This quarter, Cisco Talos observed a significant surge in phishing activity, which now accounts for over half of all incident response engagements. Attackers are increasingly using QR code-embedded PDFs and trusted cloud platforms like SharePoint to bypass traditional email security. Furthermore, authentication abuse has nearly doubled, with adversaries frequently defeating multi-factor authentication (MFA) through adversary-in-the-middle (AitM) proxies, session-token theft, and MFA fatigue attacks.
Ransomware remains a critical threat, representing 20% of cases, with the emergence of the Sinobi variant and the continued activity of groups like Warlock. A notable trend is the weaponization of legitimate remote monitoring and management (RMM) tools, such as MeshAgent and Zoho Assist, to maintain stealthy, persistent access. Healthcare continues to be the most targeted industry due to its low tolerance for operational downtime, highlighting the urgent need for phishing-resistant MFA and improved centralized logging.
Top comments (0)