Threat hunts for Cisco
30 hunts covering Cisco, each with a hypothesis, the queries that test it and what the hunt cannot see.
30 hunts
-
high Part 2 of 2Research by Huntress
Cloud Identity Hijacking and Mailbox Persistence
An adversary has bypassed multi-factor authentication via session token theft or device code phishing and established persistence by modifying mailbox rules to hide intercepted communications.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · credential access · execution -
high Part 1 of 2Research by Huntress
Endpoint Social Engineering and Malicious Execution
An attacker has used AI-tuned phishing lures or ClickFix social engineering to trick a user into executing shell commands from the Run box, eventually deploying rogue RMM tools or infostealers.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · credential access · execution -
medium Part 2 of 2Research by Cisco Talos
Unauthorized RMM and Ransomware Precursors
An adversary is using unauthorized remote management tools to maintain persistence and is performing credential harvesting or staging ransomware encryption.
3 query1 analytic1 checkpoint1 action2 taskcredential access · discovery · impact -
medium Part 1 of 2Research by Cisco Talos
Cloud Identity and AI Agent Anomalies
An adversary has used social engineering or exploited public-facing remote services to compromise an administrative identity, then used that access to manipulate cloud repositories or orchestration layers via automated agents.
3 query2 analytic2 checkpoint1 action2 taskcredential access · discovery · impact -
criticalResearch by Cisco Talos
NetScaler exploitation and RMM-driven ransomware
An attacker has exploited vulnerabilities in a public-facing gateway or remote access tool to execute a backdoor, followed by establishing persistence via unauthorized RMM software and initiating ransomware file encryption.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · execution · impact -
highResearch by Rapid7
Cisco SD-WAN Manager API Authentication Bypass
An attacker is bypassing authentication on an internet-exposed Cisco Catalyst SD-WAN Manager by using URL-encoded characters in the j_security_check path, gaining administrative access through reserved system accounts.
4 query2 analytic2 checkpoint1 action2 taskCVE-2026-20127 · CVE-2026-20182 -
highResearch by Cisco Talos
UAT-11587 Antino Backdoor Phased Infection and M365 C2
An adversary is using Cloudflare-hosted stagers to deliver the Rust-compiled Antino backdoor, which then establishes persistence via Run keys and communicates using Microsoft 365 as a dead-drop C2 channel.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · discovery · execution -
mediumResearch by Cisco Talos
Detection of Targeted Executive Asset Compromise
An adversary targets high-value executive assets using whaling and MFA bypass to access sensitive corporate roadmaps and financial data via stealthy living-off-the-land techniques.
3 query2 analytic2 checkpoint1 action2 taskcollection · execution · initial access -
highResearch by Rapid7
Cisco Secure Email Gateway SQLi Exploitation
An unauthenticated attacker has exploited CVE-2026-76461 by sending a crafted email to a Cisco Secure Email Gateway, resulting in root-level command execution from a database process.
3 query1 analytic1 checkpoint2 taskCVE-2026-76461 -
highResearch by Cisco Talos
AI-Integrated Malware Execution and Orchestration
Adversaries use AI frameworks or local runtimes for autonomous malware orchestration, detectable through cognitive artifacts like framework-specific imports, natural-language evasion strings, and outbound provider API traffic.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · defense evasion · execution -
highResearch by Cisco Talos
M365 Session Hijacking and Malware Execution
An adversary has bypassed MFA by stealing M365 session tokens via DocuSign-themed phishing, enabling them to execute malicious droppers and deploy ransomware across the fleet.
5 query2 analytic1 checkpoint1 action2 taskcredential access · execution · impact -
high Part 2 of 2Research by Cisco Talos
SSO Takeover and Data Impact
An adversary has bypassed SSO protections using stolen credentials and is now performing bulk data exfiltration or deploying ransomware across the environment.
3 query1 analytic1 checkpoint1 action2 taskcredential access · execution · impact -
high Part 1 of 2Research by Cisco Talos
Infostealer execution and browser credential harvesting
An adversary has successfully phished a user and executed an infostealer, which is now harvesting browser credentials and cookies from local SQLite databases for exfiltration.
5 query2 analytic2 checkpoint1 action2 taskcredential access · execution · impact -
medium Part 1 of 2Research by Cisco Talos
ClickFix Browser Injection and Extension Persistence
An intruder has used a social engineering lure to trick a user into manually injecting a JavaScript loader or installing a malicious Tampermonkey script that facilitates persistent cryptocurrency theft via the Google Visualization API.
5 query2 analytic1 checkpoint1 action2 taskcollection · command and control · execution -
highResearch by Rapid7
Metasploit Framework Exploitation and Post-Exploitation
An intruder has leveraged one of sixteen new Metasploit modules to exploit a public-facing web application and establish persistence or conduct Kerberos authentication relaying.
