Forest Global Training Partners

Cyber Risks · Cisco Talos

Quarterly Report: Incident Response Trends in Q2 2022

Summary: Cisco Talos Incident Response reported that commodity malware narrowly surpassed ransomware as the top threat it responded to in Q2 2022, the first time in more than a year ransomware did not lead, with malware including Remcos RAT, Vidar, Redline Stealer and Qakbot. Phishing reemerged as the most observed initial access technique, accounting for over a third of engagements where initial access could be determined, while telecommunications remained the top-targeted vertical, followed by education and health care.

Bottom line: In at least two engagements this quarter, a partner or third party without MFA enabled let the adversary authenticate into the environment - and in the Redline Stealer case, phishing collected usernames, passwords and up to two hashed one-time passcodes to reach O365, Workday and Citrix VDI.

Read the original at Cisco Talos ↗

Topics
Malware
Related