In a significant shift observed during the first quarter of 2025, cybersecurity experts have documented a dramatic surge in phishing attacks, with threat actors increasingly using this vector to gain access to valid user accounts. Vishing campaigns-phone-based social engineering-accounted for over 60 percent of these phishing incidents, with attackers employing sophisticated social engineering techniques to manipulate users into granting remote access to their workstations. After gaining initial access via phishing, attackers employ sophisticated persistence techniques that enable ongoing control over compromised systems. According to recent incident response data, phishing attacks spiked to represent 50 percent of all initial access vectors, a staggering increase from less than 10 percent in the previous quarter. Cisco Talos researchers identified a notable evolution in these attacks, observing that threat actors have pivoted from simply eliciting sensitive information to establishing persistent access within networks. Without robust detection mechanisms focused on identifying suspicious registry modifications and token manipulation, organizations remain vulnerable to these sophisticated persistence techniques that can lead to devastating ransomware deployments like BlackBasta and Cactus. “This represents a tactical shift where phishing serves as just the first step in a multi-stage attack chain aimed at deeper network penetration,” noted Talos incident response team in their quarterly report. These actors then guide unsuspecting users through the process of establishing remote access sessions using tools like Microsoft Quick Assist. This allowed unauthorized access to Microsoft Office 365 environments where the attackers deployed enterprise applications to facilitate access to additional accounts. Once connected, the attackers swiftly begin loading malicious tooling, establishing persistence mechanisms, and disabling security protections. The manufacturing sector has been disproportionately targeted, representing 25 percent of all incidents this quarter, with construction organizations also facing significant attacks. A technical analysis of recent incidents reveals that adversaries modify the Windows Registry to maintain access.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 28 Apr 2025 17:55:08 +0000