More than 3,400 servers have been compromised by malware that hides its infrastructure coordinates in a poem.

Part 1 of this week's saga can be found here. This research is a glimpse into the capabilities that power our Preemptive Exposure Management solution, enabling organizations to rapidly react to emerg...

God damn it, we're back in the room again. We'll probably write more here later, but for now, deal with this picture of our favorite software dev, who works at Citrix (we imagine). Citrix, before yo...

What we learned from being the first company to disclose an agent cyberattack

Manufacturer writes to its customers that they have concrete indications from law enforcement about an attack. Large companies are also affected in this country.

CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). It represents a shift in effort displacement for attackers, in which e...

Protecting vulnerable infrastructure will require a multipronged approach to make the United States a tougher target.

It Was That Easy

Astra is the first OpenAI model to meet the Critical cybersecurity capability threshold under the Preparedness Framework, with stronger safeguards for release.

You can no longer assume a mere VM will contain a sufficiently advanced AI agent.

Operation GitPower, a Kimsuky campaign, uses AI-generated lure documents and GitHub/GitLab-based C2 infrastructure to deliver malicious payloads.

Talos has collected prompt logs from threat actor endpoints running various applications, such as Claude Code, CodeX, Cursor, or Gemini. This blog is an analysis of the ways we've seen bad actors leve...

The Trump administration has struggled over how to approach to “open source” models, which are freely available to download and favored by Chinese companies.

The UK Artificial Intelligence Security Institute (UK AISI) and the U.S.

President Trump’s bold vision to secure and accelerate American artificial intelligence (AI) innovation is being actioned through the creation of “GOLD

Rising AI costs may lead to the real supply-chain risk, a silent shift toward Chinese models.

The deterministic work is moving to agents, which is good, because that's where most of the burnout was coming from. The judgment work is staying with…

Full agent sessions captured on a compromised host turned honeypot offer an unprecedented look at how attackers are using AI in real-world intrusions.

Washington has identified artificial intelligence as a defining national security challenge. But as China rapidly integrates AI into military operations and state strategy, experts warn America's grea...

Context Sekoia’s Threat Detection & Research (TDR) team has been tracking APT28 for several years. The intrusion set, also known as Fancy Bear, Forest Blizzard, Sofacy, Pawn Storm or Sednit and public...

In September 2025, Volexity conducted an incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine appliance on a customer’s network. The...

Members of the Five Eyes intelligence partnership release a joint bulletin warning of the threat posed by China's military intelligence services on Western professional networking sites and online job...

A Sysdig TRT investigation reveals their first seen LLM-agent-driven intrusion: from CVE-2026-39987 to internal database exfiltration in under one hour.

ALT: Think About It Meme with Reece Simpson