Quarterly Report: Incident Response trends in Spring 2020
Summary: Cisco Talos Incident Response reports that ransomware and commodity trojans continued to dominate its engagements from November 2019 through January 2020, with DDoS and coinminer threats returning in spring 2020 after a quarter's absence. In one manufacturing case, adversaries infected a victim with Emotet, likely via email, used Trickbot to move laterally and elevate privileges, then dropped Ryuk via Meterpreter, while in a government incident the attackers posted a ransom note and screenshots of compromised Active Directory systems on Twitter.
What's compelling: Ransomware actors including Sodinokibi, Nemty, DoppelPaymer, Nefilim, CLOP and Sekhmet have begun threatening to release stolen data, which negates backups as a defense and gives victims a second reason to pay.
Read the original at Cisco Talos ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026