Quarterly Report: Incident Response Trends in Q3 2022
Summary: Cisco Talos Incident Response reported that ransomware and pre-ransomware engagements were equal in Q3 2022, together making up nearly 40 percent of threats, with education the most-targeted vertical ahead of financial services, government, and energy. Talos observed Vice Society, Hive, and Black Basta ransomware, Qakbot infection chains delivering Black Basta, and the late-September 2022 leak of the LockBit 3.0 builder, which the new BlooDy Gang has reportedly used.
What you should know: Nearly 18 percent of engagements had no MFA or MFA on only a handful of accounts and critical services, and in 27 percent of engagements password or account access was not properly configured or disabled, leaving valid credentials for adversaries to use.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026