Threats tagged 'cisco'

Cisco has disclosed a maximum-severity zero-day vulnerability (CVE-2026-76460) in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products. This flaw allows remote attackers to bypass authentication via a crafted request to an API endpoint, regardless of configuration. The vulnerability is actively exploited in the wild, enabling unauthorized access to affected devices through the web-based management interface. Cisco has released patches for multiple ISE versions to remediate this issue. No workarounds exist, and Cisco strongly recommends immediate patching. Indicators of compromise include suspicious usernames in access logs and unusual network activity. The Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to patch this vulnerability within three days. Additional related critical vulnerabilities have also been patched but are not yet known to be exploited.

A critical authentication bypass vulnerability (CVE-2026-76460) in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows remote unauthenticated attackers to bypass authentication via crafted API requests. This zero-day flaw has been actively exploited in the wild, enabling attackers to gain unauthorized access to the device's management interface and execute commands with root privileges. Cisco has released urgent patches for multiple versions and recommends upgrading immediately. No workarounds exist except restricting traffic via infrastructure ACLs. The US CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging rapid patching.

Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...]

A SQL Injection vulnerability has been identified in Cisco Secure Email Gateway, affecting both physical and virtual devices regardless of configuration. Specific vulnerable versions include 13.0, 13.0.0-392, and 13.0.5-007. No CVSS score or detailed impact information is provided. No known exploits in the wild have been reported. The vendor advisory references a fixed software section for details on patched versions.

Cisco Talos disclosed a complex WebDAV infection chain linked to a Russian threat actor (UAT-10820) targeting a Ukrainian government organization. The campaign delivers the Amatera stealer along with secondary payloads such as ZigCryptoStealer and NetSupport Manager. This operation appears opportunistic and broad-based, focusing on cryptocurrency and credential theft rather than a highly targeted attack. Attackers use creative delivery and evasion techniques, including abusing legitimate infrastructure like the BNB Smart Chain for bulletproof hosting and fake CAPTCHA prompts to bypass web filters. Secondary payloads include a vulnerable driver to terminate endpoint detection and response (EDR) software and unauthorized remote access tools, enabling persistent control over infected systems. Security teams are advised to monitor for unusual WebDAV activity and suspicious DLL execution via rundll32.exe ordinal calls, educate users about fake verification prompts, and ensure endpoint solutions have robust memory scanning capabilities. No patch information is provided for this threat. The disclosure also includes a broader discussion on cybersecurity workforce mental health but is unrelated to the technical threat.

Two recently patched vulnerabilities in Cisco Secure Firewall Management Center (FMC) have been exploited by multiple threat clusters linked to ransomware and state-sponsored attacks. CVE-2026-20079 is a critical authentication bypass vulnerability with a CVSS score of 10.0, allowing unauthenticated remote root access. CVE-2026-20316 involves static credentials for a low-privileged account and has a CVSS score of 5.3 but can be combined with other flaws for privilege escalation. Exploitation has led to deployment of web shells, credential theft, reverse shells, proxies, and malware including Qilin ransomware and Cyclops Blink backdoor. Cisco has released hotfixes for both vulnerabilities and plans further hardening patches. The attacks highlight significant post-compromise activity by ransomware affiliates and a Russian state-sponsored group known as Sandworm.

An investigation revealed a sophisticated cryptocurrency and credential-stealing operation using Amatera stealer as the primary payload. The attack chain leverages Cloudflare Workers to inject JavaScript stored on BNB Smart Chain, presenting fake Google CAPTCHA prompts that lead to WebDAV-based DLL execution. Two parallel infection chains were identified, one loading through a DLL named 'pf.ch' and another through 'verification.google', both delivering Amatera stealer with different secondary payloads. The 'pf.ch' variant deployed ZigCryptoStealer via NativeAOT loader and a Go-based reverse proxy, while the 'verification.google' variant installed NetSupport Manager with C2 infrastructure in Russia. The operation affects numerous countries with primary focus on stealing cryptocurrency wallets, credentials from password managers, and various authentication data through extensive collection rules targeting over 400 applications.

