Under Attack?
For reputation or categorization inquiries, visit the Talos Support site. For emergency DDoS mitigation assistance, please contact the Cisco Secure DDoS Protection Team.
Function Identification and Recovery Signature Tool
Angel M. Villegas
Subverting Operating System Properties through Evolutionary DKOM Attacks
Mariano Graziano, Lorenzo Flore, Andrea Lanzi, and Davide Balzarotti
ROPMEMU: A Framework for the Analysis of Complex Code-Reuse Attacks
Mariano Graziano, Davide Balzarotti, and Alain Zidouemba
Threat Spotlight: PoSeidon, A Deep Dive Into Point of Sale Malware
Talos
Deconstructing and Defending Against Group 72
Andrea Allievi, Joel Esler, Douglas Goddard, Shaun Hurley, Martin Lee, Craig Williams, and Alain Zidouemba.
Threat Spotlight: Cisco Talos Thwarts Access to Massive International Exploit Kit Generating $60M Annually From Ransomware Alone
Nick Biasini with contributions from Joel Esler, Warren Mercer, Melissa Taylor, and Craig Williams
Zeus Trojan Analysis
Alex Kirk
Threat Spotlight: Angler Lurking in the Domain Shadows
CryptoWall 4: The Evolution Continues
Andrea Allievi and Holger Unterbrink with contributions from Warren Mercer
Protecting Windows and Mac Users Against the “Kyle and Stan” Malvertising Network
Shaun Hurley, David McDaniel, and Armin Pelkmann
Content-Type Mismatch Detection
ROKRAT Whitepaper: A sophisticated malware campaign targeting South Korean government officials involved in reunification
Warren Mercer, Paul Rascagneres, Matthew Molyett
Take the RIG Pill Down the Rabbit Hole
By Holger Unterbrink, with contributions by Christopher Marczewski
Wiper Malware whitepaper
Vitor Ventura (@_vventura)
Cisco Talos Email Status Portal overview
Process Control through Counterfeit Comms: Using and abusing built-in functionality to own a PLC
Jared Rittle and Patrick DeSantis
List of bitcoin wallets in recent sextortion campaigns
Jaeson Schultz
List of malicious Facebook groups taken down by Cisco Talos
Jonathan Munshaw and Jaeson Schultz
The art and science of detecting Cobalt Strike
Nicholas Mavis
Emotet IOCs
Blocking cryptocurrency mining using Cisco Security products
Alex McDonnell, with contributions from Nicholas Mavis, Spenser Reinhardt, Josh Reynolds and Alan Smith
CISO Advisory: Government & Risk management
Martin Lee and Jon Munshaw
Cisco Advisory: Security architecture
Joe Marshall and Jon Munshaw
Data breach pay-for-homework document
What to expect when you're electing: Information hygiene and the human levels of disinformation
Azim Khodjibaev and Ryan Pentney
IR Quarterly Trends TAR Q4 2019 One Pager
Cisco Talos
IR Quarterly Trends TAR Q2 2020 One Pager
IR Quarterly Trends TAR Q1 2020 One Pager
Cisco Talos Incident Response Threat Assessment Report for Q3 2020
David Liebenberg, Kendall McKay, Jonathan Munshaw
What to expect when you're electing: What Talos learned after 4 years of research and hands-on experience
Matt Olney
What to expect when you're electing: The building blocks of political disinformation campaigns
Nick Biasini, Kendall McKay and Matt Valites
IR Quarterly Trends Q4 2020
David Liebenberg and Caitlin Huey
RAMBO: Run-time packer Analysis with Multiple Branch Observation
Xabier Ugarte-Pedrero, Davide Balzarotti, , Igor Santos, and Pablo G. Bringas
Talos' advice to election officials ahead of the 2020 election
Matthew Olney
One-pager: Examining Maze after its big year
Cisco Talos Incident Response Threat Assessment Report for Q1 2021
Jonathan Munshaw
Interview with a LockBit ransomware operator
Azim Khodjibaev, Dmytro Korzhevin and Kendall McKay
Ryuk remains a formidable ransomware threat
Caitlin Huey, David Liebenberg, Kendall McKay and Jon Munshaw
Cisco Talos Incident Response trends from Winter 2020-21
Cisco Talos Incident Response Threat Assessment Report for Q2 2021
CTIR Case Study: Evicting Maze
Cisco Talos Incident Response
CTIR Case Study: Cobalt Strikes Out
CTIR Emergency Response Service
CTIR
InSideCopy: How this APT continues to evolve its arsenal
Asheer Malhotra and Justin Thattil
SolarMarker overview
ServHelper overview
Conti ransomware playbook translated to English
Talos Threat Intelligence and Interdiction Team
Overview of Operation: Armor Piercer
Talos Incident Response threat assessment report (Q3 2021)
Cisco Talos Incident Response Threat Assessment Report for Q4 2021
Jonathan Munshaw, David Liebenberg and Caitlin Huey
ZTE router vulnerability deep dive: How an attacker could exploit two vulnerabilities to gain full control
Marcin "Icewall" Noga
Executive guidance on the ongoing situation in Ukraine (translated to Ukrainian)
Overview of CyclopsBlink router malware (translated to Ukrainian)
Current Executive Guidance for Ongoing Cyberattacks in Ukraine (translated to Ukrainian)
Nick Biasini
Cisco Talos Incident Response Threat Assessment Report for Q1 2022
Threat advisory:Cybercriminals compromise users with malware disguised as pro-Ukraine cyber tools (translated to Ukrainian)
Chris Neal
Threat Advisory: HermeticWiper (translated to Ukrainian)
Asheer Malhotra
Threat Advisory: Opportunistic cyber criminals take advantage of Ukraine invasion (translated to Ukrainian)
Edmund Brumaghin
Threat Assessment Report: BlackCat ransomware
Threat Advisory: CaddyWiper (translated to Ukrainian)
Conti and Hive ransomware operations: Leveraging victim chats for insights
Kendall McKay, Paul Eubanks and Jaime Filson
Talos Incident Response Quarterly Threat Report (Q2 2022)
Caitlin Huey
Talos overview of information-stealers
Aliza Johnson and Jonathan Munshaw
Talos Incident Response Q3 2022 Quarterly Recap
Gamaredon overview
Asheer Malhotra and Guilherme Venere
Gamaredon Overview (translated to Ukrainian)
Threat Advisory: DoubleZero (translated to Ukrainian)
Cisco stands on guard with our customers in Ukraine (translated to Ukrainian)
Protecting Major Events - An Incident Response Blueprint
Jerzy "Yuri" Kramars and Dr. Giannis Tziakouris
Ukraine Summary Report: Cisco Talos 2022 Year in Review
Cisco Talos 2022 Year in Review
APT Summary Report: Cisco Talos 2022 Year in Review
Threat Landscape Summary Report: Cisco Talos 2022 Year in Review
Ransomware and Commodity Loaders Summary Report: Cisco Talos 2022 Year in Review
Talos Incident Response Q1 2023 Quarterly Recap
Caitlin Huey and Jonathan Munshaw
Cybersecurity for businesses of all sizes: A blueprint for protection
Giannis Tziakouris & Jerzy ‘Yuri’ Kramarz
Threat Overview: Data theft extortion
Jacob Finn and Jonathan Munshaw
Hacktivism, explained
Lexi DiSchola and Jonathan Munshaw
Talos Incident Response Q3 2023 Quarterly Recap
Nicole Hoffman, Caitlin Huey and Jonathan Munshaw
Cisco Talos Incident Response Q1 2024 Quarterly Trends report
Nicole Hoffman