Biasini on php2shell defense:

    Top security headlines of the week 

    ‘PHP2Shell’ Bugs Signal Red Alert for Security Industry
    Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts. (Dark Reading)

    INC and The Gentlemen Ransomware Affiliates expose 8,257 AI messages
    SOCRadar has found seven exposed servers linked to INC and The Gentlemen ransomware affiliates, holding AI chats, stolen credentials and 46 encryptor builds. (Hack Read) 

    The AI hacking apocalypse is not inevitable
    While large language models present real risks to society, experts say they can be tested and largely controlled using well-worn cybersecurity and policy choices. (Cyberscoop)

    ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
    Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold.(SecurityWeek) 

    Can’t get enough Talos? 

    Compromised eMudhra intermediate certificates
    Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.

    Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
    Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of collaboration, file-sharing, payment and other services to reach their targets.

    There’s only so much code: the rise in vulnerability numbers
    The September Microsoft Patch Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does the future look like?

    Upcoming events where you can find Talos 

    Most prevalent malware files from Talos telemetry over the past week  

    SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
    MD5: 2915b3f8b703eb744fc54c81f4a9c67f
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
    Example Filename:sample.exe
    Detection Name: W32.9F1F11A708-100.SBX.TG

    SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f
    MD5: cca616647db9370c88998ae25da6997f
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f
    Example Filename:cca616647db9370c88998ae25da6997f.exe
    Detection Name: Win.Tool.Kmsauto::1201

    SHA256: 985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9
    MD5: 485055033bcddfde56325c0d2feea4f2
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9
    Example Filename:485055033bcddfde56325c0d2feea4f2.exe
    Detection Name: Win.Tool.Kmsauto::1201

    SHA256: d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
    MD5: 0c883b1d66afce606d9830f48d69d74b
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
    Example Filename:d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1.exe
    Detection Name: Win.Worm.Zard::95.sbx.tg

    Source: Cisco Talos Intelligence · 2026-10-22

  • The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

    The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

    The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

    Welcome to this week’s edition of the Threat Source newsletter. 

    I’ve been following a lot of (sometimes heated) threads and discussions lately about the current vulnerability landscape. I learned new words/phrases such as Summer of Hell (although I’m writing this with 1°C/34°F outside), Vulnpocalypse, Bugmageddon, Bugpocalypse, Breachpocalypse… 

    Let’s look at some numbers:

    The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

    We crossed the 70k mark, and it’s only the end of September. This has never been seen before — I think we can agree this number is skyrocketing. Also, CVE numbering organically grew into the six-digit range. Check your tooling. Some might say we broke that barrier already in 2014 (CVE-2014-125110), or even hit seven digits in 2015 (CVE-2015-1000013), but those were allocated artificially. (History note: Before 2014, 9999 was the highest possible identifier.) 

    So that could be seen as the apocalypse argument. On the other hand, we have the KEV numbers:

    The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

    They didn’t explode… yet? Counting by sheer volume, YoY, CVEs increased by 105%, while KEV only grew 37%. Sounds huge at first, but following a 30% increase from 2024 to 2025, that’s less dramatic — a counter-argument of sorts.

    The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

    CVEs from 2025 or older still account for 33%. In other words, a good third of the KEVs are suggesting there is a patch gap. Looking at the 2026 CVEs, the share where the publication date matches the date added to KEV is 29%, which is only 2% more than (all of) 2025. Acknowledging this “math” is not the whole ball of wax, but it still tells me we are not living in a zero-day apocalypse right now. There’s also a slight uptick in networking gear-related CVEs, to 27%.

    This is the second time I’ll ask you to check your tooling. A new column, “forensicTriage,” was added to the KEV to flag which high-risk vulnerabilities require mandatory forensic triage and incident response workflows. You can read more about it in BOD 26-04, or the Implementation Guidance. 

