Salt Typhoon logged into telecom network gear with stolen credentials in all but one case Talos examined
Cisco Talos's February 2025 analysis of Salt Typhoon's telecom intrusions found the actor used stolen legitimate logins on Cisco devices in all but one case. It then pulled more logins from weakly encrypted router configs and captured TACACS and RADIUS keys, so credentials stored on network gear are the first exposure for defenders to close.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence66
Fake event invites route Taiwan research staff through a live Google login proxy
Cisco Talos tracks UAT-11985, an APT sending Taiwan research affiliates fake event invites that lead to a Google login proxy capturing MFA codes. The proxy relays entries to Google in real time, so a code typed into the fake page reaches the attacker first.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence60
Cisco Talos and Recorded Future tie a June 2025 to August 2026 campaign against CIS governments to UAT-6275. Talos rates its Kazakhstan nexus at medium confidence, and Recorded Future tracks the same activity as TAG-193.
Perspective Coverage
4 publishers
- Builder
- Builder 15%
- Operator
- Operator 56%
- Investor
- Investor 29%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+8
- Incentives35
- Confidence66
Talos reports CVE volume up 105% on the year against 37% growth in CISA's KEV catalog
Cisco Talos counts more than 70,000 CVEs by the end of September, up 105% on a year earlier, while CISA's KEV catalog grew 37%. Its newsletter says the backlog of exploited bugs from older CVEs is where the patching work sits.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap−15
- Incentives
- Not scored
- Confidence50
Malware's best tricks against AI analysis tools worked in about 35% of Talos test runs
Cisco Talos says the best text that malware authors plant to steer AI analysis tools tipped results their way in about 35% of test runs. The text has to sit in plaintext, so each attempt also gives defenders a string to hunt for.
Reality
- Evidence55
- Adoption25
- Hype gap+5
- Incentives40
- Confidence55
Templated event invites and doctored posters lure Taiwan researchers into a live Google login relay
Cisco Talos says UAT-11985 used fake event invitations to phish Taiwanese research staff through a kit that relays Google logins and MFA challenges live. For the people those invitations target, the useful control is a second factor the relay cannot pass along.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+5
- Incentives35
- Confidence55
Talos discloses eight patched flaws, including two Foxit Reader code-execution bugs
Cisco Talos disclosed eight vendor-patched flaws in Foxit Reader, Windows, Photoshop's installer and macOS CoreWLAN. The two Foxit Reader bugs reach code execution from an attacker's file, so Reader is the update to confirm on endpoints first.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+5
- Incentives35
- Confidence60
buildOne report1 publisher Cisco's CVSS 10 firewall-manager bypass is now being exploited to run code as root
Cisco confirmed on September 9 that attackers are exploiting a CVSS 10.0 bypass in its Firewall Management Center to run code as root. CISA added it to its Known Exploited Vulnerabilities list the same day, with a three-day deadline for federal agencies.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence64
Cisco Talos links China-nexus UAT-11587 to 16 affected or targeted institutions in eight Asian countries, via a backdoor run through Microsoft 365. Its commands move through Outlook and OneDrive via Microsoft Graph, so defenders have no command server to block.
Perspective Coverage
3 publishers
- Builder
- Builder 32%
- Operator
- Operator 63%
- Investor
- Investor 5%
Reality
- Evidence62
- Adoption30
- Hype gap+8
- Incentives
- Not scored
- Confidence65
buildOne report1 publisher Qilin ransomware affiliate logged into Cisco firewall management with a credential scored 5.3
Cisco Talos says three threat clusters are exploiting a CVSS 10.0 pre-auth root bypass and a 5.3 hard-coded credential in Secure Firewall Management Center. A patch policy with a severity cutoff above 5.3 would have skipped the credential fix on the console that pushes policy to every managed firewall.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence55
Cisco Talos found a 16.4MB Go implant that asks DeepSeek, Qwen, Mistral and Gemini what to do next and acts on the winning vote, treating the providers themselves as its C2 infrastructure. Talos has no confirmation it was ever deployed.
Perspective Coverage
7 publishers
- Builder
- Builder 28%
- Operator
- Operator 66%
- Investor
- Investor 6%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+30
- Incentives45
- Confidence62
Ontinue says the Python implant takes tasking from SharePoint dead drops over Graph API, relays interactive sessions through Teams TURN, and moves all of it through the victim's own headless Edge.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+20
- Incentives40
- Confidence60
Cisco Talos says a Chinese-speaking crew paired PentestGPT and DeepAudit with Metasploit and a 170,000-URL target list to compromise web servers at scale. Every entry flaw named is years old.
Reality
- Evidence62
- Adoption20
- Hype gap+30
- Incentives65
- Confidence62
Talos describes $300 'consultancy' calls that screen security staff for insider access
Talos says a $300 offer for an hour's phone consultation is the first stage of a con that screens security practitioners for useful access. Targets who pass end up paid to pull non-public material from co-workers and internal systems.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence40
CVE-2026-20079 hands unauthenticated attackers root on Secure Firewall Management Center. CISA wants federal boxes fixed by September 12. The hot fix closes the path but does not evict anyone who already walked it.
Perspective Coverage
6 publishers
- Builder
- Builder 23%
- Operator
- Operator 65%
- Investor
- Investor 12%
Reality
- Evidence80
- Adoption
- Not scored
- Hype gap+15
- Incentives60
- Confidence74
Thirteen npm packages ship a stripped-down stealer that uploads Chrome's extension storage wholesale
OpenSourceMalware says WeaselBiscuit borrows functions from DPRK's BeaverTail and OtterCookie but strips out the persistence and the wallet drainer. It runs from memory on an npm import and takes Chrome's extension storage.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
Gambit says a single actor pointed the Strix, Cairn and Hermes agent frameworks at online retailers from July onward, taking more than 600,000 valid card records from two victims and leaving skimmers on 119 sites.
Reality
- Evidence58
- Adoption62
- Hype gap+14
- Incentives62
- Confidence60
Eclypsium finds the month's exploited infrastructure flaws again in the management consoles
Eclypsium tracked 158 infrastructure advisories between August 25 and September 17. The exploited maximum-severity flaws it highlights are authentication bypasses in Cisco's Firewall Management Center and Identity Services Engine.
Reality
- Evidence62
- Adoption72
- Hype gap+14
- Incentives65
- Confidence58
buildOne report1 publisher Talos finds a Windows implant that puts each attack step to a four-LLM vote
Cisco Talos read CLOSEDQUORUM statically: a Go binary that polls DeepSeek, Qwen, Mistral and Gemini before it touches LSASS. The distributed sample has dummy keys. One answering provider can carry the vote.
Reality
- Evidence58
- Adoption8
- Hype gap+25
- Incentives60
- Confidence55
Cisco Talos finds malware that hands its command-and-control decisions to four voting models
Cisco Talos says its CLOSEDQUORUM sample asks four language models for executable decisions, tallies the votes and acts on the winner. An entire phase of the attack runs while the operator is offline.
Reality
- Evidence50
- Adoption8
- Hype gap+40
- Incentives62
- Confidence54