Talos Incident Response year-in-review for 2021
Summary: Cisco Talos Incident Response reported that ransomware dominated its 2021 caseload, with health care the top targeted vertical for most of the year until local governments took the lead in the Fall, and the Microsoft Exchange vulnerabilities comprising 35 percent of all incidents in the early Spring. Ryuk faded from engagements over the year alongside Darkside, BlackMatter, REvil, and Maze, while a wider variety of ransomware actors emerged and no single family was observed more than once in the Winter.
Bottom line: Talos attributes much of the ransomware it responded to on missing multi-factor authentication and notes that a majority of engagements had logging deficiencies that obscured the initial vector, leaving responders unable to establish root cause.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026