Description
Welcome to this week's edition of the Threat Source newsletter.
_" They say that a person's personality is the sum of their experiences. But that isn't true, at least not entirely, because if our past was all that defined us, we'd never be able to put up with ourselves. We need to be allowed to convince ourselves that we're more than the mistakes we made yesterday. That we are all of our next choices, too, all of our tomorrows." ― Fredrik Backman _
It's December, so 'tis the season to enjoy the onslaught that is a reflection of your year. Here there be tygers... and Spotify Wrapped, Goodreads Year in Books, Duolingo Year in Review, and... and...
This is the perfect opportunity to reflect on the defining moments of your career in information security. I can predict, without fail, your defining moment. No matter the length of that career and no matter the breadth and depth of your knowledge, I can assure you that the defining moment is not when you flexed your expertise, but rather when you made the most impactful mistake you can make in your given role at the time.
Ask any practitioner for a success story and it's a struggle -- partially because they aren't that memorable and partially because it stokes the imposter syndrome fire to five-alarm bonfire levels. Ask the same practitioner for examples of huge mistakes or failures and get ready for never-ending stories. The best part about that is that not only are those stories wildly entertaining, they are also incredibly instructive. Not only have I learned the most in my career BY FAR from my mistakes, but I've learned a lot from the mistakes of my peers and friends. They just seem to make them less often, which is really infuriating (and there goes my imposter syndrome).
So, take a second to look back on the biggest mistakes in 2025 and in your career. Go on, open your Notes app (after finishing this fantastic newsletter, of course). Then pull up a stump, take some time in one of the big team get-togethers that are so common during this time of year, and share. You'll entertain, you'll teach, you'll connect, and you'll learn from your peers who will jump in to share the bizarre and hilarious missteps that led them to their current job.
_" I've missed more than 9,000 shots in my career. I've lost almost 300 games. 26 times I've been trusted to take the game winning shot and missed. I've failed over and over and over again in my life. And that is why I succeed." -- Michael Jordan _
## The one big thing
Cisco Talos _released a blog_ exploring how generative AI (GenAI) is changing cybersecurity for both attackers and defenders. Adversaries are using GenAI for coding, phishing, evasion, and vulnerability discovery, especially as uncensored models become more widely available. While GenAI's direct role in malware is still limited, its use in social engineering and vulnerability hunting is quickly growing. For defenders, GenAI provides powerful tools to process large amounts of threat data, respond to incidents faster, and proactively find code vulnerabilities.
### Why do I care?
GenAI is lowering the barrier for adversaries to launch sophisticated attacks and discover new vulnerabilities, making threats more dynamic and harder to predict. At the same time, defenders who harness GenAI effectively can level the playing field. GenAI can help defenders overcome issues created by analyst shortages and overwhelming data volumes, gaining the edge in detection and response.
### So now what?
Now's the time for security teams to start experimenting with GenAI in their daily work -- think threat detection, incident response, and reviewing code for vulnerabilities. It's also important to get comfortable with these tools and train teams so everyone knows how to use them wisely. As GenAI keeps evolving, staying flexible and combining smart automation with human expertise will be key to staying secure.
## Top security headlines of the week
**Police disrupt "Cryptomixer," seize millions in crypto**
Multiple European law enforcement agencies recently disrupted Cryptomixer, a service allegedly used by cybercriminals to launder ill-gotten gains from ransomware and other cyber activities. (_Dark Reading_)
**Malicious Rust crate delivers OS-specific malware to Web3 developer systems**
Researchers have discovered a malicious Rust package that features malicious functionality to stealthily execute on developer machines by masquerading as an Ethereum Virtual Machine (EVM) unit helper tool. (_The Hacker News_)
**Chrome, Edge extensions caught tracking users, creating backdoors**
A threat actor published over one hundred extensions, which were seen profiling users, reading cookie data to create unique identifiers, and executing payloads with browser API access. (_SecurityWeek_)
**CISA warns of ScadaBR vulnerability after hacktivist ICS attack**
CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog with an old "OpenPLC ScadaBR" flaw that was recently leveraged by hackers to deface a honeypot they believed to be an industrial control system (ICS). (_SecurityWeek_)
**New legislation targets scammers that use AI to deceive**
Following a rash of AI-assisted impersonations of U.S. officials, the bill would raise the financial and criminal penalties around using the technology to defraud. (_CyberScoop_)
## Can't get enough Talos?
**Ranksgiving Returns: The Appetizer Uprising**
Guess who's back? Hazel, Bill and Joe welcome back fresh-from-parental-leave Dave Liebenberg, who has returned with a new baby and some truly chaotic Thanksgiving opinions.
**_Cisco Talos Incident Response: Threat Hunting at GovWare 2025_**
Yuri Kramarz goes behind the scenes of the Security Operations Centre (SOC) at the GovWare Conference and Exhibition in Singapore, which Talos IR supported for the first time this year.
