INTEL_REPORT
Cisco Talos Blog · published 5/21/2026, 6:00:14 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
The art of being ungovernable In this edition of the Threat Source newsletter, William explores the value of being "ungovernable" in a professional setting, sharing how challenging the status quo and seeking out the smartest people in the room can lead to a more fulfilling and successful career. Welcome to this week’s edition of the Threat Source newsletter.   “It takes very little to govern good people. Very little. And bad people
…
https://blog.talosintelligence.com/the-art-of-being-ungovernable
sha256:0a7bdbcc08262d5c0e3265455732b6d9c6b2f7bfd53776caff2d608168bf03be
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
| Type | Value | Link |
|---|---|---|
| domain | talosintelligence.com | Open → |
| domain | vid001.exe | Open → |
| domain | win.worm.coinminer | Open → |
| domain | w32.injector | Open → |
| url | https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | Open → |
| url | https://talosintelligence.com/talos_file_reputation?s=96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974 |
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.
| md5 | 2915b3f8b703eb744fc54c81f4a9c67f | Open → |
| md5 | aac3165ece2959f39ff98334618d10d9 | Open → |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | Open → |
| sha256 | 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974 | Open → |
| domain | demo.pdb | Open → |
| domain | win.tool.procpatcher | Open → |
| url | https://talosintelligence.com/talos_file_reputation?s=9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f | Open → |
| md5 | 38de5b216c33833af710e88f7f64fc98 | Open → |
| sha256 | 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f | Open → |
| domain | tunmirror.exe | Open → |
| domain | pua.win.tool.tunmirror | Open → |
| domain | secoh-qad.exe | Open → |
| domain | kmsss.exe | Open → |
| domain | pua.win.tool.hackkms | Open → |
| url | https://talosintelligence.com/talos_file_reputation?s=d87e8d9d43758ce67a8052cb2334b99cc24f9b0437ee44815f360be0b22d835a | Open → |
| url | https://talosintelligence.com/talos_file_reputation?s=acd55c44b8b0d66d66defed85ca18082c092f048d3621da827fce593305c11fd | Open → |
| md5 | 362498c3e71eeaa066a67e4a3f981d1c | Open → |
| md5 | 0f03f72a92aef6d63eb74e73f8ac201d | Open → |
| sha256 | d87e8d9d43758ce67a8052cb2334b99cc24f9b0437ee44815f360be0b22d835a | Open → |
| sha256 | acd55c44b8b0d66d66defed85ca18082c092f048d3621da827fce593305c11fd | Open → |