Intelligence Center

Threat Research

Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework

Cisco Talos uncovered “DKnife,” a fully featured gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants. Learn More

UAT-8837 targets critical infrastructure sectors in North America

Cisco Talos is closely tracking UAT-8837, a threat actor we assess with medium confidence is a China-nexus advanced persistent threat (APT) actor. Learn More

UAT-7290 targets high value telecommunications infrastructure in South Asia

Talos assesses with high confidence that UAT-7290 is a sophisticated threat actor falling under the China-nexus of advanced persistent threat actors (APTs). UAT-7290 primarily targets telecommunications providers in South Asia. Learn More

Fortify Your Defense

Evolve your incident response with intelligence-led proactive services and deep expertise that only Talos can offer, before –and during– an active emergency. Anyone can stand behind you – Talos IR stands beside you, every step of the way.

Together, we can reduce downtime and mitigate risk. Get started today.

Learn More

Latest Talos Takes Podcast Episodes

February 12, 2026
IR Trends Q4 2025: Ransomware chills and phishing heats up

What separates organizations that successfully fend off ransomware from those that don’t? What were the top threats facing organizations? Can we (pretty please) get a sneak peek into the 2025 Year in Review?Amy is joined by Dave Liebenberg, Strategic Analysis Team Lead, to break down key findings from Q4 2025's Cisco Talos Incident Response Quarterly Trends Report. From the top threats facing organizations — like the persistent exploitation of public-facing applications and the rise of new vulnerabilities such as Oracle EBS and React2Shell — to the unexpected drop in ransomware cases, this episode is packed with useful info. Episode resources:Q4 2025 Quarterly Trends Report: https://blog.talosintelligence.com/ir-trends-q4-2025/Qilin blog: https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/Cybersecurity on a Budget blog: https://blog.talosintelligence.com/cybersecurity-on-a-budget-strategies-for-an-economic-downturn/

January 28, 2026
Cracking the code: What encryption can (and can’t) do for you

Step into the fascinating world of cryptography. Host Amy Ciminnisi sits down with Yuri Kramarz from Cisco Talos Incident Response and Tim Wadhwa-Brown from Cisco Customer Experience to learn what encryption really accomplishes, where it leaves gaps, and when defenders need to take proactive measures.Whether you’re picturing classic codebreakers or the latest quantum-proof ciphers, this episode unpacks the essentials: what encryption and hashing actually mean, why key management is a make-or-break factor, and how even the best algorithms can fall short if the basics aren’t handled right.G7's "Coordinating the Transition to Post-Quantum Cryptography in the Financial Sector" roadmap: https://home.treasury.gov/news/press-releases/sb0355

Why Cisco Talos?

Talos is Cisco's threat intelligence research organization, an elite group of security experts devoted to providing superior protection for our customers, products and services.

Our job is your defense.

Talos powers the Cisco portfolio with comprehensive intelligence.

Every customer environment, every event, every single day, all around the world.