Quarterly Report: Incident Response Trends in Q1 2023

Web shell usage spikes in Q1 compared to previous quarters, correlating with higher instances of exploitation of public-facing applications.

In a novel increase compared to previous quarters, Cisco Talos Incident Response (Talos IR) reports that web shells were the most-observed threat in the first quarter of 2023, comprising nearly a fourth of the incidents Talos IR engaged in. The functionality of these web shells and the specific vulnerabilities and weaknesses in the platforms they targeted varied. Although each web shell …

applications basic cisco cisco talos cisco talos incident response exploitation first quarter functions higher incident incident response incidents novel own platforms public report reports response shell shells talos talos incident response threat trends vulnerabilities web web shell