Vanja Svajcer

Working for Cisco Talos. Mostly security related stuff. @[email protected]

[Cisco Talos Intelligence Group @TalosSecurity]

Cisco Talos’ 2025 Year in Review is available to view now! Read the full report here for key trends and defense tips — no annoying forms, just helpful analysis: https://t.co/bkwvt9iDvO

[Vanja Svajcer @vanjasvajcer]

Some fresh insights into Voidlink, with a link to an Isovalent blog with more details on the framework

https://t.co/P7txpvlPbl

[Vanja Svajcer @vanjasvajcer]

DKnife, a gateway-monitoring and adversary-in-the-middle framework uncovered.

https://t.co/OaJMgWMBLn

[Costin Raiu @craiu]

Important report 👉

[Vanja Svajcer @vanjasvajcer]

Dynamic binary instrumentation (DBI) with DynamoRio
https://t.co/gDiyQUNVc1

[Vanja Svajcer @vanjasvajcer]

DPRK alligned Famous Chollima keeps their operational tempo high and although not the most sophisticated actors, they have been consistently adding new features to their tools.

https://t.co/obObpNrwfV

[Vanja Svajcer @vanjasvajcer]

Although these malware families have historically been associated with campaigns attributed to Naikon or BackdoorDiplomacy, our analysis indicates a connection.

https://t.co/kKNsxo6Qqu

[Vanja Svajcer @vanjasvajcer]

Cisco Talos has observed an ongoing malware campaign that seeks to infect victims with a multi-stage malware framework, implemented in PowerShell and C#, which we are referring to as “PS1Bot.”

https://t.co/g3TfwDbA8O

[Vanja Svajcer @vanjasvajcer]

Using LLMs as a reverse engineering sidekick

https://t.co/TqJ25HOZcN

[Vanja Svajcer @vanjasvajcer]

Cisco Talos Incident Response (Talos IR) recently observed attacks by Chaos, a relatively new ransomware-as-a-service (RaaS) group conducting big-game hunting and double extortion attacks.

https://t.co/fYkgdfkuRD

[Vanja Svajcer @vanjasvajcer]

MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities

https://t.co/gnGmX0i7JP

[Vanja Svajcer @vanjasvajcer]

We published our findings about a Python variant of a Golang RAT used by Famous Chollima (aka Wagemole). This has been recently used with limited success.

https://t.co/CWLeowvuUm

[Vanja Svajcer @vanjasvajcer]

@TalosSecurity We are here and ready to entertain! The sessions are already fully booked but there is a waiting list people can join.

[Vanja Svajcer @vanjasvajcer]

I presented part of this work on learning about vulnerable Windows drivers at this year's AVAR. This is a follow up post
https://t.co/HUSRdsiESn

[Vanja Svajcer @vanjasvajcer]

Gophish and a new Powershell RAT https://t.co/ocFocmTtMW

[Vanja Svajcer @vanjasvajcer]

Talos discovered previously undocumented backdoors and additional components used by Romcom
https://t.co/JOYIadIyqJ

[BalCCon @BalCC0n]

Preliminary Schedule finally online https://t.co/exPq1tOp6t
#BalCCon #BalCCon2k24 #infosec #Hacking #NoviSad @k0st @vanjasvajcer @MacLemon @CryptoLek @Seifreed @MalwareUtkonos @KirilsSolovjovs @fladna9 @GMahovlic …..

[Vanja Svajcer @vanjasvajcer]

DragonRank, a Chinese-speaking SEO manipulator service provider
https://t.co/7DLPgv1TKI

[Vanja Svajcer @vanjasvajcer]

This started as an investigation into a maldoc with obfuscated VBA code and some unused legit functions lead to discovery of other maldocs generated by MacroPack.

https://t.co/h6B28Q1rmZ

[Vanja Svajcer @vanjasvajcer]

Details on APT41 activity

https://t.co/YjezssVlRN