Vanja Svajcer

@vanjasvajcer

Working for Cisco Talos. Mostly security related stuff. @vanjasvajcer@infosec.exchange

Zagreb, Croatia talosintelligence.com Joined August 2009

1.2K Following 1.8K Followers 851 Posts

Latest posts 5

In August, we detected a campaign using Amatera stealer to target organisations in Ukraine
blog.talosintelligence.com/clearfake-webd…

blog.talosintelligence.com ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as...

Vanja Svajcer @vanjasvajcer Aug 4

We found some open directories showing how AI is used, mostly for offensive operations.

blog.talosintelligence.com/keep-going-bro…

blog.talosintelligence.com “Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI Talos has collected prompt logs from threat actor endpoints running various applications, such as Claude Code, CodeX, Cursor, or Gemini. This blog is an analysis of the ways we've seen bad actors...

Vanja Svajcer @vanjasvajcer Jun 25

Some time ago I stumbled upon a reasonably complex piece of malware that was using several COM interfaces. I ended up learning how it should be actually done.
blog.talosintelligence.com/introduction-t…

blog.talosintelligence.com Introduction to COM usage by Windows threats Component Object Model (COM) is a fundamental Windows technology used by legitimate applications for object activation, inter-process communication, automation and language-independent component...

Vanja Svajcer @vanjasvajcer Feb 11

Some fresh insights into Voidlink, with a link to an Isovalent blog with more details on the framework

blog.talosintelligence.com/voidlink/

blog.talosintelligence.com New threat actor, UAT-9921, leverages VoidLink framework in campaigns Cisco Talos recently discovered a new threat actor, UAT-9221, leveraging VoidLink in campaigns. Their activities may go as far back as 2019, even without VoidLink.

Vanja Svajcer @vanjasvajcer Feb 5

DKnife, a gateway-monitoring and adversary-in-the-middle framework uncovered.

blog.talosintelligence.com/knife-cutting-…

blog.talosintelligence.com Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework Cisco Talos uncovered “DKnife,” a fully featured gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants.