Cisco Talos

Cisco Talos
TypePublic Company
IndustryComputer and Network Security
Headquarters
Fulton, Maryland
ParentCisco Systems, Inc.
Websitehttps://talosintelligence.com/

Cisco Talos (Talos), or Cisco Talos Threat Intelligence Group, is a cybersecurity threat intelligence team that operates as part of Cisco Systems, Inc., and is based in Fulton, Maryland. Talos provides threat intelligence that supports Cisco Security products and services, such as malware detection, DNS security, and email filtering. The group partners with industry and government entities to prevent cybersecurity threats. The group also maintains several open-source security tools, including the Snort intrusion prevention system and the ClamAV antivirus engine.

The company is known for its involvement in several high-profile cybersecurity investigations.

History

Sourcefire was founded in 2007 by Martin Roesch, the creator of the Snort intrusion prevention system. Sourcefire created an original commercial version of Snort known as the "Sourcefire 3D System," which eventually became the Firepower line of network security products. The company's headquarters were in Columbia, Maryland in the United States, with offices across the globe.

On July 23, 2013, Cisco Systems announced a definitive agreement to acquire Sourcefire for $2.7 billion.[1] After Cisco's acquisition of Sourcefire, the company combined the Sourcefire Vulnerability Research Team (Sourcefire VRT), Cisco's Threat Research, Analysis, and Communications (TRAC) team, and Security Applications (SecApps) to form Cisco Talos in August 2014. Today, Talos sits under the Cisco Secure umbrella and operates the Cisco Talos Incident Response (Talos IR) team.[2]  

In 2014, Cisco Talos helped co-found the Cyber Threat Alliance, a not-for-profit organization with the goal of improving cybersecurity "for the greater good"[3] by encouraging collaboration between cybersecurity organizations by sharing cyber threat intelligence[4] amongst members. As of 2022, the organization reported more than 40 members, including Fortinet, Checkpoint, Palo Alto Networks and Symantec.[5]

In June 2017, the team "SOLAT in the SWEN" from Talos placed first in the inaugural Fake News Challenge (FNC-1), a competition aimed at developing tools to automatically detect the stance of news articles relative to headlines using artificial intelligence and machine learning techniques.[6][7] Out of 80 registered teams and 50 submitted entries, the winning Talos team used a hybrid approach leveraging deep convolutional neural networks, pre-trained word vectors, and gradient-boosted decision trees, achieving a relative score of 82.02%.[7][8]

In 2019, Cisco Security Incident Response Services group announced a new partnership with Talos,[9] becoming Cisco Talos Incident Response (Talos IR).[2] Since the creation of Talos IR, the group was named as a leader by IDC in the 2021 MarketScape for Worldwide Incident Readiness Services[10] (doc #US46741420, November 2021). Talos IR was also added to the approved vendor list on the Bundesamt für Sicherheit in der Informationstechnik (BSI) Advanced Persistent Threat (APT) response service providers list in May 2022.

In January 2021, Talos launched Snort3, designed to make the software easier to use.[11]

In July 2023, Cisco and Talos helped to launch the Network Resilience Coalition, a group of technology companies working to ensure users and companies upgrade and update their network infrastructure.[12] The effort was launched after the discovery of JaguarTooth, a massive campaign targeting unpatched wireless routers.[13]

Threat research and protection

Talos regularly collects data on the latest cybersecurity threats, malware, and threat actors through several avenues. That information then powers Cisco Secure's products, including Cisco Secure Cloud[14] and Cisco Secure Endpoint.[15]

The FBI and U.S. Cybersecurity and Infrastructure Security Agency has credited Talos with several major security research breakthroughs, including the VPNFilter malware that could take over home wireless routers, the BlackCat ransomware group,[16] the active exploitation of the PrintNightmare vulnerability[17] in Microsoft Windows and the router malware, a cousin of VPNFilter.

In 2017, Talos discovered a malware known as Nyetya[18] (or "NotPetya") disguising itself as an update for the Ukrainian tax software[19] MeDoc. Nyetya was originally believed to be a ransomware attack targeting multinational corporations. But Talos was amongst the first threat research groups to discover that the attack was deliberately designed to destroy data and target Ukraine.

