Threat Source newsletter (Nov. 3, 2022): Mastodon, evolution, and Live Journal oh my!
Summary: Cisco Talos Incident Response's quarterly report found ransomware and pre-ransomware engagements made up nearly 40 percent of threats this quarter, with ongoing Qakbot, Hive, and Vice Society activity and the emergence of Black Basta, which first surfaced in April 2022. Nearly 18 percent of engagements had no MFA or MFA enabled only on a handful of accounts and critical services, and in nearly 15 percent of engagements adversaries identified or exploited misconfigured public-facing applications through SQL injection, Log4Shell in VMware Horizon, and exposed servers.
What's compelling: Nearly one in five engagements Talos responded to lacked MFA on most accounts, and adversaries walked in through public-facing applications in roughly 15 percent of cases - the same misconfigurations and missing controls that keep showing up in incident response.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Mentions
- CVE-2022-3602
- Related
- Threat Advisory: High Severity OpenSSL Vulnerabilities Cyber Risks ·