Talos IR ransomware engagements and the significance of timeliness in incident response
Summary: Cisco Talos compared two ransomware engagements in which the actors used similar tools and TTPs and both victims were warned before encryption, yet one ended with 0% network encryption and the other with nearly 100%. In the second case the victim ignored Cisco MDR alerts and did not engage Talos until after the Medusa binary began executing, then provided network access more than a day later, while Talos notes many ransomware variants can take full control of a network within 24-48 hours of initial access.
Bottom line: Talos assesses that victim response time was the dominant factor in the difference between 0% and nearly 100% encryption, with all other factors - actor sophistication, endpoint security, and Talos' own response - described as similar; the delay also let the actor delete or modify logs, leaving the slower victim with only general remediation advice instead of tailored guidance.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026