IR Trends: Ransomware on the rise, while technology becomes most targeted sector
Summary: Cisco Talos Incident Response reported that BEC and ransomware together accounted for 60 percent of its second-quarter 2024 engagements, with ransomware at 30 percent, a 22 percent increase from the previous quarter, and first-time responses to Mallox and Underground Team. Compromised credentials on valid accounts were the most observed initial access path for the third quarter in a row at 60 percent of engagements, while technology was the most targeted vertical at 24 percent, up 30 percent from the prior quarter.
What you should know: 80 percent of ransomware engagements lacked proper MFA on critical systems such as VPNs, and in one Underground Team case the adversary reactivated over 100 disabled Active Directory accounts before encrypting domain controllers, virtual machines and backups.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026