The OSINT playbook: Find your weak spots before attackers do
Here’s how open-source intelligence helps trace your digital footprint and uncover your weak points, plus a few essential tools to connect the dots
WeLiveSecurity – Read More
It’s not personal, it’s just business
Welcome to this week’s edition of the Threat Source newsletter.
This week, we explore how advances in agentic AI are rapidly transforming the cyber crime business.
Agentic AI programming gives AI agents autonomy, allowing them to interact with external systems to collect information, make decisions with the help of a generative AI system, and then effect changes in the external environment. The activity takes place through various APIs according to the instructions provided to the agent and in the context of a defined workflow.
The advantage for human operators is that these systems can efficiently execute routine activities that would otherwise require accessing multiple systems. Essentially, the AI agent acts as a trusted assistant who is able to get on with things with minimal supervision while the human operator can focus on other things.
As this approach brings advantages to the legitimate economy, so it brings similar efficiencies to the cyber crime economy. More recently, the publication of the discovery of the first AI-orchestrated cyber campaign should give us pause. It signals a new era for cybersecurity teams.
We’re entering a time when we can expect to see much experimentation and innovation with AI in both the legitimate and cyber crime economies. AI can act as a force enabler, making tasks easier and faster to perform. Similarly, AI can lower barriers to entry, allowing lower skilled actors to perform tasks that they lack the skills to perform. While AI does not bring new capabilities, it can make existing capabilities easier to execute. However, AI systems still require skillful instruction and supervision.
AI is not infallible, it gets things wrong, and it is prone to inventing nonsense. When it does go off the rails, a human needs to step in and resolve the situation. This is not necessarily easy to do and may prove tricky for low-skilled threat actors.
Don’t be discouraged: We can also leverage these developments to our advantage. Defensive teams can write their own agentic systems to find and fix weaknesses in their own systems before malicious actors identify them. We can deploy honeypot systems designed to be found by malicious AI systems, engage with them and tie up their resources.
The threat landscape has never been static. While AI does make some tasks more accessible to threat actors, it is a double-edged sword and also brings opportunities to defenders.
The one big thing
Cisco Talos has introduced new features for Snort3 users within Cisco Secure Firewall. A new “Severity” rule group allows you to organize detection rules by CVSS-based vulnerability severity (low, medium, high, critical). This allows teams to better prioritize and manage rules according to risk and urgency. You can also select rules based on vulnerability age (e.g., last 2, 5, or 10 years).
Why do I care?
This update allows you greater flexibility and control. It makes it simpler to maintain consistent, targeted detection coverage, whether you’re running large, distributed networks or smaller environments with tailored security priorities.
So now what?
Review your current Snort3 rule configurations in Cisco Secure Firewall and consider adopting the new Severity and time-based grouping features. By tailoring rule sets to your organization’s specific risk tolerance and patching cycles, you can optimize detection coverage, streamline management, and better protect your environments.
Top security headlines of the week
Critical railway braking systems open to tampering
Researchers have figured out how to spoof the signals that tell train conductors to brake, opening the door to any number of dangerous attack scenarios. (Dark Reading)
EchoGram flaw bypasses guardrails in major LLMs
A flaw discovered in early 2025 and dubbed EchoGram allows simple, specially chosen words or code sequences to completely trick the automated defences, or guardrails, meant to keep the AI safe. (HackRead)
Over 67,000 fake npm packages flood registry in worm-like spam attack
The worm-life propagation mechanism and the use of a distinctive naming scheme that relies on Indonesian names and food terms for the newly created packages have lent it the moniker IndonesianFoods Worm. The bogus packages masquerade as Next.js projects. (The Hacker News)
Cornerstone Staffing ransomware attack leaks 120,000 resumes, claims Qilin gang
The notorious Qilin gang posted the industry-leading recruitment agency on its dark leak blog last Thursday. The group claims to have exfiltrated 300GB of sensitive information from Cornerstone. (Cybernews)
Surveillance tech provider Protei was hacked, its data stolen, and its website defaced
It’s not clear exactly when or how Protei was hacked, but a copy of the company’s website saved on the Internet Archive’s Wayback Machine shows it was defaced on November 8 and restored soon after. (TechCrunch)
Can’t get enough Talos?
The TTP: How Talos built an AI model into one of the internet’s most abused layers
Hazel talks with Talos researcher David Rodriguez about how adversaries use DNS tunneling to sneak data out of networks, why it’s so difficult to spot in real time, and how Talos built an AI model to detect it without breaking anything important (like the internet).
Humans of Talos: On epic reads, lifelong learning, and empathy
In this episode, Bill Largent shares what drew him to Talos, how his love of reading has shaped his cybersecurity ethos, and the key insights he shares for the next generation of cybersecurity professionals.
Unleashing the Kraken ransomware group
In August 2025, Cisco Talos observed big-game hunting and double extortion attacks carried out by Kraken, a Russian-speaking group that has emerged from the remnants of the HelloKitty ransomware cartel.
