Quarterly Report: Incident Response trends from Spring 2021
Summary: Cisco Talos Incident Response reported that exploitation of four Microsoft Exchange Server zero-day vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) accounted for roughly 35 percent of all incidents it investigated in the quarter, most of which showed scanning rather than post-compromise activity. Ransomware remained a persistent problem, with new families MountLocker, Zeppelin and Avaddon fitting the ransomware-as-a-service model, deployed with Cobalt Strike and delivered by a commodity trojan loader, and health care was targeted nearly four times as often as the next most targeted verticals, education and technology.
Why it matters: In one U.S. municipal government engagement, attackers made three attempts to exploit CVE-2021-26855 within an eight-hour window, and the third succeeded using a legitimate administrator account address, leading to China Chopper web shells and post-exploitation activity.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Mentions
- CVE-2021-26855CVE-2021-26857CVE-2021-26858CVE-2021-27065
- Related
- Threat Advisory: HAFNIUM and Microsoft Exchange zero-day Cyber Risks ·