Forest Global Training Partners

Cyber Risks · Cisco Talos

IR Q4 2023 trends: Significant increase in ransomware activity found in engagements, while education remains one of the most-targeted sectors

Summary: Ransomware, including pre-ransomware activity, was the top observed threat in Q4 2023 at 28 percent of Cisco Talos Incident Response engagements, a 17 percent increase from the prior quarter, with first-time operations involving Play, Cactus, BlackSuit and NoEscape. Education and manufacturing tied as the most targeted verticals at nearly 50 percent of engagements combined, and Talos documented Play affiliates using AnyDesk and PsExec, BlackSuit and Cactus gaining access through VPN accounts without MFA, and NoEscape exploiting the Citrix Bleed vulnerability CVE-2023-4966.

Bottom line: Three of the four newly observed ransomware operations got in through credentials on accounts or appliances that lacked MFA or a patch, so the barrier between an affiliate and domain-wide encryption was a single missing control. And with education tied for the most-targeted sector, the student and faculty PII that adversaries exfiltrate is already being sold on dark web forums and reused for follow-on attacks.

Read the original at Cisco Talos ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026