The basics of a ransomware infection as Snake, Maze expands
Summary: Cisco Talos Incident Response engagements show a Maze ransomware timeline in which initial compromise and Cobalt Strike deployment occur on days 0-6, reconnaissance and data theft on days 7-13, and PsExec or WMIC execution on domain controllers with Maze spreading across the network on days 14-21. Talos notes that each of these actions generates logs or alerts defenders can detect, and that Maze and Snake campaigns have hit critical medical supply companies and large logistics firms.
What's compelling: The ransomware that makes headlines is the last stage of a compromise that Talos timelines at up to three weeks, meaning the intruders had days 0 through 13 inside the network before the domain controllers were touched - time in which the logs and alerts existed but went unanswered.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026