What Old is New Again and What's Old is Me?
Summary: Cisco Talos IR's Q4 2022 Incident Response Trends report found ransomware remained a top threat, with PsExec used in all of Talos IR's ransomware engagements that closed out the quarter to facilitate lateral movement or execute the final ransomware executable. Phishing was the top initial-access vector for the quarter, with post-exploitation activity including credential harvesting, red-teaming framework deployment and remote access tooling installation, and CISA and the NSA released a joint advisory on January 25th on malicious use of legitimate commercial RMM software.
What's compelling: PsExec appeared in every ransomware engagement Talos IR closed out that quarter, which is why Talos recommends disabling it and administrative share access to limit lateral movement.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026