Table of contents
- The cyber threat landscape is changing
- Web shells: the new cybercrime frontier
- Ransomware: a temporary decline?
The cyber threat landscape is changing
Rome, 18 February 2025 – 2024 ended with an alarming trend: web application attacks have significantly increased, while ransomware and pre-ransomware strategies have seen a slight decline. This is the scenario outlined by the latest Cisco Talos report, which analyzed cyber security incidents from the last quarter of the year.
According to experts, the driving force behind this shift has been the growing use of web shells, leveraged by threat actors to compromise vulnerable systems.
35% of incidents involved this technique, with attackers targeting unpatched web applications or those with known vulnerabilities. The predominant attack method now is exploiting exposed applications, surpassing the use of valid accounts, which was the trend in previous quarters.
Web shells: the new cybercrime frontier
Web shells are malicious tools that enable hackers to maintain persistent access to vulnerable web servers, allowing them to move laterally within a network. The Cisco Talos report identified several instances of these techniques in action:
- In many attack chains, hackers installed the “401.php” web shell, based on the open-source Neo-regeorg project available on GitHub;
- In other cases, the Fuzz Faster U Fool tool was used for brute force attacks on web applications, aiming to uncover credentials and hidden directories.
Despite adopting new techniques, cybercriminals have not abandoned older tools. For instance, an attack was documented against a vulnerable JBoss server, executed using a 2014 tool designed to test vulnerabilities in Java Platforms.
Although such tools are often rendered obsolete by updates, many attacks still succeed due to the lack of patching on target systems.
The dwell time (the duration attackers remain in compromised systems) has increased. This indicates more meticulous planning and strategic use of compromised resources, increasing the chances of lateral movement and the risk of critical data breaches.
Ransomware: a temporary decline?
While web application attacks are on the rise, ransomware and pre-ransomware incidents have slightly declined. According to the report, these threats accounted for about 30% of cyber security responses in the fourth quarter, down from 40% in the previous quarter.
Among the variants identified, Interlock emerged as a newly discovered ransomware, detected for the first time by Talos IR, alongside well-known malware families BlackBasta and RansomHub.
Forensic analysis revealed that the dwell time of these attacks ranged between 17 and 44 days, demonstrating that cybercriminals remain within compromised systems for extended periods before launching their final attack.
Conclusion
The evolution of cyber threats is constantly shifting: while ransomware appears to be losing momentum, web application attacks and the use of web shells are becoming a widespread threat.
This underscores the importance of keeping software updated and adopting proactive cyber security strategies.