Upcoming events where you can find Talos
- DeepSec IDSC (Nov. 18 – 21) Vienna, Austria
- AVAR (Dec. 3 – 5) Kuala Lumpur, Malaysia
Most prevalent malware files from Talos telemetry over the past week
SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
MD5: 2915b3f8b703eb744fc54c81f4a9c67f
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
Example Filename: e74d9994a37b2b4c693a76a580c3e8fe_1_Exe.exe
Detection Name: Win.Worm.Coinminer::1201
SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59
MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59
Example Filename: ck8yh2og.dll
Detection Name: Auto.90B145.282358.in02
SHA256: 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
MD5: aac3165ece2959f39ff98334618d10d9
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
Example Filename: 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974.exe
Detection Name: W32.Injector:Gen.21ie.1201
SHA256: c0ad494457dcd9e964378760fb6aca86a23622045bca851d8f3ab49ec33978fe
MD5: bf9672ec85283fdf002d83662f0b08b7
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=c0ad494457dcd9e964378760fb6aca86a23622045bca851d8f3ab49ec33978fe
Example Filename: f_0008d7.html
Detection Name: W32.C0AD494457-95.SBX.TG
SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91
MD5: 7bdbd180c081fa63ca94f9c22c457376
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91
Example Filename: e74d9994a37b2b4c693a76a580c3e8fe_3_Exe.exe
Detection Name: Win.Dropper.Miner::95.sbx.tg
Cisco Talos Blog – Read More
Detected in 60 Seconds: How to Identify Phishing with a Malware Sandbox
In many SOCs, phishing analysis still follows the same old pattern: manually pull apart URLs, inspect attachments by hand, take screenshots, collect indicators one by one… and hope nothing slips through in the process.
It’s careful work, but slow.
A sandbox flips that workflow on its head.
Every step analysts normally handle themselves is condensed into a few seconds of automated detonation, real-time behavior tracking, and instant IOC extraction.
That’s how a 15-minute job becomes a 60-second answer.
How Phishing Analysis Really Works: With vs. Without a Sandbox
Once the email is flagged as suspicious, analysts usually move through a predictable checklist: review the link or attachment, open it inside a safe environment, observe what happens, and extract indicators manually. Each phase takes time, and even small tasks, decoding a URL, grabbing a screenshot, checking a redirect; slow the investigation down.
When the same message is detonated inside ANY.RUN sandbox, the whole chain is captured automatically. The VM loads the content, follows redirects in real time, records every network request, and pulls out indicators as soon as the activity appears. Instead of digging piece by piece, analysts simply watch the behavior unfold and confirm the verdict.
A good example of this speed is a recent phishing case where attackers used Figma pages to kick off a credential-harvesting chain. Inside the sandbox, the entire Figma → Microsoft microdomain → Azure Blob Storage flow becomes visible in under a minute.
You can view the attack pattern here: Real Example: FigmaRedirects Used in Phishing
1. URL / Attachment Analysis
Without a sandbox:
Analysts usually begin by checking links manually, opening attachments in a VM environment, or trying to reproduce the user’s click path. Even simple emails take time to decode and verify, often adding up to 5–10 minutes before any real behavior is observed.
With a sandbox:
Upload the email or attachment, and the sandbox detonates it instantly inside a controlled VM. Initial behavior, connections, redirects, script execution, appears in 20–40 seconds, giving analysts a fast idea of whether the file is benign or dangerous.
2. Behavior Observation
Without a sandbox:
Once the link or attachment is opened in a controlled VM, analysts have to follow the behavior manually; redirects, process launches, hidden scripts, background network calls. None of it is being tracked in a custom VM deployed locally by default.
The workflow is slow because everything happens in small pieces that need to be captured one by one. Depending on the complexity of the email, this phase can take anywhere from several minutes to well over ten, especially if the chain includes multiple hops or short-lived activity.
With a sandbox:
The moment the detonation starts, the sandbox records each action as it happens.
Processes, redirects, and network requests appear live in the interface, so analysts see the full flow without chasing events across different tools. In most cases, the main behavior is already visible within 20–40 seconds, including activity that would be easy to miss during observation in a custom VM.
3. IOC Extraction
Without a sandbox:
Collecting indicators is usually one of the most time-consuming parts of phishing analysis. Analysts have to pull out every domain, IP address, hash, and dropped file path manually, sometimes by repeating the execution to catch fast or hidden activity. Cross-checking each indicator across logs, browsers, and tools can stretch this phase to 5–10 minutes or more, especially when the redirect chain is long.
With a sandbox:
Indicators appear as soon as the activity occurs. Domains, IPs, file hashes, registry changes, and dropped objects are captured automatically and displayed in a single view. Instead of hunting for details, analysts simply review the list. This typically takes 10–20 seconds, even when multiple indicators are created during detonation.
4. Threat Matching
Without a sandbox:
After gathering indicators, analysts typically check each domain, IP, and file hash in external reputation portals or TI sources. Moving between tools and validating each indicator one by one often adds 5–10 minutes, especially when the phishing chain produces several IOCs.
With a sandbox:
Reputation details appear automatically as soon as indicators show up. The ANY.RUN sandbox displays the name of the threat, whether it is a malware family, a phishing kit, or even an APT. The threat coverage is continuously updated by ANY.RUN’s in-house team of threat hunters, researchers, and analysts.
Suspicious findings are also labeled with clickable threat names, allowing analysts to jump directly to related public submissions for deeper comparison. Besides, a link to the Malware Trends Tracker provides broader context, showing how the threat behaves across other samples.
What normally requires several manual lookups takes 10–20 seconds, because the essential context is already available in the interface.
5. Incident Documentation
Without a sandbox:
Documenting findings is one of the most tedious parts of phishing analysis.
Analysts need to capture screenshots, save URLs, gather indicators, describe behavior, and assemble everything into a ticket or report by hand. Even when the case is simple, this often requires 5–10 minutes, and much longer when multiple steps or redirects are involved.
With a sandbox:
A complete report is generated automatically as the detonation runs. Screenshots, network activity, redirects, process events, indicators, and threat labels are all captured and stored in a structured format.
Analysts can export the report instantly or link directly to it, so the case can move forward without manual writing or screenshot collection. This entire phase usually takes 10–20 seconds, since the documentation is created for you.
The Time Difference: 15 Minutes vs. 60 Seconds
When you put each step side by side, the gap becomes obvious.
