Quarterly Report: Incident Response trends from Q3 2021
Summary: Ransomware was the top threat in Cisco Talos Incident Response engagements for Q3 2021, accounting for about 38 percent of all threats, with REvil and Vice Society the only ransomware groups observed more than once and no Ryuk observations for the first time. Business email compromise was the next most common threat and reached its highest quarterly count since the reports began in late 2019, while CTIR also handled pre-ransomware incidents involving tools such as Cobalt Strike, Sharphound, PCHunter, Process Hacker, TeamViewer and AnyDesk.
What you should know: One BEC victim had MFA in place but attackers bypassed it through basic authentication against O365, and CTIR says the lack of MFA remains one of the biggest impediments to enterprise security. For most incidents CTIR could not determine the initial vector because of logging deficiencies, leaving responders without the records needed to reconstruct the intrusion.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2021-30116
- Related
- CVE-2021-30116: Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021