Top all-time · #489
Cisco Talos Blog
Company blog · blog.talosintelligence.comsecurity
Cisco Talos Blog is the company blog at blog.talosintelligence.com, writing about security. Since 2017, 118 different Hacker News readers have linked it 150 times, most often “New VPNFilter malware targets 100,000s of networking devices worldwide”. It is still writing: the last post was on 2026-10-31, and you can follow it by feed.
Talos intelligence and world-class threat research team better protects you and your organization against known and emerging cybersecurity threats.
Most-linked posts?
- New VPNFilter malware targets 100,000s of networking devices worldwide7 people · 7 mentions · first linked 2018-05-23
- DNS Hijacking Abuses Trust in Core Internet Service6 people · 7 mentions · first linked 2019-04-17
- Recent Cyberattack on Cisco5 people · 5 mentions · first linked 2022-08-10
- Cisco's Talos team analysis of WannaCry worm4 people · 5 mentions · first linked 2017-05-12
- Apache Struts 0-day4 people · 4 mentions · first linked 2017-03-08
- Two vulnerabilities in Zoom could lead to code execution4 people · 4 mentions · first linked 2020-06-03
- /2018/05/VPNFilter.html?m=13 people · 3 mentions · first linked 2018-05-24
- ArcaneDoor – New campaign found targeting network devices3 people · 3 mentions · first linked 2024-04-24
- Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware3 people · 3 mentions · first linked 2023-05-27
- Olympic Destroyer Takes Aim at Winter Olympics2 people · 2 mentions · first linked 2018-02-13
What Hacker News says?
No. There's no check for Cydia or other Debian Package frontends that are there to void your warranty or stop you from downloading cracked apps (they very well could do this). They only patch the security vulnerabilities that are actually used to break out of the app sandbox and run arbitrary code, something that, as we can see with Epic's Fortnite app, could be RCE'd into an app without Apple knowing. These vulnera…
Comment linking /2019/10/checkrain-click-fraud.html
on “Apple just kicked Fortnite off the App Store”Submitted Malware identified in CCleaner 5.33 as a story · 675 points
HN discussionShadowbrokers claiming blame: https://twitter.com/0xSpamTech Analysis here: http://blog.talosintelligence.com/2017/05/wannacry.html
Comment linking /2017/05/wannacry.html
on “Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool”Submitted Two vulnerabilities in Zoom could lead to code execution as a story · 259 points
HN discussionCisco's TALOS team just published an analysis: http://blog.talosintelligence.com/2017/05/wannacry.html
Comment linking /2017/05/wannacry.html
on “Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool”Submitted Malware uses LLMs to rank victims by how much they're worth as a story · 257 points
HN discussionThat's not correct - more than 1/3 of initial access is by phishing at present, according to Cisco Talos (and others major security publications largely agree with this). Ref: https://blog.talosintelligence.com/ir-trends-q1-2026/ What you may be confusing with is the number of incidents involving token theft, which is often facilitated by phishing.
Comment linking /ir-trends-q1-2026/
on “Passkeys are a trap”Submitted Cisco's Talos team analysis of WannaCry worm as a story · 179 points
HN discussionGood riddance! Source for statement: http://blog.talosintelligence.com/2018/02/coinhoarder.html
Comment linking /2018/02/coinhoarder.html
on “Google bans cryptocurrency ads”Submitted De-anonymizing ransomware domains on the dark web as a story · 153 points
HN discussionCould be concerning, see https://blog.talosintelligence.com/2019/04/seaturtle.html
Comment linking /2019/04/seaturtle.html
on “ Let's Encrypt makes certs for 30% of web domains”Submitted ArcaneDoor – New campaign found targeting network devices as a story · 72 points
HN discussionX.org: https://www.cvedetails.com/cve/CVE-2018-14600/ MacOS: https://blog.talosintelligence.com/2016/07/apple-image-rce.h... What do you use?