Manual phishing analysis breaks the workflow into several slow checks, while an interactive sandbox condenses everything into one fast detonation.
| Step | Without a Sandbox | With a Sandbox |
| URL / Attachment Analysis | 5–10 minutes | 20–40 seconds |
| Behavior Observation | 10–15 minutes | 20–40 seconds |
| IOC Extraction | 5–10 minutes | 10–20 seconds |
| Threat Matching | 5–10 minutes | 10–20 seconds |
| Incident Documentation | 5–10 minutes | 10–20 seconds |
| Total Time | ~15 minutes | ~60 seconds |
What’s usually a long, repetitive workflow turns into a one-minute verdict.
When a phishing wave hits and dozens of suspicious emails land in the queue, those saved minutes quickly add up, often freeing hours across a single shift.
Why This Speed Counts: The Business Impact Behind the Numbers
Cutting phishing analysis from 15 minutes to 60 seconds drives measurable improvements across the entire SOC.
ANY.RUN’s data shows:
- 90% of malicious activity is exposed within the first 60 seconds of detonation
→ analysts see the real behavior before the attacker has time to hide it
- 94% of users report faster triage
→ fewer tasks stuck in the queue, fewer delays during active phishing waves
- SOCs that adopt interactive sandboxing see up to a 3× boost in investigation throughput
→ more cases closed per shift, less pile-up when suspicious emails spike
- False-positive noise drops significantly
→ threat analysts spend more time on real signals and less on dead ends
- Teams report up to a 58% increase in threats identified overall, including attacks that bypass other controls
→ behavioral visibility picks up what static checks miss
This combination, fast verdicts, clear behavior visibility, and automated context, transforms phishing analysis from a slow manual chore into a fast, reliable, repeatable process.
Want to see how your SOC can speed up phishing investigations?
Discover how interactive analysis cuts investigation time and exposes phishing behavior in under a minute.
Get a 14-Day Trial of ANY.RUN →
About ANY.RUN
ANY.RUN helps security teams investigate threats faster and with far greater clarity. The Interactive Sandbox reveals full attack behavior in real time, from process execution and redirects to network activity and dropped files, giving analysts the visibility they need to make confident, evidence-based decisions.
Cloud-based and ready to use, ANY.RUN supports Windows, Linux, and Android environments, making it easy to analyze phishing emails, URLs, and malware without managing complex infrastructure.
Its Threat Intelligence Lookup and continuously updated TI Feeds provide automation-ready indicators that strengthen detection, enrichment, response, and reporting across security operations.
Together, these capabilities give analysts a fast, transparent, and reliable way to understand modern attacks and improve overall SOC performance.
The post Detected in 60 Seconds: How to Identify Phishing with a Malware Sandbox appeared first on ANY.RUN’s Cybersecurity Blog.
ANY.RUN’s Cybersecurity Blog – Read More
PlushDaemon compromises network devices for adversary-in-the-middle attacks
ESET researchers have discovered a network implant used by the China-aligned PlushDaemon APT group to perform adversary-in-the-middle attacks
WeLiveSecurity – Read More
Hacking Black Friday: using LLMs to save on the “sale of the year” | Kaspersky official blog
Black Friday is an annual bargain hunt that often spirals into chaotic impulse buying. Stores promise incredible discounts of 50–70%, but are those savings really as significant as they seem? In 2025, we’ve got a new ally on our side in the fight for smart spending: artificial intelligence. Here’s how you can use powerful LLMs like ChatGPT and Claude to save money and never fall for a shady seller’s tricks again.
Before we enlist AI to help you save, it’s crucial we understand the battlefield. Studies paint a grim picture: a significant portion of those Black Friday “super discounts” are nothing more than a marketing illusion.
The tactic is simple and effective: in early October, stores hike up their prices, sometimes by fifty to a hundred percent. Then, when Black Friday finally hits, they “slash” the price by that same 50% and proudly tout the impressive discount on the tag. In reality, you’re just buying the item at its regular price — or sometimes even paying a premium.
While the European Union’s Omnibus Directive mandates that retailers display the lowest price from the last 30 days, even this rule is easily skirted. Retailers just hike the price up 30 days before the event, which allows them to technically adhere to the directive while still duping consumers.
How LLMs can help you save
Artificial intelligence is changing the game. Analysts estimate that in 2024, AI tools helped consumers make a staggering $60 billion in transactions during Cyber Week, and that number is only projected to climb in 2025. Already, one in three U.S. shoppers plans to lean on AI for their shopping needs.
As you know, an LLM is immune to emotion; it won’t react to marketing triggers like “2 hours left!” or “only one left in stock!” Instead, the model analyzes huge volumes of data, compares prices, tracks price history, and helps you make rational decisions.
In seconds, AI can crawl hundreds of online stores, zeroing in not only on the product you want at the lowest price but also on cheaper alternatives with comparable specs. Modern LLMs can help you figure out if a discount is truly beneficial — or if you’re falling for a scam. Amazon, for example, has already integrated a price-tracking feature into its AI assistant, Rufus, though users have noted that the tool still has some kinks to work out. Using just a few prompts, the AI can factor in your preferences, budget, and past purchases to suggest exactly what you need, cutting through all the marketing noise. Instead of wasting hours poring over spec sheets, just ask the assistant, “What’s the difference between vacuum cleaner A and vacuum cleaner B?” And you get your answer — regardless of whether the seller’s website features a comparison tool. You can use the prompts below for ChatGPT, Claude, or Gemini.
Preparing for Black Friday with AI
Step 1. Create a wish list
Don’t wait for the sales to start; your goal is to gather all the baseline data upfront.
Help me create a shopping list for Black Friday. My budget is: [amount].
I'm interested in the following categories: [electronics/clothing/home goods].
Priorities: [performance/quality/brand/price].
