Talos Q3 2026 IR trends: help-desk vishing and rising ransomware
Phishing led initial access in just over one-third of engagements, down from over 50 percent, while ransomware rose to 27 percent.
66
Threat actor
Salt Typhoon
- Mentions · 7d1
- Mentions · 30d4
- All mentions18
- First seenAug 21, 2026
- Last mentioned1d ago
Timeline
18 articles · newest firstMITRE ATT&CK v20 adds AI abuse, MFA bypass, and utility attacks
Enterprise gains nine entries, ICS adds two campaigns plus analytics, and Mobile restores sideloading and NGate.
61
MITRE ATT&CK v20 Adds New AI Attack Techniques for Prompt Injection and Data Theft
MITRE ATT&CK v20 adds Enterprise techniques for prompt injection, AI exfiltration and result poisoning.
63
MI5 Warns Over 100 Academics Helped China's Espionage Plans
MI5 warned that over 100 UK-linked academics unknowingly aided MSS espionage via projects funded through China's CGTRI/CAGT front organization.
58
Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions
Nation-state actors abuse SS7, BGP, and unpatched telecom routers, including Salt Typhoon persistence via GRE tunnels.
60
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol
Elttam disclosed a pre-authentication remote code execution flaw in the 33-year-old TACACS+ protocol used across nearly all enterprise networks, with patches only partially available.
60
Lawmakers introduce bill for voluntary telecom cyber rules after Salt Typhoon hacks
Sens. Warner and Cruz introduced a bill for voluntary telecom cybersecurity practices after Salt Typhoon.
55
Bipartisan Senate leaders introduce bill to bolster telecom cybersecurity in response to Salt Typhoon hacks
Senators Warner and Cruz introduced a bill for voluntary telecom cybersecurity standards after the Salt Typhoon campaign.
58
China's Salt Typhoon backdoors Latin American orgs with new snooping malware
China-linked Salt Typhoon deployed new modular backdoor SparroWocky against Latin American government agencies since August 2025.
76
China’s FamousSparrow hackers target Latin America with new backdoor
ESET links a new SparroWocky backdoor campaign against Latin American government agencies to Chinese espionage group FamousSparrow.
78
China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
China-aligned espionage group FamousSparrow replaced SparrowDoor with a new modular backdoor, SparroWocky, targeting government entities across eight Latin American countries since August 2025.
74
Beware the SparroWock: The backdoor that bites, the commands that catch
ESET attributes a new modular C++ backdoor, SparroWocky, to China-aligned group FamousSparrow, deployed against government entities across Latin America since August 2025.
75
Post-quantum cryptography adoption and the national security implications
Opinion analysis argues quantum computing favors nation-state espionage, leaving lagging post-quantum adoption at critical infrastructure exposed to harvest-now-decrypt-later attacks.
32
Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch
Cisco patched seven IOS XR vulnerabilities, two rated CVSS 9.8, allowing unauthenticated remote code execution and root access on carrier routers; no exploitation observed.
68
Autonomous Threat Operations in action: Real results from Recorded Future’s own SOC team
Recorded Future reports its Autonomous Threat Operations platform enabled 15-20 weekly automated threat hunts in its own SOC.
24
China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks
Sygnia links the China-nexus Fire Ant campaign to UNC3886, showing hackers weaponized compromised Cisco IOS XR routers for espionage and wider intrusions.
70
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.
78
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall
Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.
48
Related CVEs
by mentions- CVE-2023-20198100%10.0Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited)
- CVE-2024-3400100%10.0Unauthenticated Root Command Injection in Palo Alto Networks PAN-OS GlobalProtect
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2023-2027393%7.2Authenticated Command Injection (Root) in Cisco IOS XE Web UI
- CVE-2026-20274<1%9.8Critical Improper Resource Control Flaws in Cisco IOS XR Software
- CVE-2026-20279<1%9.8Critical Improper Access Control in Cisco IOS XR Software
Appears with
- SparroWockymalware · 4
- FamousSparrowthreat actor · 4
- ESETvendor · 4
- Ciscovendor · 4
- Cisco IOS XRproduct · 3
- Volt Typhoonthreat actor · 2
- MITREvendor · 2
- Fire Antthreat actor · 2
- Earth Estriesthreat actor · 2
- UNC3886threat actor · 2
- National Telecommunications and Information Administrationorganization · 2
- U.S. Senateorganization · 2
- SparrowDoormalware · 2
- The Gentlementhreat actor · 2
- Nimbus Manticorethreat actor · 2
- APT38threat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.