Tag: cisco
-
VOLTA, the infostealer that asks an AI which victims are worth the effort
VOLTA is an AI-powered infostealer that steals personal data, then uses LLMs to assess victims’ value and rank targets for attackers. Cisco Talos has analyzed a new Windows infostealer called VOLTA, which calls itself VOLTA-AUTODOXER. It steals the usual data, then hands the loot to a large language model that ranks what the victim is…
-
AI-powered infostealer picks out the most profitable parts of your stolen data
A new Windows infostealer sends the data it steals to an AI model and asks it to rank the victim’s assets by how much money they could bring in, Cisco Talos has found. “There … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/02/ai-powered-infostealer-volta-victim-profiling/
-
U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-97229 is a critical security flaw that could let attackers run code on…
-
New AI-Powered NIK C2 Malware Uses OpenAI API to Help Hackers Steal Data and Control Windows PCs
Cisco Talos has uncovered NIK C2, a Go-based, 64-bit Windows remote access tool that embeds a working OpenAI client. Operators can send prompts through an infected machine and read the model’s replies in their C2 panel. NIK C2 malware According to technical research published by Cisco Talos, the implant talks to its server over TLS-secured…
-
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
Tags: cisa, cisco, cve, cybersecurity, dos, exploit, firewall, flaw, gitlab, infrastructure, kev, rce, remote-code-execution, software, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.The vulnerabilities are listed below – CVE-2026-97229 (CVSS score: 10.0) – An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise First seen on…
-
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
Tags: cisa, cisco, cve, cybersecurity, dos, exploit, firewall, flaw, gitlab, infrastructure, kev, rce, remote-code-execution, software, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.The vulnerabilities are listed below – CVE-2026-97229 (CVSS score: 10.0) – An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise First seen on…
-
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/
-
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/
-
Cisco Talos Uncovers KeyDrift Malware Targeting SD-WAN Controllers to Steal Network Encryption Keys
Tags: access, cisco, communications, control, cyber, defense, encryption, framework, malware, network, service, technology, threatUAT-11473, an advanced persistent threat actor deploying KeyDrift, a custom malware framework targeting Cisco Catalyst SD-WAN controllers. The framework embeds inside legitimate control-plane processes to maintain access, intercept decrypted communications, and extract sensitive network encryption material. Observed targets span space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence…
-
New Cisco firewall zero-day exploited to crash SSL VPN devices
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/
-
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild.The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to…
-
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.” First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/
-
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization’s SD-WAN network.The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical…
-
Cisco Patches Actively Exploited SSL VPN Vulnerability Affecting ASA and FTD Firewalls
Cisco has released security updates that address a critical vulnerability in the Remote Access SSL VPN service on its Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. This vulnerability, tracked as CVE-2026-76418, lets unauthenticated attackers trigger unexpected device reloads, causing a denial of service. The flaw is categorized as high severity, with…
-
Cisco Talos Uncovers 1,400 Scam Emails Sent Through Staples and Dell Order Notification Systems
Cisco Talos identified roughly 1,400 scam emails delivered through legitimate Staples and Dell order notification systems, exposing how attackers can insert fraudulent support instructions into authenticated transactional messages. The findings fit a wider pattern: Talos observed abuse across more than 25 legitimate platforms over the past year, including collaboration, productivity, payments, file sharing, surveys, and…
-
Cisco Talos Uncovers 1,400 Scam Emails Sent Through Staples and Dell Order Notification Systems
Cisco Talos identified roughly 1,400 scam emails delivered through legitimate Staples and Dell order notification systems, exposing how attackers can insert fraudulent support instructions into authenticated transactional messages. The findings fit a wider pattern: Talos observed abuse across more than 25 legitimate platforms over the past year, including collaboration, productivity, payments, file sharing, surveys, and…
-
Critical Cisco Expressway Flaw Lets Attackers Execute Commands as Root
Cisco has released security updates to address a critical vulnerability in its Expressway Series. This flaw, tracked as CVE-2026-76466, could allow unauthenticated remote attackers to execute arbitrary operating system commands with root privileges. It has a CVSS v3.1 base score of 9.8 and affects vulnerable Expressway deployments configured in a cluster. The advisory was published…
-
Scammers Exploit Dell and Staples Order Emails to Bypass Traditional Phishing Detection
Tags: authentication, cisco, cyber, detection, email, exploit, infrastructure, malicious, phishing, scamScammers are abusing legitimate Dell and Staples order notifications to deliver callback phishing lures, embedding fraudulent helpline numbers inside transactional emails that pass authentication checks. Cisco Talos observed roughly 1,400 messages across two campaigns, highlighting how trusted retail infrastructure can carry attacker-controlled instructions without relying on spoofed senders or malicious links. The activity extends a…
-
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/
-
Compromised eMudhra intermediate certificates
Tags: ciscoCisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/compromised-intermediate-certificates/
-
Two critical RCEs in PHP core
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/two-critical-rces-in-php-core/
-
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of collaboration, file-sharing, payment and other services to reach their targets. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/
-
EUVD-2026-101420 / CVE-2026-76519 – Schwachstelle im Malware-Schutz von Cisco wird ausgenutzt
First seen on security-insider.de Jump to article: www.security-insider.de/cisco-secure-email-gateway-amp-schwachstelle-aktive-angriffe-a-5ddea88b41df727cb097967fa8f2f4a9/
-
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs
-
Warnung des BSI: Angriffe auf Zero-Day-Lücke in Cisco Secure Email Gateway
Der Malware-Scanner von Ciscos Secure Email Gateway reagiert fehlerhaft auf speziell gestaltete E-Mails. Hacker erhalten so Root-Rechte. First seen on golem.de Jump to article: www.golem.de/news/warnung-des-bsi-angriffe-auf-zero-day-luecke-in-cisco-secure-email-gateway-2610-214183.html
-
U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog
Tags: cisa, cisco, cybersecurity, email, exploit, flaw, infrastructure, kev, network, threat, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Cisco confirmed this week that threat actors are exploiting a critical vulnerability…
-
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia. The targets include the…
-
Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
Cisco has warned that attackers are actively exploiting a zero-day flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An unauthenticated remote attacker can use it to write arbitrary files and run commands as root on the underlying operating system. The advisory, cisco-sa-esa-afw-zqYJkjxp, says Cisco PSIRT learned of active exploitation in…
-
CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322, a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/15/cve-2026-0322-cve-2026-76519-cve-2026-105133-cve-2026-105134-exploted/