Comment linking /2016/07/apple-image-rce.html
on “Windows code-execution zeroday is under active exploit, Microsoft warns”Submitted IPv6 Address Unmasking via UPnP as a story · 66 points
HN discussionIt's called a watering hole attack. You infect many of the devices way ahead of time (that are interested in whatever subject area you targeted), and pick your victim when you need to. If you haven't prosecuted these cases, you'd be surprised how often it happens: https://www.cyberscoop.com/winter-olympics-hack-attribution-... https://krebsonsecurity.com/2017/08/blowing-the-whistle-on-b... https://blog.trendmicro.co…
Comment linking /2018/02/who-wasnt-responsible-for-olympic.html
on “Guccifer 2.0 Slipped Up and Revealed He Was a Russian Intelligence Officer”Submitted CCleaner Command and Control Causes Concern as a story · 43 points
HN discussionI'm not a reverse engineer or a white hacker but I like reading about it. Most of the malware is made for Windows OS because of the Windows' enormous market share. Majority of information about Windows malware I get from big computer security companies' research blogs like: https://www.trendmicro.com/en_us/research.html https://www.proofpoint.com/us/blog https://research.checkpoint.com/ https://blog.talosintelligenc…
Comment linking /
on “Many ransomware strains will abort if they detect a Russian keyboard installed (2021)”Submitted AI Malware Is Here: New Report Shows How Fake AI Tools Are Spreading Ransomware as a story · 39 points
HN discussionFeds take aim at potent VPNFilter malware allegedly unleashed by Russia. [..] to counter Russian-engineered malware that has infected hundreds of thousands devices. I'm interested in the evidence for this attribution. Both ars and dailybeast [0] are pointing to Russia, but the only specific hints are that it's targeting Ukraine (which might also have to do with the prevalence of vulnerable devices there, we don't kn…
Comment linking /2018/05/VPNFilter.html
on “FBI tells router users to reboot now to kill malware infecting 500k devices”Submitted Fingerprint Cloning: Myth or Reality? as a story · 31 points
HN discussionA factory reset, according to Cisco, will fix it. Correction: according to the original report a reset will mitigate the stage 2 and 3 attack only Source: https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=...
Comment linking /2018/05/VPNFilter.html?m=1
on “FBI tells router users to reboot now to kill malware infecting 500k devices”Submitted Remote code execution vulnerabilities in Cosori smart air fryer as a story · 23 points
HN discussionThis (as far as I know) was one of hte first reports of details of the malware and clearly mentions it, and other analysts haven't said otherwise, which by now they would have if they disagreed: http://blog.talosintelligence.com/2017/05/wannacry.html
Comment linking /2017/05/wannacry.html
on “Lessons from last week’s cyberattack”Submitted New VPNFilter malware targets 100,000s of networking devices worldwide as a story · 12 points
HN discussionPasskeys are fantastic! I encourage my family and friends to utilize them as an alternative to passwords whenever possible. Compared to everything else, they are so much of a nicer experience. I despise the "click the link we just emailed you" so much . And MFA is a pain, and still has security issues: https://blog.talosintelligence.com/state-of-the-art-phishing... I really don't get all the hate for Passkeys on HN.…
Comment linking /state-of-the-art-phishing-mfa-bypass/
on “The cryptography behind passkeys”Submitted Vulnerability Spotlight: Python.org certificate parsing denial-of-service as a story · 11 points
HN discussionBy exposing vulnerable graphics drivers to arbitrary web code, WebGL has allowed websites to take screenshots of your desktop ( https://www.mozilla.org/en-US/security/advisories/mfsa2013-8... ) and break out of virtual machines ( https://blog.talosintelligence.com/nvidia-graphics-driver-vu... ), to use two examples I found via a web search.
Comment linking /nvidia-graphics-driver-vulnerability-roundup/
on “WebGPU is now available on Android”Submitted VPNFilter Update – VPNFilter exploits endpoints, targets new devices as a story · 8 points
HN discussion> What I've never understood is how this doesn't ultimately just shift the security risk to my DNS registrar. > Instead of social-engineering the CA to give me a cert, I have to social-engineer the registrar to store a TXT record. I don't see why one should be significantly harder than the other. Rogue registrars aren't necessary: one can simply attack the registrar or interfere with the DNS traffic. These attacks h…
Comment linking /2019/04/seaturtle.html
on “Safari will no longer trust certs valid for more than 13 months”Submitted Recent Cyberattack on Cisco as a story · 6 points
HN discussion
