Forest Global Training Partners

Cyber Risks · Cisco Talos

Incident Response lessons from recent Maze ransomware attacks

Summary: Cisco Talos Incident Response described two targeted ransomware incidents in which attackers used CobaltStrike after gaining network access, spent at least a week moving laterally, exfiltrated data via PowerShell to a remote FTP server, and then deployed Maze ransomware. Talos assessed with high confidence that the same adversary was behind both incidents, citing shared command-and-control infrastructure, use of 7-Zip to compress data before exfiltration, interactive RDP logins, remote PowerShell execution via WMIC, and a named pipe technique associated with APT-29.

Bottom line: The attackers spent at least a week inside the network before deploying ransomware, and in both cases the data was already out the door before encryption began - so a recovery plan that only restores from backup does not address the extortion that follows.

Read the original at Cisco Talos ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026