Library

Function Identification and Recovery Signature Tool

Angel M. Villegas

Subverting Operating System Properties through Evolutionary DKOM Attacks

Mariano Graziano, Lorenzo Flore, Andrea Lanzi, and Davide Balzarotti

ROPMEMU: A Framework for the Analysis of Complex Code-Reuse Attacks

Mariano Graziano, Davide Balzarotti, and Alain Zidouemba

Threat Spotlight: PoSeidon, A Deep Dive Into Point of Sale Malware

Talos

Deconstructing and Defending Against Group 72

Andrea Allievi, Joel Esler, Douglas Goddard, Shaun Hurley, Martin Lee, Craig Williams, and Alain Zidouemba.

Threat Spotlight: Cisco Talos Thwarts Access to Massive International Exploit Kit Generating $60M Annually From Ransomware Alone

Nick Biasini with contributions from Joel Esler, Warren Mercer, Melissa Taylor, and Craig Williams

Zeus Trojan Analysis

Alex Kirk

Threat Spotlight: Angler Lurking in the Domain Shadows

Talos

CryptoWall 4: The Evolution Continues

Andrea Allievi and Holger Unterbrink with contributions from Warren Mercer

Protecting Windows and Mac Users Against the “Kyle and Stan” Malvertising Network

Shaun Hurley, David McDaniel, and Armin Pelkmann

Content-Type Mismatch Detection

Alex Kirk

ROKRAT Whitepaper: A sophisticated malware campaign targeting South Korean government officials involved in reunification

Warren Mercer, Paul Rascagneres, Matthew Molyett

Take the RIG Pill Down the Rabbit Hole

By Holger Unterbrink, with contributions by Christopher Marczewski

Wiper Malware whitepaper

Vitor Ventura (@_vventura)

Cisco Talos Email Status Portal overview

Process Control through Counterfeit Comms: Using and abusing built-in functionality to own a PLC

Jared Rittle and Patrick DeSantis

List of bitcoin wallets in recent sextortion campaigns

Jaeson Schultz

List of malicious Facebook groups taken down by Cisco Talos

Jonathan Munshaw and Jaeson Schultz

The art and science of detecting Cobalt Strike

Nicholas Mavis

Emotet IOCs

Jaeson Schultz

Blocking cryptocurrency mining using Cisco Security products

Alex McDonnell, with contributions from Nicholas Mavis, Spenser Reinhardt, Josh Reynolds and Alan Smith

CISO Advisory: Government & Risk management

Martin Lee and Jon Munshaw

Cisco Advisory: Security architecture

Joe Marshall and Jon Munshaw

Data breach pay-for-homework document

What to expect when you're electing: Information hygiene and the human levels of disinformation

Azim Khodjibaev and Ryan Pentney

IR Quarterly Trends TAR Q4 2019 One Pager

Cisco Talos

IR Quarterly Trends TAR Q2 2020 One Pager

Cisco Talos

IR Quarterly Trends TAR Q1 2020 One Pager

Cisco Talos

Cisco Talos Incident Response Threat Assessment Report for Q3 2020

David Liebenberg, Kendall McKay, Jonathan Munshaw

What to expect when you're electing: What Talos learned after 4 years of research and hands-on experience

Matt Olney

What to expect when you're electing: The building blocks of political disinformation campaigns

