How Cisco Talos IR helped a healthcare company quickly resolve a Qakbot attack
Summary: Veradigm, a healthcare technology company, detected a potential Qakbot information-stealer infection in a development environment and, with Cisco Talos Incident Response, evicted the threat actor before Qakbot could be deployed. The team found adversaries attempting command and control over DNS; Cisco Secure Endpoint's default isolation settings did not stop that DNS traffic, but Cisco Umbrella blocked it until the isolation policy was modified, and the incident was resolved in hours.
What's compelling: The default isolation setting on the endpoint tool did not stop the DNS beaconing, and only a second control, Umbrella, held the line until the policy was changed - a reminder that a single containment control can leave a gap an attacker can use.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026