Source: Cisco Talos

3 stories in the last 7d

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 1 Ransomware 1 Research 1

SeverityAll critical 0 high 1 medium 0 low 0 info 2 source: Cisco Talos ✕

Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use

Cisco Talos reports 90 ransomware incidents hit Japanese organizations in H1 2026, led by The Gentlemen, with Qilin using AI for efficiency.

Cisco Talos observed 90 ransomware incidents against Japanese organizations from January to July 2026, up about 4.7% year over year, with manufacturing accounting for 34% of victims. The Gentlemen was the most active group with 14 incidents; its leak-site listings grew from 48 in January to 105 in July. Qilin and SafePay followed with seven incidents each, and Talos notes Qilin is leveraging AI to improve operational efficiency.

Cisco Talos10:00 UTC · 1h agoRansomware in the wild

Securing the unpatchable in an age of AI-driven vulnerabilities

Cisco Talos argues AI-driven vulnerability discovery leaves unpatchable OT systems exposed, recommending virtual patching via NGFW/IPS and micro-segmentation.

AI-assisted code analysis is uncovering vulnerabilities faster than organizations can patch, leaving certified or end-of-life OT systems with unmitigated known flaws. Talos recommends virtual patching with next-generation firewalls and IPS, micro-segmentation using VLANs and ACLs, and building visibility-based inventories of legacy systems. The article cites WannaCry's impact on the NHS and 2023 exploitation of end-of-life software in government systems, and warns that air gaps and data diodes are routinely circumvented by operational shortcuts.

Cisco TalosSep 16, 10:00 UTC · 1d agoResearch

We've got one word for it, and it's usually the wrong one

Cisco Talos's Threat Source newsletter critiques 'burnout' terminology, describing four occupational injuries, and flags a UAT-10820 WebDAV stealer campaign at a Ukrainian government organization.

Cisco Talos's Threat Source newsletter argues that 'burnout' is the wrong word for most cybersecurity occupational harm, distinguishing exhaustion, secondary traumatic stress, vicarious trauma, and moral injury based on clinical literature from trauma-exposed professions. The featured disclosure describes a complex WebDAV infection chain found at a Ukrainian government organization, attributed with moderate confidence to the Russian-tracked actor UAT-10820 and assessed as an opportunistic cryptocurrency and credential-stealing operation. The campaign delivers the Amatera stealer alongside ZigCryptoStealer and NetSupport Manager, abusing BNB Smart Chain bulletproof hosting, fake CAPTCHA prompts, a vulnerable driver to kill EDR, and rundll32.exe execution of disguised DLLs with ordinal calls. Weekly headlines also cover a Microsoft Defender 'ShieldCrash' zero-day exploit released after September 2026 Patch Tuesday, a North Korean Linux espionage toolkit backdooring HAProxy, and a multi-hop Google-domain redirect phishing campaign.

Cisco TalosSep 10, 18:00 UTC · 6d agoIndustry in the wild1