Create a structured list with explanations of why each item is worth considering.
Step 2. Start tracking prices
This is a critical stage. You need to know the real price of an item before the Black Friday marketing hype machine starts rolling. On Amazon, tools like CamelCamelCamel and Keepa can help, and for AliExpress, look at AliPrice and AliTools.
Step 3. Analyze price dynamics
Collected the price data? Excellent. If you see a sharp price spike in October followed by a corresponding drop in November, you’re looking at the classic scam tactic. But if the data on the charts seems unclear, use the prompt below. The months we used are just examples, so feel free to use your own date ranges. The larger the intervals between the price checks, the higher your chances of catching an unjustified price hike.
I'm tracking [product name] on [platform]. Here's the price data:
- September: [price]
- Early October: [price]
- Late October: [price]
- Current price: [price]
- Advertised discount: [percentage]
- Analyze this data. Is this a genuine discount or is the store manipulating prices?
When is the best time to buy? Should I wait for Black Friday or buy now?
Step 4. Search for alternatives
Don’t get fixated on a single product. There may be more advantageous alternatives available.
I want to buy [product, model]. My goal is to [what it's needed for]. Budget: [amount].
Find 3–5 alternative products that solve the same problem but might be more cost-effective.
Compare them based on features, price, and reviews. Display the results in a table.
Experience shows that LLM models are particularly good at comparative analysis, highlighting key differences between similar products.
Step 5. Vet the seller and the website
Black Friday is an absolute field day for scammers. In the third quarter of 2025 we saw the number of fake online stores skyrocket by 20% compared to the monthly average. Let’s run through the immediate red flags that should raise your suspicions:
- Domains like .shop, .store, .vip or .top — rarely used by major, established brands
- Unbelievable discounts of 80–90% on popular items
- Lack of a secure HTTPS connection, meaning no padlock icon next to the URL in your browser
- Poorly translated text and/or grammatical errors
Finally, just in case, run the following prompt through the AI of your choice to check the store’s legitimacy:
I have found [product name] on [URL]. The price is very attractive: [price], which is [percentage]% below the average. How can I verify that this is not a scam?
What are the signs of a fake store? What should I pay attention to?
Step 6. Compile the all-in-one prompt
This is the all-in-one prompt containing all the data you gathered in the previous steps; it works in any LLM:
You are an expert in spotting retail price manipulation.
Product: [name]
Store: [name]
Current price: [price]
Advertised discount: [percentage]%
Stated old price [price]
Price history I tracked:
[state data for several months]
Tasks:
1. Is this a genuine discount or a manipulation?
2. What was the real average price before the alleged sale?
3. Should I buy now, or is the price likely to drop even further?
4. Your verdict: buy / wait / look for alternatives?
Note that neural networks’ cybersecurity is still far from perfect: vulnerabilities continue to be discovered within them. Therefore, to shield yourself from phishing and spam links you might accidentally follow, be sure to install a proven and reliable security solution, such as Kaspersky Premium. It’ll keep your Black Friday from turning into a financial Black Monday for both your assets and personal data.
Getting local results
One of the core issues with global AI models is that they often deliver information that’s not region-specific, or is relevant to a region other than yours. But you can adapt them to your needs with this prompt:
You are an AI shopping assistant for [country, city]. All your recommendations must factor in the local market, available stores, and regional platforms ([list of stores, if desired]). State prices in [currency]. Speak [language].
My task is to find [product] at the best price for Black Friday.
Which local platforms should I check? What kind of sales are common in [region]?
Specialized prompts for each LLM
Each LLM has its strengths (also weaknesses). With these in mind, we’ve created prompts that unlock the potential of each language model. For the highest quality results, we recommend utilizing models with a larger number of parameters (usually available via paid subscriptions), and activating deep thinking when submitting your requests.
ChatGPT excels at structuring information and generating lists. Here’s a prompt for budget planning:
Create a shopping strategy for Black Friday.
Budget: [amount]
Priority categories: [list]
For each category, specify:
1. Average price before discounts
2. Expected discounted price
3. Best time to buy (before/during/after Black Friday)
4. Alternatives
Format the results as a table.
And here’s a prompt for store comparison:
Product: [name and model]
Found in stores:
- [Store 1]: [price], shipping [terms]
- [Store 2]: [price], shipping [terms]
- [Store 3]: [price], shipping [terms]
Which option is more cost-effective considering the total cost? Analyze the reliability of the stores.
Claude is particularly good at analyzing large volumes of text and highlighting key points. Here’s a Claude prompt for analyzing reviews:
Here's a selection of reviews for [name] from various platforms: [insert reviews].
Analyze them and highlight:
1. Key advantages (top 3)
2. Key disadvantages (top 3)
3. Who is this product best suited for, and who should avoid it?
4. Are there any alarming issues mentioned?
5. Overall recommendation: is this worth buying?
Long-term planning prompt:
You're a financial consultant. I'm planning a major purchase: [product] for [price].
My monthly income: [amount]. My savings: [amount].
Should I buy this on Black Friday or should I wait?
What alternative saving and purchasing strategies can you offer?
Gemini offers seamless integration with the Google ecosystem and provides in-depth capabilities when working with images. Attach a screenshot of the banner or the offer on the website and write the prompt:
This is a Black Friday offer. Evaluate:
1. How attractive is this discount?
2. What information should I check additionally?
3. What should I pay attention to in the description?
4. Signs of a possible scam
Quick search prompt:
Find the best Black Friday 2025 offers in [category].
I'm looking for: [product characteristics]
Budget: [amount]
Region: [country/city]
Show the top-5 options and provide a justification for each choice.
Final checklist
- Use AI to create a wish list, and start tracking prices with tools like CamelCamelCamel, Keepa, or other similar services. Set up convenient price-drop notifications.
