Talos IR trends Q4 2024: Web shell usage and exploitation of public-facing applications spike

**Executive summary:** Talos Incident Response observed a significant shift in Q4 toward exploitation of public-facing applications and web shells (35% of incidents), a continued presence of ransomware and pre-ransomware activity (including BlackBasta, RansomHub, and newly observed Interlock), extensive use of remote access tooling and compromised valid accounts, long attacker dwell times (17–44 days), and large-scale password-spraying activity; the report maps these behaviors to MITRE ATT&CK techniques and provides mitigation recommendations such as enforcing MFA, patching, segmentation, and properly configured EDR.