Quarterly Report: Incident Response trends in Q1 2022
Summary: Ransomware remained the top threat in Cisco Talos Incident Response engagements in Q1 2022, with no single ransomware family seen twice and emerging families including Cerber, Entropy and Cuba alongside Hive and Conti. APT activity rose, including Iranian state-sponsored MuddyWater, China-based Mustang Panda delivering PlugX via USB drives, and a suspected Chinese actor dubbed Deep Panda exploiting Log4j, with telecommunications the most targeted vertical.
What you should know: In one engagement, an adversary reached a telecommunications company through its help desk partner, which had access to the organization's Citrix machines without MFA enabled - the third party was the root cause of the compromise.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Mentions
- CVE-2021-44228CVE-2021-45046
- Related