**_Talos Takes: When you 're told "no budget"_**
From configuring what you already have, to open-source strategies, to the impact of cybersecurity layoffs, this episode is packed with practical guidance for securing your organization during an economic downturn.
## Upcoming events where you can find Talos
* _AVAR_ (Dec. 3 - 5) Kuala Lumpur, Malaysia
* _Black Hat Europe_ (Dec. 8 - 11) London, U.K.
## Most prevalent malware files from Talos telemetry over the past week
**SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59**
MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a
Talos Rep: _https://talosintelligence.com/talos_file_reputation?s=90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59_
Example Filename: ck8yh2og.dll
Detection Name: Auto.90B145.282358.in02
**SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507**
MD5: 2915b3f8b703eb744fc54c81f4a9c67f
Talos Rep: _https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507_
Example Filename: e74d9994a37b2b4c693a76a580c3e8fe_1_Exe.exe
Detection Name: Win.Worm.Coinminer::1201
**SHA256: 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974**
MD5: aac3165ece2959f39ff98334618d10d9
Talos Rep: _https://talosintelligence.com/talos_file_reputation?s=96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974_
Example Filename: ~6325.tmp
Detection Name: W32.Injector:Gen.21ie.1201
**SHA256: c0ad494457dcd9e964378760fb6aca86a23622045bca851d8f3ab49ec33978fe**
MD5: bf9672ec85283fdf002d83662f0b08b7
Talos Rep: _https://talosintelligence.com/talos_file_reputation?s=c0ad494457dcd9e964378760fb6aca86a23622045bca851d8f3ab49ec33978fe_
Example Filename: g77wokon.html
Detection Name: W32.C0AD494457-95.SBX.TG
**SHA256: 41f14d86bcaf8e949160ee2731802523e0c76fea87adf00ee7fe9567c3cec610**
MD5: 85bbddc502f7b10871621fd460243fbc
Talos Rep: _https://talosintelligence.com/talos_file_reputation?s=41f14d86bcaf8e949160ee2731802523e0c76fea87adf00ee7fe9567c3cec610_
Example Filename: 85bbddc502f7b10871621fd460243fbc.exe
Detection Name: W32.41F14D86BC-100.SBX.TG
Welcome to this week's edition of the Threat Source newsletter.
_" They say that a person's personality is the sum of their experiences. But that isn't true, at least not entirely, because if our past was all that defined us, we'd never be able to put up with ourselves. We need to be allowed to convince ourselves that we're more than the mistakes we made yesterday. That we are all of our next choices, too, all of our tomorrows." ― Fredrik Backman _
It's December, so 'tis the season to enjoy the onslaught that is a reflection of your year. Here there be tygers... and Spotify Wrapped, Goodreads Year in Books, Duolingo Year in Review, and... and...
This is the perfect opportunity to reflect on the defining moments of your career in information security. I can predict, without fail, your defining moment. No matter the length of that career and no matter the breadth and depth of your knowledge, I can assure you that the defining moment is not when you flexed your expertise, but rather when you made the most impactful mistake you can make in your given role at the time.
Ask any practitioner for a success story and it's a struggle -- partially because they aren't that memorable and partially because it stokes the imposter syndrome fire to five-alarm bonfire levels. Ask the same practitioner for examples of huge mistakes or failures and get ready for never-ending stories. The best part about that is that not only are those stories wildly entertaining, they are also incredibly instructive. Not only have I learned the most in my career BY FAR from my mistakes, but I've learned a lot from the mistakes of my peers and friends. They just seem to make them less often, which is really infuriating (and there goes my imposter syndrome).
So, take a second to look back on the biggest mistakes in 2025 and in your career. Go on, open your Notes app (after finishing this fantastic newsletter, of course). Then pull up a stump, take some time in one of the big team get-togethers that are so common during this time of year, and share. You'll entertain, you'll teach, you'll connect, and you'll learn from your peers who will jump in to share the bizarre and hilarious missteps that led them to their current job.
_" I've missed more than 9,000 shots in my career. I've lost almost 300 games. 26 times I've been trusted to take the game winning shot and missed. I've failed over and over and over again in my life. And that is why I succeed." -- Michael Jordan _
## The one big thing
Cisco Talos _released a blog_ exploring how generative AI (GenAI) is changing cybersecurity for both attackers and defenders. Adversaries are using GenAI for coding, phishing, evasion, and vulnerability discovery, especially as uncensored models become more widely available. While GenAI's direct role in malware is still limited, its use in social engineering and vulnerability hunting is quickly growing. For defenders, GenAI provides powerful tools to process large amounts of threat data, respond to incidents faster, and proactively find code vulnerabilities.
