Threat Intelligence

Malware that does not wait for an operator

Talos reports CLOSEDQUORUM, the first documented implant with fully autonomous command and control — a shift from speed and scale to effort displacement.

2026-09-22·3 min·Source: Cisco Talos

Reading JavaScript written not to be read

String arrays, renamed functions, encoded URLs and runtime decoders — a Talos walkthrough of getting obfuscated samples to explain themselves.

2026-08-27·3 min·Source: Cisco Talos

405 samples, twelve on endpoints

Unit 42 gathered every AI-enabled malware sample it could find. Three percent reached a real machine, and none needed new detection.

SeverityLow

2026-08-25·3 min·Source: Unit 42

Seven families, sixty-five machines

Bitdefender's SilkParasite report describes about a year of quiet work across Central Asia and the Caucasus, five of the seven toolsets previously undocumented.

SeverityMedium

2026-08-21·3 min·Source: The Record

An adversary that writes its own playbooks

Talos documents UAT-10147 using agentic AI after the breach, not before it — for exploit refinement, validation and documenting its own intrusions.

SeverityHigh

2026-08-20·3 min·Source: Cisco Talos

Medusa passes five hundred organisations

A joint advisory puts the count above 500 as of April, against 300 in March last year — and names what the affiliates are paid.

SeverityHigh

2026-08-19·2 min·Source: BleepingComputer

A nine-month-old patch meets a ransomware crew

CISA has flagged CVE-2025-60710 as used in ransomware attacks. Microsoft fixed it in November 2025.

SeverityHigh

2026-08-18·2 min·Source: BleepingComputer

ShieldBreak turns Defender into a way up

A privilege escalation flaw disclosed without notice, with a working exploit and no patch yet.

SeverityHigh

2026-08-17·2 min·Source: BleepingComputer

JWR phishing kit streams keystrokes live

Talos documents a framework whose operators watch partial card numbers appear before the victim submits anything.

SeverityHigh

2026-08-13·2 min·Source: Cisco Talos

Ransomware crews are skipping the encryption

Extortion without a payload is faster, quieter, and defeats the control most organisations invested in.

SeverityCritical

2026-08-12·9 min

Initial access brokers are specialising by sector

Listings now advertise vertical, revenue band and security stack.

SeverityHigh

2026-08-08·6 min

Infostealer logs feed almost every other campaign

Commodity credential theft on personal devices is the input to targeted intrusion.

SeverityHigh

2026-08-04·5 min

Build systems are the current supply chain target

Not the package registry — the pipeline that consumes it.

SeverityCritical

2026-07-31·8 min