Full Report
Download Talos' 2024 Year in Review now, and access key insights on the top targeted vulnerabilities of the year, network-based attacks, email threats, adversary toolsets, identity attacks, multi-factor authentication (MFA) abuse, ransomware and AI-based attacks.
Analysis Summary
# Morning News Roll-up March 31, 2025
## Overview
Cisco Talos has released its **2024 Year in Review** report, derived from telemetry across 46 million global devices. The report highlights a strategic shift toward stealth and simplicity, with threat actors prioritizing identity exploitation and valid credentials over complex zero-day exploits.
## Top Stories
### Cisco Talos 2024 Year in Review: Identity and Stealth
- Summary: The 2024 threat landscape was dominated by identity-based attacks and the exploitation of valid accounts. Key findings show that 60% of incident response cases involved identity attacks, and nearly 70% of ransomware cases began with the use of valid accounts for initial access.
- Source: hxxps://blog[.]talosintelligence[.]com/2024yearinreview
### Ransomware Trends: Education Under Fire
- Summary: Education remained the most targeted sector for ransomware in 2024. Attackers are increasingly bypassing traditional security by leveraging valid credentials and targeting identity and access management (IAM) applications, which accounted for 25% of MFA-related attacks.
- Source: hxxps://blog[.]talosintelligence[.]com/content/files/2025/03/2024YiR-report[.]pdf
### The Reality of AI and Network Vulnerabilities
- Summary: While AI was expected to revolutionize cyberattacks, its actual use in 2024 was limited to enhancing existing techniques rather than creating new ones. Concurrently, attackers are focusing on network vulnerabilities in end-of-life (EOL) devices that lack available patches.
- Source: hxxps://blog[.]talosintelligence[.]com/2024yearinreview
---
# Main Topic
Cisco Talos 2024 Year in Review: Analysis of global threat trends focusing on identity exploitation, ransomware, and the weaponization of network vulnerabilities.
## Key Points
- **Identity Dominance:** Identity-based attacks comprised 60% of all Cisco Talos Incident Response (CTIR) cases in 2024.
- **Ransomware Access:** 70% of ransomware incidents leveraged valid accounts for initial entry, moving away from complex malware delivery.
- **MFA Fatigue and Abuse:** Identity and Access Management (IAM) applications were the focus of nearly 25% of all MFA-based attacks.
- **AI Integration:** AI and machine learning are currently used to augment and refine existing TTPs rather than generating novel attack vectors.
- **EOL Risks:** A significant portion of network-based attacks targeted End-of-Life (EOL) devices which no longer receive security updates.
## Threat Actors
- **Ransomware Groups:** Specifically noted for targeting the Education sector and heavily utilizing credential-based access.
- **Network Exploitation Actors:** Groups focusing on legacy infrastructure and unpatchable vulnerabilities in network appliances.
## TTPs
- **Valid Accounts:** Use of legitimate credentials for initial access (appears in 70% of ransomware cases).
- **MFA Abuse:** Targeting IAM applications to bypass or overwhelm multi-factor authentication.
- **Stealth and Simplicity:** Favoring living-off-the-land (LotL) techniques and straightforward credential theft over sophisticated custom malware.
- **Vulnerability Targeting:** Exploiting known vulnerabilities in EOL network hardware.
## Affected Systems
- **Education Sector:** Identified as the most targeted vertical for ransomware.
- **IAM Applications:** High-frequency targets for MFA-related exploitation.
- **End-of-Life (EOL) Hardware:** Network devices no longer supported by vendors.
- **Identity Infrastructure:** Core authentication systems and valid user accounts.
## Mitigations
- **Identity Protection:** Prioritize securing IAM applications and monitoring for "impossible travel" or unusual login patterns.
- **MFA Hardening:** Implement phish-resistant MFA (such as FIDO2/WebAuthn) to counter MFA exhaustion and bypass techniques.
- **Legacy Management:** Decommission or isolate End-of-Life (EOL) devices that can no longer be patched.
- **Credential Hygiene:** Implement strict password policies and monitor for leaked credentials to prevent the use of "valid accounts" for initial access.
- **Patch Management:** Focus on high-risk network vulnerabilities even if they are not the "newest" exploits.
## Conclusion
The 2024 threat landscape indicates that adversaries are choosing the path of least resistance by exploiting identities and unpatched legacy hardware. Organizations should pivot their defense strategy from focusing solely on malware detection to robust identity security and rigorous lifecycle management of network assets. Priorities for 2025 should include hardening MFA implementations and reducing the attack surface provided by unpatchable EOL systems.