    So where does that leave us? The CVE numbers alone — that +70k mark, now that Q3 is behind us — make a decent case for Vulnpocalypse, or whichever name you prefer. That part of the story is real. But discovery isn’t exploitation, and that gap is exactly what the KEV numbers remind us of. Vendors seem to be keeping pace too, at least partially — KEV is growing, just not nearly at CVE’s speed, which on its own would almost be good news. 

    Where the story breaks down is on the practical side. More than a third of actively exploited vulnerabilities still trace back to 2025 or earlier. Patch debt doesn’t care how many new apocalypse-themed hashtags we invent. 

    So, panic? I still don’t think so. Relax? Definitely not either. Somewhere between the two is where the real work sits — chipping away at that backlog, one legacy system at a time. Maybe by next quarter it’ll feel less like Bugmageddon and more like business as usual. Or maybe I won’t even need a warmer jacket for the upcoming “Winter of Hell.”

    The one big thing  

    Cisco Talos and Recorded Future’s Insikt Group are disclosing new espionage activity from UAT-6275 targeting government and critical infrastructure across the Commonwealth of Independent States (CIS). Thanks to the threat actor’s own operational security lapses, researchers gained direct visibility into their infrastructure and malware development. We observed four distinct infection chains delivering custom reverse shells via macro-enabled documents, GitHub-hosted scripts, and a WinRAR vulnerability. 

    Why do I care? 

    Regional government and critical infrastructure entities are actively being targeted for diplomatic and economic intelligence. UAT-6275 is consistently evolving its tradecraft, abusing legitimate platforms like GitHub to host payloads and deploying lightweight reverse shells. Furthermore, recovered tooling suggests the group is preparing to expand its reach into Linux hosts and internet-facing appliances. 

    So now what? 

    Defenders in targeted regions and sectors should monitor for unexpected PowerShell activity and payload downloads originating from public services like GitHub. It is also critical to watch for suspicious scheduled tasks and unauthorized changes to the Windows Startup folder, which this group uses for persistence. Finally, ensure archive utilities are fully patched to prevent exploit-assisted delivery. ClamAV signatures and indicators of compromise (IOCs) to detect this threat can be found in the full blog post. 

    Top security headlines of the week 

    Hackers heat supermarket fridges to 50°C in France cyber attack 
    The attack began overnight from Sunday to Monday. The unknown attackers reportedly abused the defrosting function in older control software, setting some equipment to heat continuously, with temperatures said to have reached 50°C. (Hack Read) 

    Ivanti zero-day chain gave attackers root access to fully patched VPN 
    CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. (SecurityWeek) 

    U.S. arrests two in crackdown on North Korean IT worker laptop farms
    As part of the scheme, which allegedly ran between 2019 and July 2025, the two housed and configured laptops issued by victim U.S. companies so ITWs would appear to work from the U.S. (SecurityWeek) 

    Canadian cybersecurity executive arrested in U.S. federal extortion case 
    While the FBI did not publicly announce Dubrovsky’s arrest, the case appears to align with actions taken in the wake of the ShinyHunters’ attack on the FBI’s IT systems, which exposed personal data about thousands of bureau employees. (CyberScoop) 

    Maximum-severity SSRF flaw in SonicWall SMA devices under attack 
    The vulnerability, which SonicWall assigned a maximum 10 out of 10 CVSS score, stems from an “unintended alternate access path,” according to the vendor’s advisory. (Dark Reading) 

    Can’t get enough Talos? 

    You’ve got to lurk before you can smirk 
    How do you get under a cybercriminal’s skin? Sometimes you expose their operations. Sometimes you make every step through a network painfully slow. And sometimes, if you’re Azim, you join a dark web forum where they’re insulting you, and help them to do it. 

    Microsoft Patch Tuesday for October 2026 
    Microsoft has released its monthly security update for October 2026, which includes 1,415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as “critical.” 

    One breach, please, and make no mistakes 
    The cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure. How you prepare for agentic threats is what makes the difference during real incidents. 

