Forest Global Training Partners

Cyber Risks · Cisco Talos

Lessons from Ted Lasso for cybersecurity success

Summary: Cisco Talos published a blog post on an initial access broker it calls ToyMaker, a financially motivated actor that deploys a custom backdoor called LAGTOY to extract credentials from victim enterprises, with LAGTOY able to create reverse shells and execute commands on infected endpoints. Talos says it observed ToyMaker hand access to Cactus, a double extortion gang that used its own tactics, techniques and procedures across the victim's network, and the blog includes a timeline of the turnaround from ToyMaker to Cactus along with related IOCs.

Key Takeaway: The handoff from an access broker to a double extortion gang means the initial intrusion is only the first stage, and the source gives no turnaround time, so the window between credential theft and extortion is one you cannot currently measure.

Read the original at Cisco Talos ↗

Topics
Malware
Related