### Why do I care?
GenAI is lowering the barrier for adversaries to launch sophisticated attacks and discover new vulnerabilities, making threats more dynamic and harder to predict. At the same time, defenders who harness GenAI effectively can level the playing field. GenAI can help defenders overcome issues created by analyst shortages and overwhelming data volumes, gaining the edge in detection and response.
### So now what?
Now's the time for security teams to start experimenting with GenAI in their daily work -- think threat detection, incident response, and reviewing code for vulnerabilities. It's also important to get comfortable with these tools and train teams so everyone knows how to use them wisely. As GenAI keeps evolving, staying flexible and combining smart automation with human expertise will be key to staying secure.
## Top security headlines of the week
**Police disrupt "Cryptomixer," seize millions in crypto**
Multiple European law enforcement agencies recently disrupted Cryptomixer, a service allegedly used by cybercriminals to launder ill-gotten gains from ransomware and other cyber activities. (_Dark Reading_)
**Malicious Rust crate delivers OS-specific malware to Web3 developer systems**
Researchers have discovered a malicious Rust package that features malicious functionality to stealthily execute on developer machines by masquerading as an Ethereum Virtual Machine (EVM) unit helper tool. (_The Hacker News_)
**Chrome, Edge extensions caught tracking users, creating backdoors**
A threat actor published over one hundred extensions, which were seen profiling users, reading cookie data to create unique identifiers, and executing payloads with browser API access. (_SecurityWeek_)
**CISA warns of ScadaBR vulnerability after hacktivist ICS attack**
CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog with an old "OpenPLC ScadaBR" flaw that was recently leveraged by hackers to deface a honeypot they believed to be an industrial control system (ICS). (_SecurityWeek_)
**New legislation targets scammers that use AI to deceive**
Following a rash of AI-assisted impersonations of U.S. officials, the bill would raise the financial and criminal penalties around using the technology to defraud. (_CyberScoop_)
## Can't get enough Talos?
**Ranksgiving Returns: The Appetizer Uprising**
Guess who's back? Hazel, Bill and Joe welcome back fresh-from-parental-leave Dave Liebenberg, who has returned with a new baby and some truly chaotic Thanksgiving opinions.
**_Cisco Talos Incident Response: Threat Hunting at GovWare 2025_**
Yuri Kramarz goes behind the scenes of the Security Operations Centre (SOC) at the GovWare Conference and Exhibition in Singapore, which Talos IR supported for the first time this year.
**_Talos Takes: When you 're told "no budget"_**
From configuring what you already have, to open-source strategies, to the impact of cybersecurity layoffs, this episode is packed with practical guidance for securing your organization during an economic downturn.
## Upcoming events where you can find Talos
* _AVAR_ (Dec. 3 - 5) Kuala Lumpur, Malaysia
* _Black Hat Europe_ (Dec. 8 - 11) London, U.K.
## Most prevalent malware files from Talos telemetry over the past week
**SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59**
MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a
Talos Rep: _https://talosintelligence.com/talos_file_reputation?s=90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59_
Example Filename: ck8yh2og.dll
Detection Name: Auto.90B145.282358.in02
**SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507**
MD5: 2915b3f8b703eb744fc54c81f4a9c67f
Talos Rep: _https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507_
Example Filename: e74d9994a37b2b4c693a76a580c3e8fe_1_Exe.exe
Detection Name: Win.Worm.Coinminer::1201
**SHA256: 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974**
MD5: aac3165ece2959f39ff98334618d10d9
Talos Rep: _https://talosintelligence.com/talos_file_reputation?s=96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974_
Example Filename: ~6325.tmp
Detection Name: W32.Injector:Gen.21ie.1201
**SHA256: c0ad494457dcd9e964378760fb6aca86a23622045bca851d8f3ab49ec33978fe**
MD5: bf9672ec85283fdf002d83662f0b08b7
Talos Rep: _https://talosintelligence.com/talos_file_reputation?s=c0ad494457dcd9e964378760fb6aca86a23622045bca851d8f3ab49ec33978fe_
Example Filename: g77wokon.html
Detection Name: W32.C0AD494457-95.SBX.TG
**SHA256: 41f14d86bcaf8e949160ee2731802523e0c76fea87adf00ee7fe9567c3cec610**
MD5: 85bbddc502f7b10871621fd460243fbc
Talos Rep: _https://talosintelligence.com/talos_file_reputation?s=41f14d86bcaf8e949160ee2731802523e0c76fea87adf00ee7fe9567c3cec610_
Example Filename: 85bbddc502f7b10871621fd460243fbc.exe
Detection Name: W32.41F14D86BC-100.SBX.TG
Basic Information
ID
TALOSBLOG:8B5FA5E5CAA66B716DB5A706994A2294
Published
Dec 4, 2025 at 19:00