[00:00] Aaron Cole: Welcome to Prime Cyber Insights. I'm Aaron Cole. Today, exploited vulnerabilities are dominating
[00:06] Aaron Cole: intrusions. Attackers are moving in hours, and the FBI just seized a major ransomware forum.
[00:13] Aaron Cole: So the big question is, what actually changes for defenders?
[00:18] Lauren Mitchell: And I'm Lauren Mitchell. We'll walk through new numbers showing exploits behind a huge chunk of
[00:24] Lauren Mitchell: initial access.
[00:25] Lauren Mitchell: why patching still drags in the real world and what the ramp takedown might signal for ransomware operations.
[00:33] Aaron Cole: Let's start with the patch or perish trend.
[00:36] Aaron Cole: Cisco Talos says exploited vulnerabilities drove nearly 40% of intrusions in Q4 2025.
[00:43] Aaron Cole: That's the second straight quarter where exploits lead initial access,
[00:47] Aaron Cole: even after that Q3 spike tied to large-scale tool shell activity.
[00:51] Aaron Cole: And honestly, the takeaway isn't the exact percentage.
[00:54] Aaron Cole: It's the timing.
[00:55] Aaron Cole: Oracle EBS and React 2Shell were reportedly getting hit right around disclosure,
[01:00] Aaron Cole: and proof of concepts spread fast.
[01:03] Aaron Cole: If you're defending internet-facing apps,
[01:05] Aaron Cole: your risk window is basically hours now, not weeks.
[01:09] Lauren Mitchell: Yep, and the reporting really shows how that window collapses.
[01:14] Lauren Mitchell: React 2Shell had functional exploit code floating around within about a day,
[01:19] Lauren Mitchell: and AWS warned that state-backed actors can move within hours or days on maximum severity bugs.
[01:26] Lauren Mitchell: So that old rhythm, wait for a maintenance window, bundle fixes, test next month, it just doesn't match attacker tempo.
[01:36] Lauren Mitchell: If a service is exposed, disclosure can basically be the starting gun.
[01:40] Aaron Cole: So why are so many enterprises still patching in months?
[01:44] Aaron Cole: It's complexity, it's fear of downtime, and it's also process gaps.
[01:49] Aaron Cole: And just to be clear, patch in hours doesn't mean reckless change.
[01:54] Aaron Cole: It means you already have an emergency lane that's pre-approved.
[01:58] Aaron Cole: You need an asset inventory that actually maps public exposure,
[02:02] Aaron Cole: a hot-fix playbook for critical CVEs, rapid testing patterns, and clear authority to act.
[02:08] Aaron Cole: And when you can't patch immediately, you compensate by reducing exposure.
[02:13] Aaron Cole: Pull vulnerable endpoints behind a VPN, restrict access with allow lists,
[02:18] Aaron Cole: disable modules, turn off unused features, or temporarily move that service out of the
[02:23] Lauren Mitchell: direct blast radius. Yes, this is where resilience meets governance.
[02:28] Lauren Mitchell: Leaders often want certainty before patching, but the certainty is that exploitation moves fast.
[02:37] Lauren Mitchell: A workable approach is to treat public-facing enterprise apps and default deployments in
[02:43] Lauren Mitchell: widely used frameworks as high-risk by design.
[02:47] Lauren Mitchell: Then,
[02:47] Lauren Mitchell: you tear it. Critical, externally reachable systems get immediate mitigations. And internal-only
[02:55] Lauren Mitchell: systems follow a shorter but safer validation cycle. And also, make sure your telemetry
[03:02] Lauren Mitchell: is actually ready. Talos emphasized logs.
[03:06] Lauren Mitchell: If responders show up and you've got no authentication logs, no web logs, no endpoint traces, you're basically blind.
[03:14] Aaron Cole: Now, even with exploits leading, phishing is still right there at 32% of access cases.
[03:21] Aaron Cole: Talos pointed to campaigns targeting Native American tribal organizations
[03:26] Aaron Cole: where successful phishes led to email account compromise
[03:29] Aaron Cole: and then attackers used that access to run internal and external follow-on phishing.
[03:34] Aaron Cole: That's the pattern. One mailbox becomes a launch pad, and the victim's trust relationships do the scaling for the attacker.
[03:42] Lauren Mitchell: That's notable because the advice is familiar, but the execution has to be sharper now.
[03:49] Lauren Mitchell: MFA everywhere, plus detection for MFA abuse.
[03:54] Lauren Mitchell: Think impossible travel, weird token refresh patterns, push fatigue signals, and risky OAuth
[04:02] Lauren Mitchell: app grants.
[04:03] Lauren Mitchell: And don't treat internal phishing like it's just a footnote.
[04:07] Lauren Mitchell: If an attacker is sending from a legitimate account, your secure email gateway might not
[04:13] Lauren Mitchell: save you.
[04:14] Lauren Mitchell: You need strong user reporting pipelines.
[04:17] Lauren Mitchell: rapid account quarantine, conditional access controls, and the ability to invalidate sessions quickly.
[04:25] Aaron Cole: Let's shift to the other big headline. The FBI seized Ramp, a long-running forum that had positioned itself as a key marketplace and discussion hub, especially as other forums got disrupted.
[04:38] Aaron Cole: ours reports both the clear web and dark websites were taken over and dns now points to fbi-controlled
[04:46] Aaron Cole: infrastructure we don't have public confirmation of arrests but even the seizure alone can
[04:51] Aaron Cole: create real turbulence buyers lose vendors escrow relationships break and reputations get
[04:57] Aaron Cole: questioned overnight wait what
[05:00] Lauren Mitchell: The defensive read here still has to be cautious.
[05:04] Lauren Mitchell: A takedown can fragment coordination and raise OPEC anxiety, especially if user databases
[05:12] Lauren Mitchell: or messages were accessed, but it doesn't remove the underlying demand for access, malware,
[05:18] Lauren Mitchell: and laundering.
[05:20] Lauren Mitchell: We've seen ecosystems reform elsewhere, sometimes more distributed.
[05:25] Lauren Mitchell: And another point from the Talos data, ransomware cases dropped to 13% from 20% the prior quarter.
[05:33] Lauren Mitchell: That can mean consolidation, fewer groups, bigger operations, not necessarily less risk.
[05:40] Lauren Mitchell: So, defenders should treat this as disruption, not victory.
[05:46] Aaron Cole: All right, action items to close out.
[05:48] Aaron Cole: First, measure your exposure to patch time for internet-facing systems and set an hours-level
[05:54] Aaron Cole: lane for critical CVEs.
[05:56] Aaron Cole: Second, if you can't patch, reduce exposure immediately.
[06:00] Aaron Cole: Don't leave vulnerable endpoints hanging out on the open internet.
[06:03] Aaron Cole: Third, harden identity with MFA plus monitoring for bypass and abuse.
[06:08] Aaron Cole: Fourth, log like you mean it because you can't investigate what you didn't record.
[06:13] Lauren Mitchell: And I'll add one more.
[06:15] Lauren Mitchell: Treat criminal market disruptions like ramp as short-term volatility.
[06:20] Lauren Mitchell: Your best hedge is disciplined basics, asset visibility, rapid mitigation, identity controls,
[06:28] Lauren Mitchell: and incident-ready logging. That's it for today. I'm Lauren Mitchell.
[06:33] Aaron Cole: I'm Aaron Cole. Thanks for listening to Prime Cyber Insights. For more episodes,
[06:38] Aaron Cole: head to PCI.neuralNewscast.com. Neural Newscast is AI-assisted, human-reviewed.
[06:44] Aaron Cole: View our AI transparency policy at neuralnewscast.com.