Cisco Talos Blog
blog.talosintelligence.com · Company blog · on HN since 2017
Cisco Talos is Cisco's threat intelligence group, publishing analyses of malware, vulnerabilities, spyware and attacks on network devices.
What HN saysHN links it for detailed technical write-ups of malware such as VPNFilter, and commenters value such security vendor research.
115HN people shared it
38linked it in comments
108stories submitted
1.7Kstory points
7 months agolast shared
2017people per year2026
Most-shared posts
- 1New VPNFilter malware targets 100,000s of networking devices worldwide7 people · 12 points · first shared 2018 · 2 comments on HN
- 2Recent Cyberattack on Cisco6 people · 16 points · first shared 2022 · 1 comments on HN
- 3DNS Hijacking Abuses Trust in Core Internet Service6 people · 9 points · first shared 2019 · 1 comments on HN
- 4Two vulnerabilities in Zoom could lead to code execution4 people · 267 points · first shared 2020 · 188 comments on HN
- 5Cisco's Talos team analysis of WannaCry worm4 people · 179 points · first shared 2017 · 66 comments on HN
- 6ArcaneDoor – New campaign found targeting network devices4 people · 77 points · first shared 2024 · 23 comments on HN
- 7Apache Struts 0-day4 people · 10 points · first shared 2017 · 1 comments on HN
- 8Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware3 people · 4 points · first shared 2023 · discussion on HN
- 9VPNFilter3 people · first shared 2018
- 10IPv6 Address Unmasking via UPnP2 people · 66 points · first shared 2019 · 39 comments on HN
- 11VPNFilter Update – VPNFilter exploits endpoints, targets new devices2 people · 9 points · first shared 2018 · 3 comments on HN
- 12COINHOARDER: Tracking a Ukrainian Bitcoin Phishing Ring DNS Style2 people · 6 points · first shared 2018 · 2 comments on HN
- 13Olympic Destroyer Takes Aim at Winter Olympics2 people · 4 points · first shared 2018 · discussion on HN
- 14Show HN: GPlayed Trojan – .Net Playing with Google Market2 people · 3 points · first shared 2018 · discussion on HN
- 15Advanced Mobile Malware Campaign in India Uses Malicious MDM2 people · 2 points · first shared 2018 · discussion on HN
What HN people wrote when they linked it
eddyg · 2025-05-14
Passkeys are fantastic! I encourage my family and friends to utilize them as an alternative to passwords whenever possible.
Compared to everything else, they are so much of a nicer experience. I despise the "click the link we just emailed you" so much. And MFA is a pain, and still has security issues: https://blog.talosintelligence.com/state-of-the-art-phishing-mfa-bypas…
I really don't get all the hate for Passkeys on HN...
fragmede · 2023-09-14
You have a point, but I don't think a thirteen year old slashdot post is the best way to illustrate it. Fingerprint authentication has to be implemented correctly, or else it does face the problem you mentioned, and other ones as well. Which Apple did. You can't steal the fingerprint out of an Apple Secure Enclave and compromise it like you're thinking. So it would need to be done right, which Google is capable of mandating for Chromebooks.
As far as Gummy bears are involved, my read of the Cisco Talos Threat Intelligence group report*, vs the competency and resources available to 13-year olds (who are not to be underestimated, tbc), is that the gummy bear trick no longer works.
* https://blog.talosintelligence.com/fingerprint-research/
meritt · 2018-05-24
https://blog.talosintelligence.com/2018/05/VPNFilter.html provides a detailed technical overview of how VPNFilter functions and their findings conclude it appears to be a derivative of similar efforts by the same group.
NCCIC released the following analysis last year with more on the topic:
https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_E…
Sophos published an article a month ago that warned about this exact scenario: https://nakedsecurity.sophos.com/2018/04/18/russias-grizzly-steppe-gun…
mrkramer · 2025-06-30
I'm not a reverse engineer or a white hacker but I like reading about it. Most of the malware is made for Windows OS because of the Windows' enormous market share.
Majority of information about Windows malware I get from big computer security companies' research blogs like:
https://www.trendmicro.com/en_us/research.html
https://www.proofpoint.com/us/blog
https://research.checkpoint.com/
https://blog.talosintelligence.com/
https://www.welivesecurity.com/en/
Microsoft also got good security research blog: https://www.microsoft.com/en-us/security/blog/
Majority of the research combes down to researching malware's capabilities regarding malware persistence, anti-VM techniques and anti-debugging techniques.
