IR Trends Q1 2025: Phishing soars as identity-based attacks persist
Summary: Cisco Talos Incident Response reports that phishing was the initial access vector in 50 percent of engagements this quarter, up from less than 10 percent last quarter, with vishing accounting for over 60 percent of those phishing attacks. Ransomware and pre-ransomware incidents made up over 50 percent of engagements, and a campaign using BlackBasta and Cactus TTPs against manufacturing and construction organizations accounted for over 60 percent of those cases.
Bottom line: Half of the quarter's engagements involved MFA issues - misconfigured, absent, or bypassed - and attackers stole session tokens and added their own secondary MFA devices to compromised accounts, so the control most leaders treat as settled is the one being walked around.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026