Talos IR trends Q4 2024: Web shell usage and exploitation of public-facing applications spike
Summary: In Q4 2024, Cisco Talos Incident Response observed web shell deployment in 35 percent of incidents, up from less than 10 percent the previous quarter, and exploitation of public-facing applications became the most observed initial access method at nearly 40 percent of engagements where initial access could be determined, ending a run of more than a year in which valid accounts led. Ransomware, pre-ransomware, and data theft extortion fell to nearly 30 percent of engagements from 40 percent, with BlackBasta, RansomHub, and first-seen Interlock observed, dwell times of roughly 17 to 44 days, remote access tools used in 100 percent of ransomware engagements, and every ransomware-affected organization lacking properly implemented MFA or having it bypassed.
What you should know: Every organization hit by ransomware this quarter either had no working MFA or had it bypassed, and operators used remote access tools in 100 percent of those engagements, with Splashtop appearing in 75 percent of them.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026