Inside the ransomware playbook: Analyzing attack chains and mapping common TTPs
Summary: Cisco Talos reviewed 14 ransomware groups operating between 2023 and 2024 and found that most prioritize initial access, with valid accounts the most common mechanism and credential phishing preceding attacks across all incident response engagements. AlphV/Blackcat and Rhysida showed the broadest range of TTPs, Clop focused on extortion through data theft rather than encryption, and Talos IR engagements repeatedly saw exploitation of CVE-2020-1472 (Zerologon), CVE-2018-13379 (FortiOS SSL VPN) and CVE-2023-0669 (GoAnywhere MFT).
Key Takeaway: The most common way in was a valid account, and the most prevalent credential technique Talos saw was dumping LSASS memory to pull plaintext passwords and tokens - meaning the attacker often logs in rather than breaks in, and your detection has to catch that.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- How adversaries use politics for compromise Cyber Risks ·Wasted Locker Goes "Big-Game Hunting" in 2020 Cyber Risks ·