Case Study: Incident Response is a relationship-driven business
Summary: Cisco Talos Incident Response describes an engagement with a publicly traded company with more than $8 billion in revenue that was mid-merger when CTIR flagged suspicious Cobalt Strike activity and pre-ransomware TTPs through SecureX telemetry. Analysis of patient zero traced the intrusion to a malicious macro in Document_1223672987_11142020.zip that delivered the Qakbot banking trojan, followed by Cobalt Strike beacon PowerShell and BloodHound enumeration of domain users and computers on 2020-11-20.
What you should know: The customer's CISO credits pre-existing trust and joint drills with CTIR as the differentiator that contained an adversary capable of deploying ransomware, which CTIR says likely would have caused millions of dollars in lost revenue and recovery expenses.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026