Forest Global Training Partners

Cyber Risks · Cisco Talos

Stopping ransomware before it starts: Lessons from Cisco Talos Incident Response

Summary: Cisco Talos analyzed incident response engagements spanning two and a half years that it categorized as pre-ransomware, where adversaries conducted account pivots and escalations, deployed command-and-control or remote access tools, and harvested credentials without completing enterprise-wide encryption. Engaging Talos IR within one to two days of first observed adversary activity was credited with preventing a more serious ransomware attack in approximately a third of engagements, and security team action within two hours of an EDR or MDR alert correlated with successful isolation of the threat in almost a third.

Why it matters: In over 10 percent of engagements, customers' security solutions actively blocked or quarantined malicious executables, yet Talos often sees endpoint protection deployed passively - alerting but taking no action - and has responded to multiple engagements where that configuration let threat actors execute malware, including ransomware.

Read the original at Cisco Talos ↗

Topics
Threat Actors & Nation-State
Related