I'm locked in!
Summary: Cisco Talos Incident Response's Q4 2025 report found exploitation of public-facing applications remained the top initial access method at about 40% of engagements, down from 62%, with phishing second-most common and ransomware at only 13% of cases, still led by Qilin. The newsletter also cites ESET attributing a never-before-seen wiper attack on Poland's energy grid to the Russian group Sandworm, and reports Konni using AI-generated PowerShell malware against blockchain engineers.
Bottom line: Ransomware fell to 13% of engagements while attackers shifted to phishing, MFA abuse, and both new and old internet-facing vulnerabilities - meaning the controls many teams treat as settled, like MFA, are exactly what adversaries are now working around.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026