A new approach to reverse engineering, developed by Cisco Talos, integrates local artificial intelligence agents with traditional analysis tools. This method utilizes the VB6 disassembler, vbdec, to expose parsed data through a live Component Object Model (COM) interface. This allows security analysts to use natural language prompts to automate complex tasks such as decompiling functions and constructing call graphs, transforming the disassembler into an interactive data server.
This methodology offers significant advantages for security professionals. It empowers analysts to create custom workflows dynamically, eliminating the need to wait for new features from software vendors. Furthermore, it addresses privacy concerns by keeping sensitive binaries on the analyst's local machine, as both the AI agent and the disassembler operate on the same workstation. This architectural shift demonstrates that any analysis tool with structured data accessible via a graphical user interface can be enhanced for automated tasks, potentially saving defenders considerable time.
The developers of analysis tools are encouraged to expose their application data through external scripting interfaces like COM or other inter-process communication protocols. For those analyzing VB6 binaries, enabling remote scripting in vbdec and directing a local AI agent towards the provided operator briefing can automate various tasks. Security teams are advised to embrace this paradigm shift, allowing AI agents to handle repetitive and extensive work while human analysts focus on higher-level analysis.
In other cybersecurity news, the group ShinyHunters has claimed responsibility for a hack on the Council of Europe, threatening to release over 297GB of stolen data. Separately, a widespread credential-harvesting operation has compromised more than 30,000 Fortinet devices globally, targeting firewalls and VPN gateways.
A fileless malware known as Phantom Stealer has been observed targeting browser credentials. This malware employs anti-analysis techniques, including in-memory execution, to evade detection. In a different incident, a security researcher discovered a flaw in an internal FIFA World Cup system that allowed unauthorized individuals to control and view the TV stream of all games.
The FBI has established a dedicated facility called the Kinetic Cyber Range, a replica small town designed to simulate real-world cyber attacks. This facility, operational since February 2025, includes various structures and infrastructure mimicking a typical U.S. community.
Cisco Talos also highlighted several resources for cybersecurity professionals. A podcast episode, "Patching in the dark," discusses the complexities of managing unknown threats and the practical challenges of patching in intricate environments. Another resource details Cisco Talos Threat Hunting's use of hypothesis-driven methods and multi-domain telemetry correlation to detect sophisticated threats. Additionally, a discussion with Tony Giandomenico, Senior Director of Product Management with Cisco Talos, explores endurance in cybersecurity and the discipline required for success. Talos will also be present at upcoming events such as Black Hat USA and DEF CON 34.
The most prevalent malware files identified through Talos telemetry in the past week include samples detected as Win.Worm.Coinminer, W32.C0AD494457-95.SBX.TG, and Win.Tool.Procpatcher.
