Cisco Talos researcher Ryan Fetterman on October 31, 2026 published an analysis of VOLTA-AUTODOXER, a self-deleting Windows infostealer that follows a broad credential-theft pass with a large...

At a Glance Malware Family NIK C2 framework (Go-based 64-bit Windows implant, OpenAI API client, and screen-locking ransomware) Threat Actor Unattributed operator group (internal project labeled nik_panel; intent unconfirmed) Target / Victims Windows endpoints holding cryptocurrency wallets, browser logins, and OpenAI developer keys (active server observed in the wild) Delivery Vector

TL;DR Threat actors tracked as UAT-11473 exploited a critical authentication bypass flaw in Cisco SD-WAN Catalyst Controllers to deploy a custom implant called KeyDrift malware. Through this KeyDrift malware UAT-11473 operation, attackers injected malicious modules directly into control-plane processes to steal encryption keys and maintain hidden backdoors. Furthermore, investigators found strong infrastructure links connecting this campaign to Volt Typhoon's covert relay network.

TL;DR Threat actors tracked as UAT-11473 exploited a critical authentication bypass flaw in Cisco SD-WAN Catalyst Controllers to deploy a custom implant called KeyDrift malware. Through this KeyDrift malware UAT-11473 operation, attackers injected malicious modules directly into control-plane processes to steal encryption keys and maintain hidden backdoors. Furthermore, investigators found strong infrastructure links connecting this campaign to Volt Typhoon's covert relay network.

TL;DR Security researchers uncovered an active espionage campaign led by the UAT-6275 threat actor against government agencies across the Commonwealth of Independent States (CIS). Between June 2025 and August 2026, the group deployed four distinct infection chains, including a WinRAR vulnerability exploit. Moreover, operational security mistakes exposed the group's staging servers and GitHub repositories to investigators. What Happened in the Campaigns…

At a glance Actor UAT-11985 (tracked by Cisco Talos) Activity Spear-phishing, QR code phishing (quishing), and AitM credential theft Targets People affiliated with Taiwan research organizations Scale Not disclosed; Talos analyzed three lure emails Status No law-enforcement action reported Source Cisco Talos research report TL;DR Cisco Talos found a spear-phishing campaign against people linked to Taiwan research groups in mid-2026. The actor, UAT-11985, sent fake event invitations that led to an AitM phishing kit built to steal Google logins and MFA codes.

China-nexus UAT-11587 targets Asian government and policy groups with Antino, a Rust backdoor that uses Microsoft 365 for C2.

A New Backdoor Hides in Microsoft 365 Traffic About 350 computers in government and policy organizations across Asia have been infected with a new backdoor called Antino. A China-linked cluster named UAT-11587 used Outlook and OneDrive as its command channel. In this way, it disguised malicious traffic as ordinary Microsoft 365 activity. Scope of the Campaign Cisco Talos has watched the campaign since at least September 2025.

Chinese government-backed hacking groups allegedly targeted AI experts, think tanks, universities, and government organizations across Asia through phishing lures and credential theft. Cisco Talos and Proofpoint linked the activity to the Antino backdoor and multiple campaigns aimed at intelligence gathering and access persistence. #Antino #Proofpoint #CiscoTalos #LynneEdwardsParker #HeidiCreboRediker...

At a Glance Attribute Details Actor or Group UAT-11587 (suspected China-nexus group; overlaps with Jewelbug) Activity Type Cyberespionage, spear-phishing, DLL sideloading, dead-drop C2 Targets or Victims Government, military, think tanks, and policy bodies across Asia Scale Approximately 350 compromised endpoints across eight countries Jurisdiction / Status Suspected Chinese state-sponsored threat group; uncharged Source

At a Glance Summary Attribute Details Malware Family CLOSEDQUORUM Threat Actor Unknown developer (suspected ties to criminal carding forums since 2025) Target Victims Windows endpoints, cryptocurrency wallets, and browser credentials Delivery Vector Custom binary compilation template (in-the-wild delivery unconfirmed) Key Capabilities Autonomous LLM-driven C2, credential theft, process injection, persistence Source Cisco Talos (Project CAIRN) Executive Summary The newly identified CLOSEDQUORUM implant introduces autonomous command and control using commercial artificial intelligence providers.

Cisco Talos released CAIRN, an open-source framework that classifies AI-integrated malware using only file metadata and cognitive artifacts, without downloading or executing samples. Their first public finding is CLOSEDQUORUM, a Windows implant that uses multiple commercial LLMs to decide its next move and is designed to steal credentials and crypto wallets. #CiscoTalos #CAIRN #CLOSEDQUORUM #LAMEHUG #CERT-UA #DeepSeek #Qwen #Mistral #Gemini

ClosedQuorum is a new Windows malware that uses Google Gemini, DeepSeek, Qwen, and Mistral AI to autonomously choose post-compromise actions without human operator commands. Cisco Talos says it can steal credentials, inject shellcode, or persist on infected hosts, and that stolen data is exfiltrated through a Discord webhook. #ClosedQuorum #GoogleGemini #DeepSeek #Qwen #Mistral #CiscoTalos

Cisco Talos says three threat clusters exploited two newly patched Cisco Secure Firewall Management Center flaws, leading to web shells, credential theft, reverse shells, and proxy deployment. The attacks were linked to Qilin ransomware, Cyclops Blink, and activity overlapping with the Sandworm APT group. #CVE-2026-20079 #CVE-2026-20316 #Qilin #CyclopsBlink #Sandworm #CiscoTalos

ClickFix has abandoned its habit of knocking at PowerShell and has taken up residence directly inside the browser. Cisco Talos has disclosed a campaign in which the victim is invited to paste JavaScript into Chrome's address bar or to install it via Tampermonkey. Once executed, the code operates within the page itself and requires no separate malicious program on the system.

At a Glance Malware type Browser-injected web skimmer Threat actor Unattributed; linked to "The Protocol One" persona Targets Crypto traders using SwapZone and SimpleSwap Delivery vector ClickFix-style lures on Telegram, DarkForums, paste sites Key capabilities Google Sheets C2, address swapping, clipboard hijacking Source Cisco Talos TL;DR Cisco Talos uncovered a crypto-stealing campaign that turns the ClickFix browser attack into a web skimmer.

At a glance Factor Details Actor UAT-10147 (Suspected Chinese-speaking cybercrime threat group) Activity Type Search engine optimization (SEO) fraud, data theft, and automated server exploitation Targets Windows and Linux web servers in government, education, technology, media, and gaming Scale Over 170,000 target URLs identified across more than 15 countries Status Active cybercrime threat under ongoing industry monitoring Source

At a glance Actor or group: Suspected Chinese-speaking cybercriminals. Activity type: Phishing-as-a-Service (PhaaS). Targets or victims: Shoppers using Shopify, PayPal, Apple, and Klarna. Scale: Widespread SMS campaigns across Southeast Asia and the Middle East. Jurisdiction or law-enforcement status: The FBI targeted the related "Outsider" platform in June 2026. Source: Cisco Talos. TL;DR Cisco Talos recently exposed the JWR phishing framework. This platform allows attackers to monitor victims in real time.