Vanja Svajcer

Cisco Talos’ 2025 Year in Review is available to view now! Read the full report here for key trends and defense tips — no annoying forms, just helpful analysis: cs.co/6019B6X0VF

Some fresh insights into Voidlink, with a link to an Isovalent blog with more details on the framework blog.talosintelligence.com/voidlink/

DKnife, a gateway-monitoring and adversary-in-the-middle framework uncovered. blog.talosintelligence.com/knife-cutting-…

Important report 👉

Dynamic binary instrumentation (DBI) with DynamoRio blog.talosintelligence.com/dynamic-binary…

DPRK alligned Famous Chollima keeps their operational tempo high and although not the most sophisticated actors, they have been consistently adding new features to their tools. blog.talosintelligence.com/beavertail-and…

Although these malware families have historically been associated with campaigns attributed to Naikon or BackdoorDiplomacy, our analysis indicates a connection. blog.talosintelligence.com/how-rainyday-t…

Cisco Talos has observed an ongoing malware campaign that seeks to infect victims with a multi-stage malware framework, implemented in PowerShell and C#, which we are referring to as “PS1Bot.” blog.talosintelligence.com/ps1bot-malvert…

Using LLMs as a reverse engineering sidekick blog.talosintelligence.com/using-llm-as-a…

Cisco Talos Incident Response (Talos IR) recently observed attacks by Chaos, a relatively new ransomware-as-a-service (RaaS) group conducting big-game hunting and double extortion attacks. blog.talosintelligence.com/new-chaos-rans…

MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities blog.talosintelligence.com/maas-operation…

We published our findings about a Python variant of a Golang RAT used by Famous Chollima (aka Wagemole). This has been recently used with limited success. blog.talosintelligence.com/python-version…

@TalosSecurity We are here and ready to entertain! The sessions are already fully booked but there is a waiting list people can join.

Vanja Svajcer and Giannis Tziakouris are hosting not one, but two, Ransomware Role-Playing breakouts this week at #CiscoLiveEMEA be sure to join them on Tuesday or Thursday this week! cs.co/6016xhHr6

I presented part of this work on learning about vulnerable Windows drivers at this year's AVAR. This is a follow up post blog.talosintelligence.com/exploring-vuln…

Gophish and a new Powershell RAT blog.talosintelligence.com/gophish-powerr…

Talos discovered previously undocumented backdoors and additional components used by Romcom blog.talosintelligence.com/uat-5647-romco…

Preliminary Schedule finally online tinyurl.com/yya5jdxf #BalCCon #BalCCon2k24 #infosec #Hacking #NoviSad @k0st @vanjasvajcer @MacLemon @CryptoLek @Seifreed @MalwareUtkonos @KirilsSolovjovs @fladna9 @GMahovlic …..

DragonRank, a Chinese-speaking SEO manipulator service provider blog.talosintelligence.com/dragon-rank-se…

This started as an investigation into a maldoc with obfuscated VBA code and some unused legit functions lead to discovery of other maldocs generated by MacroPack. blog.talosintelligence.com/threat-actors-…

Details on APT41 activity blog.talosintelligence.com/chinese-hackin…