Cisco released the Talos Incident Response (IR) Quarterly Trends Report for Q1 2024.

Cisco, a global leader in technology services, recently published the Talos Incident Response (IR) Quarterly Trends Report for the first quarter of 2024. Compiled by the Cisco Talos Intelligence Group, this report sheds light on the prevailing cyber threats and provides strategic insights aimed at fortifying organizations against cyberattacks.

In the latest report, Business Email Compromise (BEC) has emerged as the foremost cyber threat, accounting for 46% of all Cisco Talos IR engagements. This marks a notable increase from the previous quarter and involves attackers impersonating legitimate business contacts to send deceitful emails that may contain harmful links or arranged financial fraud.

Multi-Factor Authentication

The report also highlights ongoing challenges with Multi-Factor Authentication (MFA). A new phishing tool known as Tycoon 2FA has been identified, capable of avoiding MFA protections. This underscores the continued efforts by attackers to exploit weaknesses in MFA implementations.

Weaknesses involving MFA were observed within nearly half of engagements, with the top weakness being users accepting unauthorized push notifications, occurring within 25% of engagements. The lack of proper MFA implementation followed closely, accounting for 21% of engagements.

Ransomware

Ransomware incidents, previously the dominant threat in the final quarter of 2023, saw an 11% reduction, comprising 17% of total engagements. In the first quarter of 2024, Talos IR encountered new versions of Phobos and Akira ransomware, alongside continuing challenges from established threats like LockBit and Black Basta.

Notably, a recent analysis revealed that Akira ransomware has reintroduced encryption tactics to enhance its extortion capabilities, now executing a diversified assault strategy on both Windows and Linux platforms.

Additionally, Cisco’s security experts detected a range of other security threats, including data theft extortion schemes, brute-force attacks on virtual private network (VPN) systems, and attacks involving the known Gootloader malware.

Manufacturing

Manufacturing continues to be heavily targeted by cyber attackers, maintaining its status from the fourth quarter of 2023. It represented 21% of all incident response engagements, slightly more than the education sector. Healthcare, public administration, and technology sectors were also notably targeted, each tying for the third most affected sector.

The manufacturing industry saw a 20% rise in cyber incidents compared to the previous quarter, attributed to its critical need for uninterrupted operations. The threats faced by this sector included not only financially driven attacks like BEC and ransomware but also brute-force attacks targeting VPN infrastructures.

In terms of attack techniques, the prevalent method for initial access involved compromised credentials, which accounted for 29% of engagements, marking a significant increase of 75% from the previous quarter. The manipulation of email settings to hide malicious activities emerged as the most common evasion tactic, likely fueled by the rise in BEC and phishing incidents, accounting for 21% of engagements.

Fady Younes, Managing Director for Cybersecurity at Cisco Middle East & Africa, says, “We have seen significant changes in the way attackers approach their malicious activities since last year. In this complex landscape full of rapidly evolving threats, a holistic digital security strategy that focuses on proactive cybersecurity measures is of critical importance. At Cisco, we are leveraging cutting-edge technologies, including AI, to help organizations embed advanced security controls across their infrastructure to prevent, detect, and effectively respond to all forms of cyberattacks.”

The implementation of MFA and a single sign-on system ensures only trusted parties can access corporate email accounts to prevent the spread of BEC. Lack of MFA remains among the biggest impediments for enterprise security. All organizations should implement some form of MFA, such as Cisco Duo. Meanwhile, EDR solutions like Cisco Secure Endpoint can detect malicious activity on organizations’ networks and machines. In addition, Cisco’s Snort and ClamAV signatures can block many well-known ransomware families distributed in Q1 2024, such as Black Basta and Akira.

Cisco released the Talos Incident Response (IR) Quarterly Trends Report for Q1 2024.

The report offers key insights on top attacker trends, latest developments in ransomware, and most targeted sectors

The Dubai International Chamber’ strategic initiatives aimed at promoting Dubai as a global business hub, fostering bilateral trade, and empowering businesses through a range of innovative services.