    Upcoming events where you can find Talos 

    Most prevalent malware files from Talos telemetry over the past week  

    SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507  
    MD5: 2915b3f8b703eb744fc54c81f4a9c67f  
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
    Example Filename: sample.exe  
    Detection Name: W32.9F1F11A708-100.SBX.TG** 

    SHA256: 73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f 
    MD5: 63f3351cfdf618bec6045f60203e7978  
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f 
    Example Filename: f_00478d.exe 
    Detection Name: W32.PUP:PulseBrowser.29kh.in12.Talos 

    SHA256: 58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 
    MD5: f1fe671bcefd4630e5ed8b87c9283534 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 
    Example Filename: KMSAuto Net.exe 
    Detection Name: W32.58D6FEC4BA-95.SBX.TG 

    SHA256: fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f 
    MD5: 207d9d891ac756b2bfad88aba5682c65 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f 
    Example Filename: sample.exe 
    Detection Name: W32.FED979F93B-95.SBX.TG 

    Source: Cisco Talos Intelligence · 2026-10-15

  • Making sure the checks get printed

    Making sure the checks get printed

    Making sure the checks get printed

    Welcome to this week’s edition of the Threat Source newsletter. 

    My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve been working in the cybersecurity industry in many roles over the past 20+ years, first focusing on endpoint security, policies, and firewalls, then moving to risk management and compliance, disaster recovery, and investigations. I spent about 15 years as a consultant working across many well-known consultancy firms and eventually moved to Cisco where I spent time doing security operations center (SOC) design and assessments as well as segmentation before moving to the Talos IR team. I spent many years there, first as an Incident Commander and then a manager of our excellent team of global IR consultants and investigators. My current role is with the Talos Threat Intelligence and Interdiction team, where I’m focused on intelligence efficacy — how we can do better with the data we have, how we can get more data, and what our customers want from our intelligence products. 

    Since it’s Cybersecurity Awareness Month, I wanted to take a few minutes to collectively thank all of the defenders out there for the hard work you do each day. The work you do may not always be visible, but it matters.  

    I remember one job I had many years ago when I was in charge of security for a financial institution. I spent time learning each of the business processes that we had so I could understand each of the moving parts, what was essential, and what was on the horizon for change. I even spent a couple days meeting with the folks who handled printing. Yeah, printing — but not reports or internal documents. These were the people that created the checks that our institution used to pay other institutions, and more importantly (to me) our customers. 

    I recall there being many out-of-patch compliance boxes in this area of the company, so I, being the diligent Director, decided to find out why. It turns out the software being used to print these business essential checks would not run on the current operating systems, and the physical printer cards used to connect to these non-network printers also required older hardware ports. As one of the people I interviewed said, “We don’t want to be the reason someone’s grandma doesn’t get her check and can’t go to the grocery store.” 

    There were (at the time) no other alternatives that we could deploy, and the environment had zero tolerance for downtime. The solution I proposed was to isolate these devices into their own network, which blocked access to and from the internet for these devices, and also reduced the likelihood that these devices would be identified during an adversary’s internal reconnaissance or mapping. It didn’t patch the vulnerable devices, but it went a long way to reducing the likelihood of a bad thing happening to these devices due to their out-of-date OS and software. 

    This story is especially appropriate today, as we face ever-increasing numbers of vulnerabilities announced by software vendors, and can only expect this volume to continue to increase. Do what you can to make sure the checks still get printed, while managing your risks intentionally. 

    The one big thing  

    Cisco Talos is disclosing new findings from our CAIRN research that show malware authors are embedding natural-language instructions into their code to evade AI-assisted analysis. We classify this growing trend as “A3: AI-Analysis Evasion.” Over the past 18 months, we’ve tracked techniques ranging from simple comments telling an AI to ignore a file, to advanced “template spraying” designed to trick specific large language models (LLMs).  

