Threat Source newsletter (Oct. 27, 2022): I thought we were already aware of supply chain attacks?
Summary: Cisco Talos Incident Response reported that for the first time since it began collecting such data, ransomware and pre-ransomware engagements were equal in number, together making up nearly 40 percent of threats in the third quarter of 2022. Talos IR also found that nearly 18 percent of engagements had no MFA or MFA enabled only on a handful of accounts and critical services, and it assesses that Cobalt Strike combined with credential-harvesting tools like Mimikatz plus enumeration and discovery techniques indicates a high likelihood that ransomware is the final objective.
What's compelling: Nearly 18 percent of the engagements Talos IR saw lacked MFA on most or all accounts, and it says ransomware and phishing incidents it observed could have been prevented had MFA been properly enabled on critical services such as EDR solutions.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2022-42827
- Related
- CVE-2022-42827: Apple iOS and iPadOS Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Oct 25, 2022Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026