Recommendations that defenders can use from Talos’ Year in Review Report
Summary: Cisco Talos' 2023 Year in Review reports new ransomware strains emerging from leaked source code, commodity loaders adding reconnaissance measures, and geopolitical events influencing APT activity. Talos also observed increased targeting of network devices by both APTs and cybercriminals, relying on recently disclosed vulnerabilities and weak or default credentials, with valid accounts a top MITRE ATT&CK technique and a consistent top weakness in Talos Incident Response engagements.
Bottom line: Talos notes that even a takedown like Qakbot in August does not mean the group behind it stops operating, so a single disruption buys time rather than closure. The healthcare IT organization Veradigm caught an intrusion before attackers could execute their plan because it could quickly answer four questions: how they got in, whether they were still in, what they did, and how they could get in again.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026