Who is Responsible and Does it Matter?
Summary: Cisco Talos writes that identifying the origin of an attack is often harder than identifying the attack itself, since attackers hide their origin and leave only habitual clues that build into a characteristic fingerprint over time. The newsletter cites Lotus Blossom, a threat actor running espionage campaigns against government, manufacturing, telecoms, and media sectors in Vietnam, Hong Kong, Taiwan, and the Philippines using the Sagerunex backdoor family, and also notes 244 million additional compromised passwords added to Have I Been Pwned and a botnet of more than 86,000 compromised IoT devices conducting DDoS attacks on telecom firms and gaming platforms.
Bottom line: Talos states plainly that it blocks threats regardless of origin, which puts the burden on your own team: the same newsletter reports 244 million more breached passwords in circulation and an 86,000-device IoT botnet, and asks whether you can search your network for known IOCs at all.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026