In May 2018, Talos worked with the FBI in the U.S. to disclose the existence[20] of a widespread wireless router malware known as VPNFilter. At the time of their initial disclosure, Talos stated that as many as 500,000 networking devices,[21] mainly consumer-grade internet routers, were already infected with the malware across 54 countries.[22] VPNFilter essentially acted as a "kill switch" the threat actor could pull at any time to render the device useless. The FBI would go on to release a warning[23] telling users of the affected routers to factory reset their devices to protect against the malware. American law enforcement agencies would eventually go on to seize the botnet associated with VPNFilter and even backdoored some consumer routers. A variant of VPNFilter known as Cyclops Blink would arise again in 2022[24] in Ukraine after Russia's invasion.

In early 2018, Talos responded to a major cyber attack against the Winter Olympics in Pyeongchang, South Korea. Eventually dubbed "Olympic Destroyer," Talos found the actors wanted to completely wipe computers used on-site for the opening ceremony, rendering them unusable. The cyber attack disrupted the Olympics' official website the day before the opening ceremony, and attendees were unable to access the site or print their tickets to attend the Olympic events. The Wi-Fi in Pyeonchang Olympic Stadium also stopped working for several hours before returning to normal. Although many media outlets reported the attack came from a Russian threat actor, Talos stated there was too much doubt surrounding this assertion to attribute the attack confidently. Talos has since gone on to work on Olympic cybersecurity at other Games.  

Since 2021, Cisco has served as the NFL’s Official Enterprise Networking Partner and an Official Cybersecurity Partner. Talos has provided cybersecurity support for several Super Bowls and NFL international games.[25][26]

Starting in 2022, Talos has been heavily involved in protecting Ukraine's network during the 2022 Russo-Ukrainian War. The company announced in early March 2022 that it was directly operating security products 24/7 for critical customers in Ukraine. More than 500 employees in Cisco were assisting at the time in collecting open-source intelligence for Talos to act on. Talos researchers also created Ukraine-specific protections based on the intelligence they received. The company also wrote about numerous cyberattacks targeting Ukraine during Russia's invasion, including countless spam campaigns and wiper malware families.

In December 2023, CNN reported on Cisco Talos' initiative to help protect Ukraine’s power grid amid ongoing Russian attacks.[27][28][29] The effort addressed Russian interference with the GPS systems that Ukraine relies on to synchronize the signals necessary to manage its electricity flow.[27][28] Cisco’s industrial Ethernet switches were modified and equipped with robust internal clocks known as oven-controlled crystal oscillators, so the substations could maintain accurate timing and communication even when GPS signals were jammed or unavailable.[27][28] The prototypes were covertly delivered to Ukraine with assistance from U.S. agencies using humanitarian aid flights, and dozens of the devices were installed across the country, protecting Ukraine’s energy infrastructure.[27][28][29]

Vulnerability Research team

Cisco Talos has a Vulnerability Research team that identifies high-priority security vulnerabilities[30] In computer operating systems, software and hardware, including platforms like ICS and IoT systems. This team works with vendors to disclose and patch more than 200 vulnerabilities a year.