Malware#windows#ciscoUnited States+5

Cisco Talos is tracking a cryptocurrency theft campaign that abuses the Google Visualization API to deliver obfuscated JavaScript from Google Sheets, which victims are socially engineered to inject into their browser sessions. The attack uses a variation of ClickFix social engineering, convincing targets to paste malicious JavaScript into the Chrome address bar or install it via the Tampermonkey extension for persistence. The malicious script acts as a web skimmer, hooking the browser's fetch API to replace cryptocurrency deposit addresses and manipulate clipboard contents, deceiving users with fake bonus interfaces. The campaign targets users on cryptocurrency and hacking forums with a lure about a nonexistent API vulnerability to entice quick financial gain. The actors moved their hosting to Google Docs and Sheets after disruptions on paste sites. While this campaign primarily targets individuals, the techniques used could be adapted for broader supply-chain or web-based attacks.

This content is an analytical discussion from Cisco Talos about the challenges in producing actionable threat intelligence and the operational hurdles posed by AI safety guardrails in cybersecurity defense. It highlights how AI models with restrictive guardrails can impede legitimate forensic and defensive tasks, while adversaries exploit unconstrained AI models for attacks. The piece emphasizes the need for security teams to regain control over AI capabilities to maintain an advantage against attackers. It also shares insights into adversary engagement and the human factors influencing cybercriminal behavior.

Cisco disclosed multiple vulnerabilities affecting its Secure Email product, IOS XR, Nexus 9000 series switches, and certain IP phone devices. Two medium-severity flaws in Secure Email's S/MIME decryption could allow attackers to intercept and obtain plaintext from encrypted emails. Critical vulnerabilities in IOS XR and Nexus switches could enable remote code execution, authentication bypass, and code injection. Additionally, a high-severity denial-of-service vulnerability affects Cisco IP phones using SIP. Cisco has released patches for the IOS XR, Nexus switches, and IP phone vulnerabilities, but the Secure Email flaws remain unpatched. No active exploitation has been reported for any of these vulnerabilities.

Researchers have identified a new tactic used by the Chinese Fire Ant threat actor involving Cisco IOS XR routers. The attackers create unauthorized GRE tunnel interfaces on affected routers, which do not correspond to any legitimate configuration or commit history. This technique allows the compromised routers to be leveraged as spying platforms. No specific affected versions or patches have been disclosed. There is no confirmed active exploitation in the wild at this time.

Cisco research reveals that AI model country-of-origin labels do not reliably indicate the model's true technical lineage or inherited behaviors. AI models often incorporate upstream dependencies through fine-tuning on existing checkpoints, causing them to inherit weights, biases, or behaviors from models originating in different countries. This phenomenon, called provenance entanglement, complicates risk assessment based solely on the labeled country of origin. Cisco suggests that AI models require a form of Software Bill of Materials (SBOM) to disclose lineage and dependencies for better security and regulatory oversight. The research highlights the need for transparency in AI model development to identify potential inherited vulnerabilities or biases.

This content discusses the security implications of AI guardrails in security operations centers (SOCs). It highlights how poorly designed or externally controlled AI safety filters can inadvertently aid attackers by slowing or halting incident investigations. The article emphasizes the importance of operational sovereignty, allowing organizations to customize and control AI guardrails to fit their threat models and maintain effective response capabilities.

This analysis discusses the challenges and considerations in selecting large language models (LLMs) for security operations center (SOC) and digital forensics and incident response (DFIR) workflows. Cisco Talos evaluated 66 model and reasoning combinations from Anthropic and OpenAI on a synthetic log analysis task to assess effectiveness, cost, time, and consistency. The study found no single best model; instead, organizations should balance investigative quality with cost, speed, and consistency requirements. The findings emphasize that higher reasoning effort does not always improve results and that consistency is a critical factor in model selection.

The flaws could lead to remote code execution, authentication bypasses, and path traversal attacks. The post Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities appeared first on SecurityWeek .