Here is for example good compilation of malware's anti-debugging and anti-VM techniques:
https://anti-debug.checkpoint.com/
https://github.com/CheckPointSW/Evasions
avidiax · 2024-07-08
https://en.wikipedia.org/wiki/Search_domain
An example:
The attacker posts a message to a forum, chatroom, etc. like:
Download: 2024YourCompanySalaryData.zip
When the user clicks "2024YourCompanySalaryData.zip", it is actually a domain name, and loads that website. This website then asks you to enter your corp credentials, or executes a 0-day on the victim's browser, etc.
The forum doesn't need to allow file downloads (i.e. a real .zip might not even work), and even if it does, client or server side virus scanning doesn't have a .zip to inspect.
The user is less wary of phishing, having never seen the .zip TLD. They assume they are downloading a file.
https://blog.talosintelligence.com/zip-tld-information-leak/
nubinetwork · 2024-04-28
This guy is a cybersec clout chaser... just link to the article... https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-ca…
csande17 · 2024-01-18
By exposing vulnerable graphics drivers to arbitrary web code, WebGL has allowed websites to take screenshots of your desktop (https://www.mozilla.org/en-US/security/advisories/mfsa2013-86/) and break out of virtual machines (https://blog.talosintelligence.com/nvidia-graphics-driver-vulnerabilit… to use two examples I found via a web search.
costco · 2023-10-20
This is almost certainly related to some sort of Russian cybercrime investigation. If you ever read Krebs or peruse some of the seedier Russian forums, xmpp.ru will sound familiar to you, because it is. Not imputing anything to the operator, that's just the nature of operating an anonymous service.
https://ddanchev.blogspot.com/2021/03/exposing-currently-active-portfo…
https://ddanchev.blogspot.com/2019/07/profiling-currently-active-portf…
https://blog.talosintelligence.com/picking-apart-remcos/
https://flashpoint.io/wp-content/uploads/Plea-Agreement-USA-v.-Vitalii…
Really interesting writeup though. I guess it's a practical example of why everyone should get a CT monitoring service!
rolph · 2023-07-13
olliej · 2023-05-28
Actual analysis seems to be at https://blog.talosintelligence.com/mercenary-intellexa-predator/
mdaniel · 2023-03-15
According to https://blog.talosintelligence.com/microsoft-patch-tuesday-for-march-2… it's an out of bounds write, which I interpret to mean it is luck of the draw about the "RCE" part, but almost certain about the Availability component of the CVSS score
While TFA didn't mention the Patch Tuesday part, the Talos blog said the fix is included in the March release, along with some other venomous looking ones
ay · 2023-01-16
FWIW, the original write-up from TALOS team in Cisco, which is dated a week earlier than this post (10th August 2022): https://blog.talosintelligence.com/recent-cyber-attack/
Disclaimer: I am a Cisco employee.
judge2020 · 2020-08-13
No. There's no check for Cydia or other Debian Package frontends that are there to void your warranty or stop you from downloading cracked apps (they very well could do this). They only patch the security vulnerabilities that are actually used to break out of the app sandbox and run arbitrary code, something that, as we can see with Epic's Fortnite app, could be RCE'd into an app without Apple knowing. These vulnerabilities can and have been used by actual malware in the past[0], so Apple fixing them in iOS is a legitimate security measure.
0: https://blog.talosintelligence.com/2019/10/checkrain-click-fraud.html
Shared404 · 2020-06-08
Except when they leak your data to Facebook, or tell you your video's encrypted...
edit: Or open up RCE
Link: https://blog.talosintelligence.com/2020/06/vuln-spotlight-zoom-code-ex…
Discussion: https://news.ycombinator.com/item?id=23445325
lostmsu · 2020-03-24
X.org: https://www.cvedetails.com/cve/CVE-2018-14600/
MacOS: https://blog.talosintelligence.com/2016/07/apple-image-rce.html
What do you use?
nl · 2020-01-27
There's more details on the SeaTurtle attack this was related to[1][2][3][4].
It looks like the new information here is that intelligence officers are confident enough to link the group to Turkey. Previously FireEye thought it was an Iranian group.
