Talos Takes

Continuing our “Kenna 101” series, Jon is joined this week by Jerry Gamblin, Kenna’s director of security research. Jerry is an expert at all things CVE’s, so we reflect on reading vulnerability reports and analyzing specific CVEs. We discuss if “severity” scores even really mean anything, and how to interpret a maximum 10/10 score versus an attacker vector or type of vulnerability.

It’s tax season! You know what that means — sadness, frustration and scams. Host Jon Munshaw sat down with Nick Biasini from the Talos Outreach team to talk about common tactics adversaries use around this “holiday” to try and spread malware, steal personal information and take users’ money. We talk about free security tools you can deploy to block these types of threats, common spam tactics to keep an eye out for and other services that can help you prepare for a worst-case scenario.

We’re kicking off a new series of episodes called “Kenna 101” highlighting Cisco’s newest partner, Kenna Security. Kenna is a risk management platform for vulnerabilities that allows users to view what vulnerabilities exist in their environment and helps them create a plan for patching and mitigation. We’re starting things off with the CTO of Kenna, Ed Bellis, to talk about the basics of Kenna and its risk scores.

When most people think of the “Metaverse,” they may first think of the company Meta — the recently rebranded Facebook. After all, what other company would really want everyone taking meetings virtually using avatars while you share your cryptocurrency wallets and personal information with them? The Metaverse is actually much larger than this, though. So in this Talos Takes episode, we’re trying to demystify the Metaverse and look at what it is, exactly. Researcher Jaeson Schultz recaps his recent blog post on the matter, and then he and Jon talk about the potential security pitfalls that could arise from adopting the Metaverse.

Jon and Nick sit down for a few minutes to talk about U.S. President Joe Biden’s recent Executive Order on more heavily regulating cryptocurrency. For a primer on this episode, you can read a quick overview here. This episode pretty much sums it up as being a good thing for anyone who uses cryptocurrency legitimately, and bad for anyone who uses crypto to do anything illegal. We discuss how greater regulation could affect ransomware operators who rely on virtual currency for ransom payments and illegitimate miners, and why no one using Bitcoin legitimately should be worried.

Cisco Talos threat intelligence team and Cisco ThousandEyes went live on Talos’ social media platforms Friday to provide guidance on current cyberattacks and insight into internet activity in Ukraine. Both teams are actively monitoring the digital landscape and openly sharing essential findings to contribute to the safety of our customers globally.

Many of our teams have set aside normal tasks, now spending their time watching over Ukrainian networks. Other teams have focused on protecting refugees, physically and digitally. Still, others have volunteered their free time contributing critical components to our open-source intelligence work. The audio version of this briefing will share what we have seen and how you can protect your data, network and teams.

In the latest entry in the “Days of our Ransomware” series, Azim Khodjibaev joins Jon to talk about some recent ransomware drama. Dark web forums have been going nuts since Russia arrested and charged several alleged members of the REvil ransomware gang in January. Azim discusses how there’s been a power grab since those arrests, and we discuss what else it might take to shut down many of these wide-reaching ransomware groups. Threat actors: They get into the same petty arguments we all do in Slack.

As the Ukraine situation evolves, we figured it was an important time to check in with the specific threats government agencies across the globe have started to warn us about. Joe Marshall, Talos’ resident industrial control systems expert, joins this week’s episode of Talos Takes to talk about potential threats to Ukraine’s power grid should kinetic warfare break out in the area. We also touch on what potential threats America’s infrastructure faces if our government leaders were to oppose any Russian actions in the region. It’s admittedly a tangled web currently — but for the most current information on this, check out the Talos blog on the topic.

What’s a commodity RAT? And how does that make it different from your run-of-the-mill RAT? Is that RAT different than a trojan? In this week’s Talos Takes episode, we answer these questions and more to provide you a quick overview of remote access trojans/tools (aka RATs) and how commodity RATS specifically differ from their “normal” brethren. Asheer Malhotra from our Outreach team has been looking at several commodity RATs for months now and is here to take you to class for 10 minutes.

Jon Munshaw and Nick Biasini sit down for a few minutes to discuss the latest on the ongoing cyber attacks and security concerns in Ukraine. They discuss how a recent set of attacks against government-run websites compares to past attacks like NotPetya, and provide guidance for any companies who may be based in, or do business in, Ukraine. For more of Talos’ insight on this, please continue to check back on our blog post here.