China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) network by…
Tag: Cisco Talos
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A sophisticated device code phishing campaign targeting Microsoft 365 accounts has been observed between late June and early July 2026, leveraging collaboration-themed…
ARToken: Advanced PhaaS Panel for Device Code Phishing and BEC Operations
ARToken is a fully-featured PhaaS operator panel identified by Cisco Talos, sharing infrastructure with EvilTokens. It exposes over 80 API endpoints for…
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber attacks…
UAT-7237: Hacking Group Targeting Web Infrastructure in Taiwan
UAT-7237 is a hacking group first flagged by Cisco Talos in August 2025 for campaigns against web infrastructure entities in Taiwan. It…
Cisco Talos: Threat Intelligence Research on UAT-7810
Cisco Talos is the threat intelligence division of Cisco that identified and reported on the activities of Chinese APT UAT-7810, including the…