Cryptominers, ransomware among top malware in IR engagements in Q4
Summary: Cisco Talos Incident Response data from engagements between May and July 2019 found common malware families used in unsophisticated attacks, with phishing the top infection vector. Ryuk was typically dropped by banking trojans such as Trickbot, Emotet appeared in several engagements, and Chinese cryptocurrency botnets linked to the Rocke and Iron groups infected internet-facing servers and Hadoop virtual machines.
Key Takeaway: Talos reports that in the majority of engagements it could not pinpoint the initial attack vector, and that lack of logging was a weakness in almost every engagement - meaning the record of what an adversary did after getting in often does not exist.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026