UAT-10147 is a sophisticated Chinese-speaking intrusion actor deploying a cross-platform backdoor named SPECTRE targeting IIS and Linux servers. SPECTRE integrates advanced post-exploitation features including process injection, credential theft, anti-analysis, and kernel-level EDR bypass via Bring Your Own Virtual Driver (BYOVD) techniques. The campaign combines SEO fraud monetization with custom malware, open-source tools, and AI-assisted development workflows. The Windows variant of SPECTRE uses runtime API resolution and string encryption to evade static detection and includes a comprehensive command set for system control and persistence. The Linux variant incorporates a kernel rootkit with similar advanced capabilities. The actor also uses in-memory web shells and sophisticated evasion methods. No patch or remediation is indicated in the available data.

Cisco Talos identified a Chinese-speaking cybercrime group, UAT-10147, conducting large-scale attacks against Windows and Linux web servers globally. The group exploits publicly disclosed vulnerabilities to gain initial access and integrates AI-driven tools to automate exploitation, reconnaissance, payload generation, validation, and persistence. Targets include organizations in government, education, media, technology, and gaming sectors across Brazil, Bolivia, China, Canada, and Vietnam. The actor deploys malware for SEO fraud and data theft, using multiple open-source offensive frameworks and privilege escalation tools. The infection chains involve multi-stage scripts that evade detection and establish persistence via backdoors and rogue accounts. Talos assesses this as a financially motivated campaign leveraging semi-autonomous AI orchestration to scale complex intrusions efficiently.

Campaign#windows#linuxBrazil+4

Welcome to this week’s edition of the Threat Source newsletter. “Experiment is the mother of knowledge.” ― Madeleine L'Engle, A Wrinkle in Time “Don't slide down the rabbit hole. The way down is a breeze, but climbing back's a battle.” ― Kate Morton, The Clockmaker's Daughter Hacker Summer Camp has come and gone, which means it’s time for you to start planning next year’s trip. I’m surely going to recap Camp Season, right? Nope. One of the things that I’ve really enjoyed lately is a segment on the Beers with Talos podcast that we call “Make Hazel a Hacker.” If you haven’t listened to it, this is a perfect time to start. Each episode we take a few minutes and pose a security question, term, or concept to Hazel and force her to come up with an idea or explanation on the spot. There are no parameters, so she’s faced with the entirety of information security — past, present, and future. I know, it’s insane. The craziest part is that (I think) Hazel came up with this idea and still volunteered to put herself in the line of fire. As we put Hazel’s feet to the fire, one of my favorite things happens: The rest of us listen in and offer our thoughts during her brainstorming process. Invariably, we’ve got three very different answers, ideas, hints, or directions for her. It’s surely maddening for Hazel, but to me, the best part of the discussion that inevitably follows is that although they’re all different, they’re all correct. For example, this past episode I asked her about a behavioral indicator (regarding “wallpaper.bmp”) that seems benign on its own, but can be interesting to use as a pivot for a threat hunt. We had various interesting angles to consider, backed by years of knowledge and experience. It gave us a good conversation, and that was a .bmp! One of the most nebulous things to learn in this field is that multiple things can be both different and correct. When you are making your decisions this week — whether it’s deciding on a new pivot in your hunting, what devices to prioritize in your patching and updating, or which books or online training to focus on — take a quick second and get a second, third, and fourth opinion. Then try something that’s outside of your normal wheelhouse but sounds good when it’s proposed. None of this is a solo sport. It’s a team game and the best plays come from a mix of perspectives, experiences, and mistakes. The “right” answer can wear many faces, and your ability to hold different truths will lead you to undiscovered territory, the rabbit hole where anomaly lives and breathes. So... welcome back from Vegas. Now go down a rabbit hole on a path you wouldn’t normally take because one of your friends (Joe) or your mortal enemy (Dave) told you that it would work. “She'd been to Narnia, Wonderland, Hogwarts, Dictionopolis. She had tessered, fallen through the rabbit hole, crossed the ice bridge into the unknown world beyond.” ― Anne Ursu, Breadcrumbs The one big thing Cisco Talos recently discovered "JWR," a previously undocumented, real-time phishing framework and likely variant of "The Outsider" phishing-as-a-service platform. JWR uses an open WebSocket connection that allows attackers to monitor keystrokes live and dynamically steer victims through fake checkout and login flows. Currently deployed via SMS lures impersonating regional toll and postal authorities, JWR enables operators to steal payment data, 2FA codes, identity documents, and device fingerprints. Why do I care? Because JWR is operator-driven in real time, attackers can actively bypass multi-factor authentication (MFA) by prompting victims for 2FA codes exactly when needed. The sheer volume of collected data gives threat actors a comprehensive identity profile primed for extensive follow-on fraud and network compromise. Furthermore, JWR's seamless integration with legitimate e-commerce platforms like Shopify makes these lures incredibly convincing to the untrained eye. So now what? Prioritize user education around SMS-based phish…

Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms. The client engine of the JWR phishing framework is a real-time, operator-driven system that, rather than merely logging form submissions like a static credential-stealing page, keeps an AES-CTR encrypted WebSocket open to the threat actor so they can steer each victim's session live. The victim data targeted by the actor using JWR extends well beyond payment data, encompassing identity documents, Social Security numbers, passport and driver's license images, website and PayPal credentials, 2FA codes, and full device fingerprints, all committed to the actor's server once a session ends. Talos assesses with medium confidence that the JWR phishing framework is a variant of "The Outsider," a phishing-as-a-service (PhaaS) platform, based on several similarities in the client engine scripts and functionalities of the two PhaaS platforms. Talos observed a real-world campaign delivering the JWR client via SMS lures impersonating toll authorities, and postal and courier services of several countries in Southeast Asia and the Middle East. JWR phishing framework, a likely variant of the Outsider JWR is a phishing framework capable of harvesting complete payment card data, login credentials, and personally identifiable information (PII) documents and images in real time. The client-side engine of the framework impersonates login, and checkout flows of several payment gateways, including Shopify, PayPal, Apple, Klarna, and banks, while allowing the operator to stealthily control the victim session through an AES-CTR encrypted WebSocket channel. The client engine architecture is divided into a Host Bridge module that relays commands into a phishing inline frame (iframe) and a Vue.js victim application that renders across 44 phishing pages, streams the victim's keystrokes to the actor as they are typed, and carries out more than 40 distinct instructions issued from the command-and-control (C2) console. The data exfiltration schema is a cvvform object that includes fields such as credit card number, CVV, PIN, expiry date, Social Security Number (SSN), passport or ID images, two-factor authentication (2FA) codes, website logins, PayPal credentials, and device fingerprint. Talos discovered that the JWR client engine shares significant code and functional similarities with the client of The Outsider PhaaS platform operated by the Chinese-speaking actor “Outsider Enterprise,” which was reported by external researchers . JWR client architecture and workflow Figure 1. JWR phishing framework’s client engine architecture and execution flow. The execution starts when the parent phishing webpage loads and executes the client's engine. It checks a single global flag, window.__HOST_MODE , which is set by the parent phishing page, and selects one of two execution modes. If the flag is set, the script enters Host Mode, and control passes to the Host Bridge module, an immediately invoked function expression (IIFE) that operates within the parent page, typically a replica of a legitimate checkout or account login page, relaying received details into a child iframe that contains the actual phishing form. It establishes a persistent WebSocket connection to the actor’s C2 server. If the flag is not set, the page enters Content Mode, and control passes to the Vue.js Application, an interactive front end that renders the phishing pages, collects victim input, manages the flow across 44 HTML files, and handles the actor’s instructions from the C2 server, ultimately redirecting to a custom error page after sending the data to the C2. The Content Mode of execution has three communication modes: standalone, pluginIframe, and hostIframe. In standalone mode, the application fully owns its WebSocket connection. In pluginIframe mode, it has no direct link to t…

Cisco has issued a warning about a high-severity denial-of-service (DoS) vulnerability affecting Secure Firewall ASA and Threat Defense (FTD) software. This flaw is actively exploited in the wild to remotely crash affected devices, disrupting their operation. The vulnerability impacts VPN functionality on these Cisco products. No specific affected versions or patch information is provided in the available data.