IR Trends Q4 2025: Exploitation remains dominant, phishing campaign targets Native American tribal organizations
Summary: Cisco Talos Incident Response reports that threat actors exploited public-facing applications for initial access in nearly 40 percent of engagements in Q4 2025, down from over 60 percent the prior quarter, with activity targeting Oracle E-Business Suite (CVE-2025-61882) and React2Shell (CVE-2025-55182) around the time each vulnerability became public. Phishing was the second-most common initial access tactic at 32 percent, including a campaign against Native American tribal organizations that used compromised email accounts and lures themed around sexual harassment training, while ransomware and pre-ransomware incidents fell to about 13 percent of engagements from 20 percent the prior quarter and roughly 50 percent in Q1 and Q2.
Why it matters: In one tribal-organization incident, Talos suspects the attacker gained a foothold because MFA was absent, and in a related case a single approved MFA push let an adversary flood internal and external recipients with follow-on phishing from a legitimate account. Talos also responded to a ransomware incident where the organization delayed engaging, and encryption and exfiltration of sensitive data were not prevented.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2025-55182CVE-2025-61882
- Related
- UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications Cyber Risks ·CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025CVE-2025-61882: Oracle E-Business Suite Unspecified Vulnerability Known Exploited Vulnerabilities · Oct 06, 2025