    Why do I care? 

    Attackers expect AI to be in your analysis pipeline, and they’re developing cheap methods to manipulate those systems. While we found these prompt-injection techniques only steer the AI’s verdict in the attacker’s favor about 35 percent of the time, they are being adopted across all levels of malware sophistication. A3 families like MANTLEMAZE also pair these AI deceptions with serious underlying threats, such as abusing vulnerable drivers to disable EDR from kernel space. 

    So now what? 

    Because these evasion instructions must be written in plaintext, defenders have a highly stable detection surface to monitor. Security teams should flag imperative language addressed to analysis systems within binaries as a suspicious signal. Most importantly, anyone building or using AI-assisted pipelines must ensure that text extracted from a sample is strictly treated as evidence, never as a system directive. Read the full blog for more information on these techniques and a list of sample hashes. 

    Top security headlines of the week 

    Citrix NetScaler security snafus get even worse amid more zero-day reports 
    This latest vulnerability, tracked as CVE-2026-88779, is a memory overflow bug that leads to denial of service attacks. (The Register) 

    Hackers steal 8 million citizens’ records from Danish government database 
    The Danish government would not say who is behind the breach, which happened in September but was discovered on October 2. However, it said the unauthorized access was obtained by “abusing a Danish company’s lawful access to search for information in the CPR system.” (TechCrunch) 

    Google narrows open-source bug bounty amid wave of invalid automated reports 
    Google has temporarily closed its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions. According to Google, it has no impact on the program’s supply chain reports or on any pending reports. (SecurityWeek) 

    Warlock ransomware hits large Spanish, Portuguese orgs 
    In the last two months, researchers observed Warlock attacks against four victims: a water utility, a telecommunications provider, a regional government body, and a university. (Dark Reading) 

    U.S. Senate passes health care cybersecurity bill after 190 million impacted by Change Healthcare breach 
    The Health Care Cybersecurity and Resiliency Act of 2026 was passed by unanimous consent last week, potentially expanding federal cyber requirements for health care organizations. (The Record) 

    Can’t get enough Talos? 

    One breach, please, and make no mistakes 
    The cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure. How you prepare for agentic threats is what makes the difference during real incidents. 

    Talos Takes: Honey, I Trapped the Adversary 
    It’s time to start having fun and messing with your attackers. For Cybersecurity Awareness Month, Martin Lee joins Amy to discuss the fine art of making life on your network a complete nightmare for adversaries. 

    The Fine Art of Frustrating the Adversary 
    What really frustrates an adversary? Eight Cisco Talos researchers share practical ways to make their next move slower and riskier, from deception and behavioral detection to breaking attack dependencies. 

    Upcoming events where you can find Talos 

    Most prevalent malware files from Talos telemetry over the past week  

    SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
    MD5: 2915b3f8b703eb744fc54c81f4a9c67f 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
    Example Filename: sample.exe 
    Detection Name: W32.9F1F11A708-100.SBX.TG 

    SHA256: fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f 
    MD5: 207d9d891ac756b2bfad88aba5682c65 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f 
    Example Filename: sample.exe 
    Detection Name: W32.FED979F93B-95.SBX.TG 

    SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f 
    MD5: 38de5b216c33833af710e88f7f64fc98 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f 
    Example Filename: SECOH-QAD.exe 
    Detection Name: W32.9896A6FCB9-95.SBX.TG 

    SHA256: 73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f 
    MD5: 63f3351cfdf618bec6045f60203e7978 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f 
    Example Filename: f_003914.exe 
    Detection Name: W32.PUP:PulseBrowser.29kh.in12.Talos 

    SHA256: 58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 
    MD5: f1fe671bcefd4630e5ed8b87c9283534 
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681 
    Example Filename: KMSAuto Net.exe 
    Detection Name: W32.58D6FEC4BA-95.SBX.TG

    Source: Cisco Talos Intelligence · 2026-10-08