- Analyze the collected price data, find alternative products and stores, and simultaneously verify the sellers’ reliability.
- Set up a separate credit card for purchases with a spending limit. If possible, get a virtual card and prepare our prompts for quick retail-offer analysis.
- On the actual sale day, don’t fall for urgency tricks like “last item in stock!”, and make sure you check every “super deal” with your AI assistant and a critical eye. Cross-reference the price history, don’t open suspicious emails, and don’t follow dubious links. If you follow these steps, your Black Friday will result not only in zero losses, but also in genuinely advantageous purchases.
What else to read on the topic of AI:
Kaspersky official blog – Read More
Bill Largent: On epic reads, lifelong learning, and empathy
Welcome to another episode of Humans of Talos! This week, Amy sits down with William (Bill) Largent from the Strategic Planning and Communications team. Bill’s role as Senior Security Researcher spans from threat research to communicating Talos’s critical work to internal teams, partners, and customers.
Join us as Bill shares what drew him to Talos, how his love of reading has shaped his cybersecurity ethos, and the key insights he shares for the next generation of cybersecurity professionals.
Amy Ciminnisi: Bill, it’s great to have you on. You’re part of my team in Strategic Planning and Communications. Can you tell us a little bit about what you do here at Talos?
Bill Largent: Generally speaking, most of my time is still spent on threat research and hunting. About 25 to 30% of the time, they have me talk to people. They let me out of the cage for a little while and put me in front of people. I get to talk to internal Cisco teams and to a lot of partners, which is really interesting. I discuss the state of things, help them understand what’s going on in the threat landscape, and explain what Talos is and how we do things. I also get to talk to customers, which is really fun. My background is in vendor-agnostic remote managed services, so I ran SOCs for years. Talking to people who are doing that now is really refreshing.
AC: You’ve been at Cisco for a while. What made you want to join Talos, and how did that career transition go for you?
BL: It’s really interesting. I’ve been here a long time. If you look me up in the directory, you’ll see my photo is about 24 years old. It was taken on a Saturday or Sunday night at 2 or 3 a.m. because I was working overnight shifts, so it looks exactly like you’d imagine. Getting to Talos was about seeking out smarter people. I believe if you’re the smartest person in the room, you’re in the wrong room, so I started tracking where the smarter people were and went there.
As a member of Talos, there’s never a smarter room than the Talos room. It’s insane, and I mean that for any topic you can think of — chaos theory, mathematics, planetary science, beer making… You name it, someone in Talos is an expert. It’s honestly great. That’s how I came to Talos: trying to find the smartest people in the room.
AC: Is working with people and especially people on Talos your favorite thing about your role, or are there other aspects you love?
BL: For me, the people are a massive differentiator from working anywhere else. I feel super supported and engaged all the time. Beyond the people, what’s interesting about cybersecurity is that it evolves so fast and changes so much that you’re never in a state of stasis. There’s always something new to learn, and even though it’s all cyclical and some things come back around, there’s a lot of difference day to day. It keeps my brain occupied. I also have the support of people who encourage me to go learn things that interest me.
Want to see more? Watch the full interview, and don’t forget to subscribe to our YouTube channel for future episodes of Humans of Talos.
Cisco Talos Blog – Read More
LOLBin Attacks Explained with Examples: Everything SOC Teams Need to Know
Some attacks smash the door open. LOLBins just borrow your keys and walk right in.
They’re tricky because tools everyone trusts suddenly start doing things that don’t match their usual job; loading odd-looking modules, decoding files that shouldn’t need decoding, or quietly handing work off to hidden PowerShell scripts. At first glance it all feels normal, but a closer look shows a payload slowly being set up in the background.
For analysts, the real challenge is noticing that shift before it grows into a full incident.
Let’s take a closer look at what’s hiding behind LOLBin attacks, and how advanced SOC teams uncover them in minutes without much effort.
What Are LOLBin Attacks?
LOLBin attacks occur when threat actors repurpose legitimate Windows system binaries (rundll32, certutil, mshta, powershell, regsvr32, etc.) to carry out malicious actions. These tools are built into every system, signed by Microsoft, and widely used by normal applications, which is why attackers rely on them.
Using LOLBins, adversaries can:
- Load disguised or renamed DLLs
- Decode or unpack payloads using built-in utilities
- Trigger PowerShell or script execution indirectly
- Execute code completely in memory
- Blend malicious steps into routine system activity
This approach lets attackers avoid dropping obvious malware and makes early-stage execution appear clean and legitimate.
Why LOLBin Attacks Are a Real Risk for Businesses?
The real problem isn’t the binaries themselves but how much visibility your SOC loses when attackers hide behind them. When malicious activity runs inside trusted system tools, the early signs of an intrusion become dramatically harder to catch.
Here’s what makes them dangerous:
- Normal on the surface: Activity is routed through tools the environment already trusts.
- Minimal forensic evidence: In-memory execution leaves few files to investigate.
- Weak signature coverage: Microsoft-signed binaries rarely trigger basic detection rules.
- Extended dwell time: Attackers gain more space for lateral movement and credential access.
- Harder investigations: Clean-looking events force analysts to dig deeper to find the real issue.
- Higher SOC workload: The team must identify subtle behavior shifts instead of relying on clear indicators.
This means attackers can establish footholds, unpack payloads, or run loaders while the environment still appears clean, leading to late detection and higher incident impact.
The Fastest Way to Reveal LOLBin Abuse: How ANY.RUN Makes It Obvious
LOLBin attacks only work when no one can see what’s really happening behind those trusted Windows binaries. ANY.RUN removes that advantage by showing analysts the full behavior in real time; not just the file name or the process label, but the actual actions taking place underneath.
