Quarterly Report: Incident Response trends from Winter 2020-21
Summary: Cisco Talos Incident Response reported ransomware as the dominant threat for the seventh consecutive quarter, with Ryuk and Vatet the top variants and nearly 70 percent of ransomware attacks relying on commodity trojan maldoc phishes such as Zloader, BazarLoader and IcedID. CTIR also responded to incidents involving trojanized SolarWinds Orion updates and a growing number of Microsoft Exchange vulnerability exploits, with affected organizations estimated in the tens of thousands.
What you should know: Health care was the most frequently targeted vertical, and CTIR described a pattern in which regional hospitals with active VPN connections to an already-attacked hospital became follow-on targets, with the COVID-19 pandemic cited as a reason victims pay quickly to restore services.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026