Quarterly Report: Incident Response trends from Fall 2020
Summary: Cisco Talos Incident Response reported ransomware dominating the threat landscape for the sixth consecutive quarter, with Maze and Sodinokibi the top families and no single family dominant, while no closed engagements involved Ryuk for the first time since the reports began. Phishing remained the top infection vector for the sixth quarter in a row, and CTIR observed a spike in Vatet loader engagements against health care entities, including a U.S. medical center where an IcedID phishing email with a ZIP attachment using steganography led to Vatet, Cobalt Strike activity, and Defray777 ransomware.
Why it matters: Health care and manufacturing were tied as the most affected sectors, and CTIR notes adversaries will likely keep targeting health care given its security posture and incentives to pay during the COVID-19 pandemic - with several Ryuk and health care engagements still open at quarter's end.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026