References

  1. ↑ "Cisco Agrees to Buy Sourcefire in $2.7 Billion Deal". Bloomberg.com. 2013-07-23. Retrieved 2022-08-10.
  2. 1 2 "Cisco Talos Incident Response || Cisco Talos Intelligence Group - Comprehensive Threat Intelligence". talosintelligence.com. Retrieved 2022-08-10.
  3. ↑ Holseberg, Kate. "Home". Cyber Threat Alliance. Retrieved 2022-08-10.
  4. ↑ "Cyber Threat Alliance". Cyber Threat Alliance. Retrieved 2022-08-10.
  5. ↑ Holseberg, Kate. "Membership". Cyber Threat Alliance. Retrieved 2022-08-10.
  6. ↑ "FNC". Fake News Challenge Official Website. Retrieved December 11, 2025.
  7. 1 2 Aljrees, Turki; Cheng, Xiaochun; Ahmed, Mian Muhammad; Umer, Muhammad; Majeed, Rizwan; Alnowaiser, Khaled; Abuzinadah, Nihal; Ashraf, Imran (2023). "Fake news stance detection using selective features and FakeNET". PLoS ONE. Retrieved December 9, 2025.
  8. ↑ Simonite, T. (June 15, 2017). "Humans Can't Expect AI to Just Fight Fake News for Them". WIRED. Retrieved December 9, 2025.
  9. ↑ Munshaw, Jon (5 November 2019). "Talos, Cisco Incident Response team up to offer more protection than ever". Retrieved 2022-08-10.
  10. ↑ "IDC MarketScape Worldwide Incident Readiness Services 2021 Vendor Assessment". idcdocserv.com. Retrieved 2022-08-10.
  11. ↑ Nestor, Marcus (January 20, 2021). "Snort 3 Open-Source Intrusion Prevention System Released with Major New Features". 9to5Linux. Retrieved December 6, 2025.
  12. ↑ "Network Resilience Coalition launches to improve patch, vulnerability management".
  13. ↑ "APT28 exploits known vulnerability to carry out reconnaissance and deploy malware on Cisco routers". National Cyber Security Centre. April 18, 2023. Retrieved December 6, 2025.
  14. ↑ "Cisco Security Cloud: Open, Integrated Platform". Cisco. Retrieved 2022-08-10.
  15. ↑ "Cisco Secure Endpoint (Formerly AMP for Endpoints)". Cisco. Retrieved 2022-08-10.
  16. ↑ "FBI: This ransomware written in the Rust programming language has hit at least 60 targets". ZDNet. Retrieved 2022-08-10.
  17. ↑ "Russian State-Sponsored Cyber Actors Access Network Misconfigured with Default MFA Protocols | CISA". www.cisa.gov. 15 March 2022. Retrieved 2022-08-10.
  18. ↑ Alexander Chiu (27 June 2017). "New Ransomware Variant "Nyetya" Compromises Systems Worldwide". Retrieved 2022-08-10.
  19. ↑ Biasini, Nick (5 July 2017). "The MeDoc Connection". Retrieved 2022-08-10.
  20. ↑ "Justice Department Announces Actions to Disrupt Advanced Persistent Threat 28 Botnet of Infected Routers and Network Storage Devices". www.justice.gov. 2018-05-23. Retrieved 2022-08-10.
  21. ↑ Largent, William (23 May 2018). "New VPNFilter malware targets at least 500K networking devices worldwide". Retrieved 2022-08-10.
  22. ↑ "Talos finds new VPNFilter malware hitting 500K IoT devices, mostly in Ukraine". ZDNet. Retrieved 2022-08-10.
  23. ↑ Limer, Eric (2018-05-30). "Reboot Your Router, But Don't Stop There". Popular Mechanics. Retrieved 2022-08-10.
  24. ↑ Malhotra, Asheer (24 March 2022). "Threat Advisory: DoubleZero". Retrieved 2022-08-10.
  25. ↑ Holmes, Aaron (February 17, 2022). "The NFL's cybersecurity chief explains how the league worked with Cisco to fend off cyberattacks during the Super Bowl". Business Insider. Retrieved December 10, 2025.
  26. ↑ Vijayan, Jai (January 28, 2025). "Super Bowl LIX Could Be a Magnet for Cyberattacks". Dark Reading. Retrieved December 10, 2025.
  27. 1 2 3 4 Lyngaas, Sean (November 21, 2023). "Exclusive: This pizza box-sized equipment could be key to Ukraine keeping the lights on this winter". CNN. Retrieved December 15, 2025.
  28. 1 2 3 4 McLaughlin, Jenna (April 17, 2024). "How Ukraine is keeping the power grid running amidst war with Russia". NPR. Retrieved December 13, 2025.
  29. 1 2 Goodwin, Grace Eliza (November 21, 2023). "US officials helped Cisco sneak a cybersecurity prototype into Ukraine using a plane carrying humanitarian aid". Business Insider. Retrieved December 13, 2025.
  30. ↑ "Zero-Day Vulnerability & Disclosed Vulnerabilities Reports || Cisco Talos Intelligence Group - Comprehensive Threat Intelligence". www.talosintelligence.com. Retrieved 2022-08-10.
This page is issued from Wikipedia. The text is available under Creative Commons Attribution-Share Alike 4.0 unless otherwise noted. Additional terms may apply for the media files.