Talos IR trends Q3 2024: Identity-based operations loom large
Summary: Cisco Talos Incident Response reported that credential theft was the main goal in a quarter of its engagements, with valid accounts the most observed means of initial access at 66 percent of cases where initial access could be determined, up from 60 percent the prior quarter. Password spraying and brute force appeared in 25 percent of incidents, ransomware, pre-ransomware and data theft extortion accounted for nearly 40 percent, and misconfigured, absent or bypassed MFA was the top observed weakness in nearly 40 percent of engagements.
Key Takeaway: In 100 percent of engagements where threat actors sent phishing emails, MFA was bypassed or not fully enabled, and over 20 percent of incidents where ransomware was deployed had no MFA on VPNs - the control most often cited as the fix was the one most often missing.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2024-37085
- Related
- CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Jul 30, 2024