The 2024 Threat Landscape State of Play
Summary: Cisco Talos' Head of Outreach Nick Biasini named two major areas of concern in the 2024 threat landscape and focused on one particularly active state-sponsored actor, alongside the infostealer market's maturing phase. The year's spotlighted research included a Zardoor backdoor espionage campaign likely persisting since at least March 2021, ArcaneDoor targeting perimeter network devices, large-scale brute-force attacks on VPNs and SSH services since at least March 18, 2024, and APT41's likely compromise of a Taiwanese government-affiliated research institute using ShadowPad and Cobalt Strike.
Why it matters: State-sponsored actors spent the year inside perimeter network devices and long-running espionage implants like Zardoor, and a maturing infostealer market means stolen credentials are now a commodity defenders must assume are already circulating.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026