With ANY.RUN’s sandbox, “normal-looking” activity turns into something you can spot immediately:
- Process behavior becomes clear at a glance: rundll32 loading a strange module, certutil decoding an unexpected file, mshta spawning hidden PowerShell… every unusual step is visible right away.
- Parent–child chains tell the full story: Instead of digging through logs, you see exactly who launched what, and whether it fits normal usage patterns.
- Command lines show the truth: Encoded strings, odd export calls, Temp-folder payloads, and hidden flags are exposed instantly.
- In-memory actions are no longer invisible: Even when attackers avoid dropping files, the sandbox reveals decoded scripts, loader behavior, and execution flow.
- Artifacts stay captured: Renamed DLLs, extracted archives, decrypted payloads, and cleanup attempts can all be reviewed without rushing or digging.
- Analysis becomes interactive: Analysts can click deeper, replay events, and confirm suspicions in minutes instead of piecing everything together manually.
Instead of guessing whether a trusted binary is being misused, ANY.RUN shows the exact behavior clearly, quickly, and with the context you need to act confidently.
Real-Time LOLBin Attacks Revealed Inside ANY.RUN in Minutes
Here are a few real LOLBin attacks captured and analyzed inside ANY.RUN.
Take a look at how these techniques unfold in real time, and see how easily your team can expose the same behavior using interactive analysis.
1. LOLBin RUNDLL32.EXE
ATT&CK® Technique: T1218.011 – Rundll32
What this attack is:
A trusted Windows utility used to load and run a disguised module, letting attackers execute their payload under a legitimate process.
See this RUNDLL32 attack exposed live inside ANY.RUN:
→ Gh0st RAT delivered through rundll32
Gh0st RAT launches the legitimate rundll32.exe, which then loads a disguised module named grgfrqe.rfg from an unusual directory. The file isn’t a typical DLL at first glance; the strange extension is intentionally chosen to bypass simple “.dll” rules and blend into the system.
Once loaded, rundll32 calls an export named RAFlush and passes it a path to a temporary executable: C:UsersadminAppDataLocalTemphkjhn.exe.
From there, the chain unfolds:
- Load: rundll32 loads the renamed DLL (grgfrqe.rfg)
- Invoke: The RAFlush export is executed
- Drop/execute: The module drops, unpacks, or runs hkjhn.exe inside %Temp%
- Cleanup: Temporary files are removed to reduce traces
This is a typical LOLBin pattern: a trusted binary quietly executing hidden functionality while the malicious module stays disguised and difficult to catch without behavioral visibility.
Use this ANY.RUN’s TI Lookup query to explore similar samples and collect IOCs:
2. LOLBin CERTUTIL.EXE
ATT&CK® Technique: T1140 – Deobfuscate/Decode Files or Information
What this attack is:
A built-in Windows tool misused to decode, transform, or prepare hidden payloads before execution; all under the guise of a legitimate system operation.
See this CERTUTIL attack exposed live inside ANY.RUN:
→ PXAStealer decoding and unpacking files through certutil
PXAStealer uses certutil.exe to quietly decode a disguised file named DA 성형외과 재무 보고서.pdf. Although it appears to be a harmless PDF, certutil converts it into Invoice.pdf, which is not a document at all but a RAR archive.
The attack continues as a renamed instance of WinRAR, disguised as a JPEG image (부가가치세 영수증.jpg), unpacks the archive using the password
iJbcsRBR84uUl9USIhj09PH0elalyHPJ.
The execution flow looks like this:
- Decode: certutil transforms the fake PDF into an archive
- Extract: The disguised WinRAR instance unpacks it
- Execute: The payload inside the archive is launched
- Cleanup: Files are removed or hidden to minimize traces
This combination, a trusted decoding tool + disguised content + hidden extraction, is a classic LOLBin chain designed to slip past basic detection and appear routine unless investigated behaviorally.
Check out more sessions of this attack and gather related IOCs using this TI query:
commandLine:”certutil.exe*-decode”
3. LOLBin MSHTA.EXE
ATT&CK® Technique: T1218.005 – Mshta
What this attack is:
A trusted Windows utility used to execute HTA-based scripts that trigger hidden PowerShell activity, enabling in-memory execution without leaving clear artifacts.
See this MSHTA attack exposed live inside ANY.RUN:
→ ReverseLoader executed through mshta + hidden PowerShell
In this attack chain, mshta.exe launches an HTA file named gg.hta from the user’s desktop. The HTA isn’t a simple script; it contains obfuscated logic that immediately spawns a PowerShell process configured to stay out of sight.
PowerShell is executed with:
- -NoProfile
- -WindowStyle Hidden
- A Base64-encoded command decoded and passed into Invoke-Expression
This allows the payload to run entirely in memory, without dropping a traditional file on disk.
Here’s how the chain unfolds:
- Deliver: The HTA file is delivered locally or through a link
- Execute: mshta runs the HTA script as a trusted system tool
- Decode & run: PowerShell decodes the Base64 string and executes the logic
- Stealth: Hidden windows and in-memory execution conceal most traces
This mshta + encoded PowerShell combination is a well-known method for quietly loading backdoors, RATs, and script-based loaders while appearing to use legitimate system components.
Check out more sessions of similar attacks and gather relevant data using this TI query:
Strengthening Defenses Against LOLBin Techniques
For SOC managers, stopping LOLBin abuse starts with improving how the team spots unusual behavior inside trusted system tools. These attacks don’t announce themselves, so the goal is to create clearer visibility and reduce the time analysts spend guessing what’s happening.
Focus on behavior, not the binary: Even legitimate tools like rundll32, certutil, and mshta become suspicious when they load odd modules, decode files, or trigger hidden PowerShell. Building detections around these behaviors helps the team surface threats that signatures often miss.