Nick Biasini, Kendall McKay and Matt Valites

IR Quarterly Trends Q4 2020

David Liebenberg and Caitlin Huey

RAMBO: Run-time packer Analysis with Multiple Branch Observation

Xabier Ugarte-Pedrero, Davide Balzarotti, , Igor Santos, and Pablo G. Bringas

Talos' advice to election officials ahead of the 2020 election

Matthew Olney

One-pager: Examining Maze after its big year

David Liebenberg, Kendall McKay, Jonathan Munshaw

Cisco Talos Incident Response Threat Assessment Report for Q1 2021

Jonathan Munshaw

Interview with a LockBit ransomware operator

Azim Khodjibaev, Dmytro Korzhevin and Kendall McKay

Ryuk remains a formidable ransomware threat

Caitlin Huey, David Liebenberg, Kendall McKay and Jon Munshaw

Cisco Talos Incident Response trends from Winter 2020-21

Cisco Talos Incident Response Threat Assessment Report for Q2 2021

CTIR Case Study: Evicting Maze

Cisco Talos Incident Response

CTIR Case Study: Cobalt Strikes Out

Cisco Talos Incident Response

CTIR Emergency Response Service

CTIR

InSideCopy: How this APT continues to evolve its arsenal

Asheer Malhotra and Justin Thattil

SolarMarker overview

Jonathan Munshaw

ServHelper overview

Conti ransomware playbook translated to English

Talos Threat Intelligence and Interdiction Team

Overview of Operation: Armor Piercer

Talos Incident Response threat assessment report (Q3 2021)

Cisco Talos Incident Response Threat Assessment Report for Q4 2021

Jonathan Munshaw, David Liebenberg and Caitlin Huey

ZTE router vulnerability deep dive: How an attacker could exploit two vulnerabilities to gain full control

Marcin "Icewall" Noga

Executive guidance on the ongoing situation in Ukraine (translated to Ukrainian)

Overview of CyclopsBlink router malware (translated to Ukrainian)

Current Executive Guidance for Ongoing Cyberattacks in Ukraine (translated to Ukrainian)

Nick Biasini

Cisco Talos Incident Response Threat Assessment Report for Q1 2022

Threat advisory:Cybercriminals compromise users with malware disguised as pro-Ukraine cyber tools (translated to Ukrainian)

Chris Neal

Threat Advisory: HermeticWiper (translated to Ukrainian)

Asheer Malhotra

Threat Advisory: Opportunistic cyber criminals take advantage of Ukraine invasion (translated to Ukrainian)

Edmund Brumaghin

Threat Assessment Report: BlackCat ransomware

Threat Advisory: CaddyWiper (translated to Ukrainian)

Asheer Malhotra

Conti and Hive ransomware operations: Leveraging victim chats for insights

Kendall McKay, Paul Eubanks and Jaime Filson

Talos Incident Response Quarterly Threat Report (Q2 2022)

Caitlin Huey

Talos overview of information-stealers

Aliza Johnson and Jonathan Munshaw

Talos Incident Response Q3 2022 Quarterly Recap

Caitlin Huey

Gamaredon overview

Asheer Malhotra and Guilherme Venere

Gamaredon Overview (translated to Ukrainian)

Asheer Malhotra and Guilherme Venere

Threat Advisory: DoubleZero (translated to Ukrainian)

Asheer Malhotra

Cisco stands on guard with our customers in Ukraine (translated to Ukrainian)

Nick Biasini

Protecting Major Events - An Incident Response Blueprint

Jerzy "Yuri" Kramars and Dr. Giannis Tziakouris

Ukraine Summary Report: Cisco Talos 2022 Year in Review

Cisco Talos

Cisco Talos 2022 Year in Review

Cisco Talos

APT Summary Report: Cisco Talos 2022 Year in Review

Cisco Talos

Threat Landscape Summary Report: Cisco Talos 2022 Year in Review

Cisco Talos

Ransomware and Commodity Loaders Summary Report: Cisco Talos 2022 Year in Review

Cisco Talos

Talos Incident Response Q1 2023 Quarterly Recap

Caitlin Huey and Jonathan Munshaw

Cybersecurity for businesses of all sizes: A blueprint for protection

Giannis Tziakouris & Jerzy ‘Yuri’ Kramarz

Threat Overview: Data theft extortion

Jacob Finn and Jonathan Munshaw

Hacktivism, explained

Lexi DiSchola and Jonathan Munshaw

Talos Incident Response Q3 2023 Quarterly Recap

Nicole Hoffman, Caitlin Huey and Jonathan Munshaw

Cisco Talos Incident Response Q1 2024 Quarterly Trends report

Nicole Hoffman