Quarterly Report: Incident Response trends in fall 2019
Summary: Cisco Talos Incident Response reports that threat actors are increasingly combining exfiltration of sensitive data with encryption as new levers to compel victims to pay, and in two winter engagements the same actor used CobaltStrike to traverse the network, exfiltrated data via PowerShell to an FTP server, then deployed Maze ransomware. Talos also observed Ryuk deployed as a group policy object across an Active Directory environment following a Trikbot infection, rather than the usual PsExec method, and noted Emotet appeared much less frequently while Lokibiot, Avemaria, ASP web shells and the Frenchy toolkit were new to the quarter.
What's compelling: Exfiltration means backups no longer neutralize a ransomware event, and the same actor was observed threatening to release stolen data when ransom went unpaid and following through in several instances, with indications other actors are beginning to mimic the behavior.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026