Quarterly Report: Incident Response Trends in Q4 2022
Summary: Cisco Talos Incident Response reported that the Syncro remote monitoring and management tool appeared in nearly 30 percent of its Q4 2022 engagements, a significant increase from prior quarters, and that phishing was the top initial-access vector at nearly 40 percent of engagements. Ransomware remained a top threat, including the BlackCat (ALPHV) family and Royal, a suspected Conti rebrand first seen in Talos IR engagements this quarter, while telecommunications was the most targeted sector.
What you should know: Nearly 30 percent of engagements had no MFA or MFA on only a handful of accounts and critical services, and Talos IR says ransomware and phishing incidents could have been prevented had it been enabled on critical services such as EDR solutions or VPNs. PsExec was used in all of the ransomware engagements that closed out this quarter to move laterally or execute the final ransomware executable.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026