Give analysts a simple triage path: Most LOLBin alerts look harmless at first. A lightweight checklist, parent process, command line, execution path, and any decoding or script activity, keeps investigations consistent and prevents early-stage activity from slipping by.
Use sandbox analysis to confirm suspicious cases quickly: Instead of piecing clues together from logs, ANY.RUN gives analysts the full picture in seconds: process chains, decoded content, dropped components, and in-memory activity. This cuts investigation time and helps the team act confidently.
Add small policy controls where possible: Limiting execution from user-controlled folders or applying basic PowerShell restrictions reduces the surface attackers can exploit without disrupting normal operations.
A few focused improvements like these help SOC managers turn LOLBin activity from a hidden risk into something the team can catch early and handle efficiently.
About ANY.RUN
ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions, built to give SOC teams the visibility they need when traditional tools fall short.
Today, 15,000+ organizations worldwide use ANY.RUN to speed up investigations, strengthen detection pipelines, and give their teams a clearer view of what’s really happening on their endpoints.
SOC teams using ANY.RUN report measurable improvements, including:
- 3× boost in SOC efficiency
- 95% faster initial triage
- Up to 58% more threats identified
- 21-minute reduction in MTTR per incident
Give your team the visibility they need: Try ANY.RUN now
The post LOLBin Attacks Explained with Examples: Everything SOC Teams Need to Know appeared first on ANY.RUN’s Cybersecurity Blog.
ANY.RUN’s Cybersecurity Blog – Read More
How to securely vet browser extensions across your organization
Malicious browser extensions remain a significant blind spot for many organizations’ cybersecurity teams. They’ve become a permanent fixture in the cybercriminal arsenal, used for session and account theft, espionage, masking other criminal activity, ad fraud, and cryptocurrency theft. High-profile incidents involving malicious extensions are frequent — ranging from the compromise of the Cyberhaven security extension to the mass publication of infostealer extensions.
Extensions are appealing to attackers because they’re granted permissions and wide-ranging access to information within SaaS applications and websites. Because they’re not standalone applications, they often slip past standard security policies and control tools.
A company’s security team must tackle this problem systematically. Managing browser extensions requires a combination of policy management tools and specialized extension-analysis services or utilities. This topic was the focus of Athanasios Giatsos’ talk at the Security Analyst Summit 2025.
Threat capabilities of web extensions and innovations in Manifest V3
A browser’s web extension has broad access to web page information: it can read and modify any data available to the user through the web application, including financial or medical records. Extensions also often gain access to important data typically unseen by users: cookies, local storage, and proxy settings. This greatly simplifies session hijacking. Sometimes, the capabilities of extensions extend far beyond web pages: they can access the user’s location, browser downloads, desktop screen capture, clipboard content, and browser notifications.
In the previously dominant extension architecture, Manifest V2 extensions — which worked across Chrome, Edge, Opera, Vivaldi, Firefox, and Safari — are virtually indistinguishable from full-fledged applications in terms of capabilities. They can continuously run background scripts, keep invisible web pages open, load and execute scripts from external websites, and communicate with arbitrary sites to retrieve or send data. To curb potential abuse — as well as to limit ad blockers — Google transitioned Chromium and Chrome to Manifest V3. This update limited or blocked many extension features. Extensions must now declare all the sites they communicate with, are prohibited from executing dynamically loaded third-party code, and must use short-lived micro-services instead of persistent background scripts. While some types of attacks are now harder to execute due to the new architecture, attackers can easily rewrite their malicious code to retain most necessary functions while sacrificing stealth. Therefore, relying solely on browsers and extensions operating under Manifest V3 within an organization simplifies monitoring, but is not a panacea.
Furthermore, V3 doesn’t address the core problem with extensions: they’re generally downloaded from official application stores using legitimate Google, Microsoft or Mozilla domains. Their activity appears to be initiated by the browser itself, making it extremely difficult to distinguish actions performed by an extension from those manually executed by the user.
How malicious extensions emerge
Drawing from various public incidents, Athanasios Giatsos highlights several scenarios where malicious extensions can rear their ugly heads:
- The original developer sells a legitimate and popular extension. The buyer then “enhances” it with malicious code for ad display, espionage, or other nefarious purposes. Examples include The Great Suspender and Page Ruler.
- Attackers compromise the developer’s account and publish a trojanized update for an existing extension, as was the case with Cyberhaven.
- The extension is designed to be malicious from the beginning. It either masquerades as a helpful utility, such as a fake Save to Google Drive tool, or mimics the names and designs of popular extensions, like the dozens of AdBlock clones available.
- A more sophisticated version of this scheme involves initially publishing the extension in a clean state, where it performs a genuinely useful function. Malicious additions are then introduced weeks or even months later, once the extension has gained enough popularity. ChatGPT for Google is one example.
In all these scenarios, the extension is widely available in the Chrome Web Store and sometimes even advertised. However, there’s also a targeted attack scenario where phishing pages or messages prompt victims to install a malicious extension that’s not available to the general public.
Centralized distribution through the Chrome Web Store, combined with automated updates for both the browser and extensions, often results in users unknowingly ending up with a malicious extension without any effort on their part. If an extension already installed on a computer receives a malicious update, it will be installed automatically.
Organizational defenses against malicious extensions
In his talk, Athanasios offered a number of general recommendations:
- Adopt a company policy regarding the use of browser extensions.
- Prohibit any extensions not explicitly included in a list approved by the cybersecurity and IT departments.
- Continuously audit all installed extensions and their versions.
- When extensions are updated, track changes in permissions they’re granted, and monitor any changes in the ownership of the extensions or their developer team.
