Fighting the Good Fight: Life inside the Talos Ukraine Task Unit
Summary: Cisco Talos formed an internal Ukraine task unit after Russia's invasion, deploying and managing Cisco Secure products in Ukrainian organizations and refocusing parts of its workforce to monitor and detect threats against critical infrastructure. Talos also reports a destructive attack on a Ukrainian critical infrastructure entity using a previously unknown wiper it calls "PathWiper," an ongoing campaign targeting Ukrainian users with malicious LNK files that run a PowerShell downloader since at least November 2024, and attacks since at least late 2023 by a Russian-speaking group it tracks as "UAT-5647" against Ukrainian government entities and unknown Polish entities.
What you should know: Talos describes the task unit as a prototype for responding to future global events with significant, ongoing cyber implications - and the threats it is answering include a wiper aimed at critical infrastructure and a campaign running since at least late 2023 that has already reached beyond Ukraine's borders to unknown Polish entities.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026