Talos IR ransomware engagements and the significance of timeliness in incident response

Cisco Talos compares two recent ransomware engagements—one involving Chaos affiliates that exfiltrated data but did not encrypt systems due to rapid Talos IR intervention, and a second involving Medusa ransomware that achieved nearly complete encryption after the victim delayed engagement and withheld network access. The report highlights common attacker techniques (social engineering, RMM abuse, LoLBins, Impacket), provides IOCs and signatures, analyzes how response time drove the differing impacts, and offers mitigation and detection recommendations to prevent similar outcomes.