Quarterly Report: Incident Response trends in Summer 2020
Summary: Cisco Talos Incident Response observed ransomware as the dominant threat for the fifth consecutive quarter, with families including Ryuk, Maze, LockBit, and Netwalker, and 66 percent of ransomware engagements involving the red-teaming framework Cobalt Strike. Manufacturing was the top targeted vertical, and in one LockBit case adversaries used Cobalt Strike for command and control with traffic every six minutes, ran CrackMapExecWin to force a Group Policy update that executed the ransomware, created user accounts, cleared event logs, and deployed TeamViewer.
What you should know: Two-thirds of ransomware engagements now run through Cobalt Strike rather than commodity trojans, and in most cases the initial vector could not be identified because of logging shortfalls - so the tooling and the evidence trail are both working against defenders.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Mentions
- CVE-2019-18935
- Related
- CVE-2019-18935: Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021