Talos IR trends: BEC attacks surge, while weaknesses in MFA persist
Summary: Business email compromise was the top threat Cisco Talos Incident Response observed in Q1 2024, accounting for nearly half of engagements, more than double the previous quarter, while compromised credentials on valid accounts was the top initial access vector at 29 percent of engagements. MFA weaknesses appeared in nearly half of engagements, with users accepting unauthorized push notifications the top weakness at 25 percent, and ransomware fell to 17 percent of engagements, an 11 percent decrease, though Talos IR responded to new Akira variants ("Akira_v2" and "Megazord," written in Rust) and the "BackMyData" variant of Phobos for the first time.
What you should know: Users accepting unauthorized push notifications drove 25 percent of engagements, and in one case a password-spraying and MFA exhaustion campaign against accounts lacking proper MFA let adversaries into at least two accounts using single-factor authentication. Manufacturing was the most targeted vertical with a 20 percent increase in engagements, a sector the source notes has an inherently low tolerance for operational downtime.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026