Quarterly Report: Incident Response Trends in Q1 2023
Summary: Cisco Talos Incident Response reported that web shells were the most-observed threat in Q1 2023, comprising nearly a fourth of the incidents it engaged in, up from 6% the previous quarter. Attackers exploited public-facing applications to establish initial access in 45 percent of engagements, a jump from 15 percent the prior quarter, while ransomware fell from 20% to around 10% of threats observed.
What you should know: Nearly 30 percent of engagements involved organizations with no MFA or MFA on only a handful of accounts, and Talos notes ransomware and phishing incidents it saw could have been prevented had MFA been enabled on critical services such as EDR solutions or VPNs.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026