[1] https://www.zdnet.com/article/hackers-breached-greeces-top-level-domai…
[2] https://techcrunch.com/2019/04/17/sea-turtle-talos-dns-hijack/
[3] https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets…
[4] https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijack…
tyingq · 2019-12-06
Interesting. I also found this post about using UpnP on ipv4 addresses to unmask ipv6. https://blog.talosintelligence.com/2019/03/ipv6-unmasking-via-upnp.htm…
bane · 2019-09-07
Could be concerning, see
https://blog.talosintelligence.com/2019/04/seaturtle.html
srcmap · 2018-06-07
In this URL,
https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=1
it mentions snort rules for detection and protection for VPNFilter and ClamAV Signatures.
But it didn't explain how to use them.
The way I understand SNORT after googling it, I need to able captures the traffic (wan port) and feed that to SNORT for analysis, is that correct?
Also for ClamAV, do I need to clone/mount the rootfs from the wifi router to Linux and use ClamAV to scan that rootfs for those signatures?
The URL mentions the infested device have /var/run/vpnfilterm, /var/run/vpnfilterw. I checked they are not in my wifi router's fs.
The URL also mentions it modified/insert entry the crontab, but I can't find what exe name, possible file locations I should search in my router. Do anyone else know such info?
rdiddly · 2018-05-30
Rebooting is enough to get rid of stages 2 and 3, if present. To get rid of stage 1, you have to factory reset, and preferably overwrite the firmware too, even if it's already up-to-date.
More helpful than TFA or the FBI's announcements was this blog post, already featured on HN at least once and linked by commenters probably multiple times:
https://blog.talosintelligence.com/2018/05/VPNFilter.html
drchiu · 2018-05-26
A factory reset, according to Cisco, will fix it.
Correction: according to the original report a reset will mitigate the stage 2 and 3 attack only
Source: https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=1
awat · 2018-05-24
The Talos blog below goes much further in depth on whats actually happening (ip is extracted from photo location data)
Link to blog: https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=1
mzs · 2018-05-24
NKosmatos · 2018-05-23
Link to the technical report by Talos: https://blog.talosintelligence.com/2018/05/VPNFilter.html
Fun trivia, Talos in Greek mythology was a giant automaton robot?) made of bronze to protect Europa in the island of Crete from pirates and invaders.
https://en.wikipedia.org/wiki/Talos
remingtonc · 2018-05-23
Technical breakdown at https://blog.talosintelligence.com/2018/05/VPNFilter.html - "While the list may not be complete, the known devices affected by VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices."
kenbaylor · 2018-03-23
It's called a watering hole attack. You infect many of the devices way ahead of time (that are interested in whatever subject area you targeted), and pick your victim when you need to. If you haven't prosecuted these cases, you'd be surprised how often it happens:
https://www.cyberscoop.com/winter-olympics-hack-attribution-talos-wash…
https://krebsonsecurity.com/2017/08/blowing-the-whistle-on-bad-attribu…
https://blog.trendmicro.com/trendlabs-security-intelligence/eyepyramid…
https://blog.talosintelligence.com/2018/02/who-wasnt-responsible-for-o…
campuscodi · 2018-03-14
Good riddance!
Source for statement: http://blog.talosintelligence.com/2018/02/coinhoarder.html
guelo · 2017-09-16
The CVE and the patch came out on March 7. Exploits were already being detected in the wild at the time by perimeter security vendors. See http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
Equifax "believes" that the hackers got in on May 13. They had some kind of intrusion detection system that finally detected the intrusion on July 29. 5 months after the "Critical" CVE alert went out. During that time security vendors were adding firewall rules to stop the attack. But apparently Equifax didn't have any other security in front of the Struts server.
That just seems like unconscionable incompetence and malpractice for such a high value target.
RachelF · 2017-05-16
Systems that have already been infected with the NSA DOUBLEPULSAR rootkit are more vulnerable to infection [1].
The high prevalence in China (and Russia) might also indicate that these systems were hacked by the NSA prior to the Microsoft March 2017 update patch and the WannaCry ransomware.
[1] http://blog.talosintelligence.com/2017/05/wannacry.html
detaro · 2017-05-14
This (as far as I know) was one of hte first reports of details of the malware and clearly mentions it, and other analysts haven't said otherwise, which by now they would have if they disagreed: http://blog.talosintelligence.com/2017/05/wannacry.html