5 query2 analytic1 checkpoint1 action2 taskCVE-2025-54988 · CVE-2025-66516 -
high Part 2 of 2Research by Cisco Talos
Amatera Stealer and Follow-on Payloads
An intruder has deployed the Amatera stealer, characterized by DLL hollowing of dbghelp.dll and dead-drop C2 resolution via Telegraph, and is now scanning for cryptocurrency wallets or deploying secondary payloads like ZigCryptoStealer.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · credential access · defense evasion -
high Part 2 of 2Research by Cisco Talos
Host Intrusion and Destructive Impact
An adversary has bypassed local security controls using system patchers and is executing AI-generated scripts to perform mass file encryption for ransomware extortion.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · execution · impact -
high Part 1 of 2Research by Cisco Talos
Remote access abuse and red-team implants
An intruder accessed the environment via an external remote service using a single-factor credential and deployed red-team framework implants to maintain command and control.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · execution · impact -
high Part 2 of 2Research by Cisco Talos
CLOSEDQUORUM AI Payload Actions
An autonomous AI implant is performing credential theft, process injection, or WMI persistence based on plurality-vote decisions reached by a panel of LLM providers.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · credential access · defense evasion -
high Part 1 of 2Research by Cisco Talos
Autonomous LLM Decision Loop
An autonomous implant performs host discovery and then queries multiple commercial AI providers to decide its next tactical moves, bypassing traditional C2 infrastructure.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · credential access · defense evasion -
high Part 2 of 2Research by Cisco Talos
Cisco FMC Vulnerability and Blockchain C2
Adversaries are exploiting unpatched Cisco Firewall Management Center vulnerabilities to gain initial access and establishing command-and-control communication via legitimate blockchain infrastructure.
3 query1 analytic1 checkpoint1 action2 taskCVE-2026-20079 · CVE-2026-20316 -
high Part 1 of 2Research by Cisco Talos
UAT-10820 Multi-Stage Stealer Infection Chain
An intruder has infected an endpoint using a WebDAV social engineering chain, followed by the execution of disguised DLLs via rundll32 ordinals and the installation of unauthorized RMM tools for persistence.
5 query2 analytic1 checkpoint1 action2 taskCVE-2026-20079 · CVE-2026-20316 -
high Part 2 of 2Research by Cisco Talos
VoidLink Lateral Scanning and Mesh C2
An intruder is using a VoidLink implant to perform automated internal reconnaissance and establish a peer-to-peer mesh command-and-control network between compromised Linux servers.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · discovery · execution -
high Part 1 of 2Research by Cisco Talos
VoidLink: Exploitation and Kernel-Level Implant Deployment
An adversary has exploited a Java-based Apache Dubbo service to deploy a ZigLang-based VoidLink implant and maintained stealth using an unsigned kernel-level rootkit.
3 query2 analytic2 checkpoint1 action2 taskcommand and control · discovery · execution -
high Part 2 of 2Research by Cisco Talos
Static Tundra: Cisco IOS Post-Exploitation
An adversary has exploited legacy Smart Install services to enable TFTP servers for configuration theft or is using compromised SNMP community strings for lateral discovery within the network infrastructure.
4 query2 analytic1 checkpoint1 action2 taskCVE-2018-0171 -
high Part 1 of 2Research by Cisco Talos
Vulnerable Cisco Asset Exposure
An adversary is identifying and exploiting end-of-life Cisco devices via the Smart Install feature on port 4786 to extract configuration files and establish persistence.
3 query1 analytic1 checkpoint1 action3 taskCVE-2018-0171 -
high Part 2 of 3Research by Cisco Talos
UAT-10147: Host Elevation and Evasion
An adversary is executing automated staging scripts to deploy privilege escalation tools and blind security software on compromised web servers.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · defense evasion · discovery -
high Part 1 of 3Research by Cisco Talos
Web Exploit and Telemetry Theft (UAT-10147)
The adversary exploits known web vulnerabilities in Zimbra, Telerik, or AjaxPro to achieve initial access and exfiltrates system identifiers to a Nacos configuration server via HTTP POST requests.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · defense evasion · discovery -
high Part 2 of 2Research by Huntress
RMM Command and Control and Redundancy
An attacker is using rogue ScreenConnect instances and secondary RMM tools to maintain persistence, identified by non-standard port connections and rare binaries running from user-writable directories.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · discovery · execution -
high Part 1 of 2Research by Huntress
Rogue ScreenConnect Host Execution and Persistence
An adversary is using social engineering to deploy rogue ScreenConnect clients that execute a multi-stage VBScript chain for host profiling and persistent access via registry run keys.
6 query2 analytic1 checkpoint1 action2 taskcommand and control · discovery · execution