- Incorporate information about the risks of, and rules for, using browser extensions into security awareness training programs for all employees.
We add a few practical insights and specific considerations to these recommendations.
Restricted list of extensions and browsers. In addition to applying security policies to the company’s officially approved browser, it’s crucial to prohibit the installation of portable versions and trendy AI browsers like Comet or other unauthorized solutions that allow the same dangerous extensions to be installed. When implementing this step, ensure that local administrator privileges are restricted to the IT staff and other personnel whose job duties strictly require them.
As part of the policy for the company’s main browser, you should disable developer mode and prohibit the installation of extensions from local files. For Chrome, you can manage this via the Admin console. These settings are also available through Windows Group Policies, macOS configuration profiles, or via a JSON policy file on Linux.
Managed updates. Implement version pinning to prevent updates for allowed extensions from being installed company-wide immediately. The IT and cybersecurity teams need to regularly test new versions of approved extensions and pin the updated versions only after they’ve been vetted.
Multi-layered defense. It’s mandatory to install an EDR agent on all corporate devices to prevent users from launching unauthorized browsers, mitigate the risks of visiting malicious phishing sites, and block malware downloads. It’s also necessary to track DNS requests and browser network traffic at the firewall level for real-time detection of communications with suspicious hosts and other anomalies.
Continuous monitoring. Use EDR and SIEM solutions to collect browser state details from employee workstations. This includes the list of extensions in each installed browser, along with the manifest files for version and permission analysis. This allows for the rapid detection of new extensions being installed or the version being updated and granted permission changes.
How to vet browser extensions
To implement the controls discussed above, the company needs an internal database of approved and prohibited extensions. Unfortunately, application stores and the browsers themselves offer no mechanisms to assess risk on an organizational scale, or to automatically populate such a list. Therefore, the cybersecurity team has to create both this process and the list. Employees will also need a formal procedure for submitting requests to add extensions to the approved list.
The assessment of business need and available alternatives is best conducted with a representative from the relevant business unit. However, the risk assessment remains entirely the responsibility of the security team. It’s not necessary to manually download extensions and cross-reference them across different extension stores. This task can be handled by a range of tools, such as open-source utilities, free online services, and commercial platforms.
Services like Spin.AI and Koidex (formerly ExtensionTotal) can be used to gauge the overall risk profile. Both maintain a database of popular extensions, so assessment is typically instant. They use LLMs to generate a brief summary of the extension’s properties, but also provide detailed analysis, including required permissions, the developer’s profile, and the history of versions, ratings, and downloads.
To examine core data on extensions, you can also use Chrome-Stats. While primarily designed for extension developers, this service displays ratings, reviews, and other store data. Crucially, it allows users to directly download the current and several previous versions of an extension, which simplifies incident investigation.
You can employ tools like CRX Viewer for a deeper analysis of suspicious or mission-critical extensions. This tool allows analysts to examine the extension’s internal components, conveniently filtering and displaying the contents with an emphasis on the HTML and JavaScript code.
Kaspersky official blog – Read More
New in Snort3: Enhanced rule grouping for greater flexibility and control
Today, Cisco Talos is introducing new capabilities for Snort3 users within Cisco Secure Firewall. These enhancements are designed to give you greater flexibility in how you manage, organize, and prioritize detection rules. They also make it easier to align SNORT® rules with your organization’s specific security needs.
The new “Severity” rule group
In Snort3, rule groups let you organize and manage detection rules according to specific criteria. Previously, only two top-level groups were available:
- Rule Category: groups rules by Snort2 categories such as FILE-OTHER, MALWARE-CNC, etc.
- MITRE ATT&CK: groups rules by attacker behaviors and techniques
These groups allow you to set a security level from 0 (all rules disabled) to 4 (all rules enabled).
The new Severity rule group introduces a third way to organize rules — by vulnerability severity, using CVSS scores. Rules are grouped as low, medium, high, or critical, allowing your team to prioritize detection based on the impact and urgency of vulnerabilities, rather than just category or behavior.
This makes it easier to focus attention and resources where they matter most.
Flexible rule group creation based on time range
With the Severity group, you can define how far back in time you want your coverage to extend:
|
Level |
Coverage |
Description |
|
0 |
None |
No rules enabled |
|
1 |
Last 2 years |
Focuses on recent, high-impact vulnerabilities |
|
2 |
Last 5 years |
Balanced coverage of recent and mid-term threats |
|
3 |
Last 10 years |
Broad coverage for long-lived environments |
|
4 |
All |
Includes all vulnerabilities detected to date |
This approach gives you precise control over rule selection and volume. It helps optimize performance while ensuring your detection policies match your organization’s patching cycles, compliance requirements, and risk profile.
We’re also looking to develop more top-level groupings in the coming quarters. More details will be shared in due course.
What this means for your environment
Configuring Snort3 previously required enabling rules individually or applying a predefined ruleset and then tuning manually. We know this wasn’t the most time-efficient process, so the Snort analyst team worked to simplify it with the new features announced today.
You can now:
- Enable rule groups aligned with your own internal policies
- Scale configurations across multiple environments without managing individual rules
- Adjust detection depth easily by time range or severity level
These capabilities make it simpler to maintain consistent, targeted detection coverage — whether you’re running large, distributed networks or smaller environments with tailored security priorities.
Conclusion
The new Severity rule group and expanded rule group model give Snort3 users more flexibility and control.
By organizing rules based on vulnerability severity and timeframe, you can focus detection where it has the greatest impact, improving both efficiency and accuracy in threat management.
Cisco Talos Blog – Read More
What if your romantic AI chatbot can’t keep a secret?
Does your chatbot know too much? Think twice before you tell your AI companion everything.
WeLiveSecurity – Read More