In 2024, cyber-criminals didn’t need cutting-edge malware or zero-day exploits to breach major organisations. Instead, they went back to basics—and it worked.

According to Cisco Talos’ 2024 Year in Review, threat actors “prioritised stealth, simplicity, and efficiency, largely abandoning the use of custom malware and zero-day vulnerabilities in favor of simpler yet highly effective techniques.”

The report, compiled from telemetry across 46 million devices in 193 countries, reveals a disturbing trend: attackers are logging in, not hacking in, bypassing traditional defenses by exploiting weak credentials, unpatched systems, and misconfigurations.

This shift has made cybersecurity less about stopping sophisticated code and more about securing fundamental IT hygiene—a challenge many organisations are still failing.

The Credential Epidemic

Gone are the days when cyber-attacks required custom malware or exotic exploits. Last year, 60% of all incidents Cisco Talos responded to involved identity-based attacks – threat actors using stolen login credentials, session tokens, and API keys to bypass security controls.

“Adversaries are increasingly opting to compromise networks and accounts by simply logging in, rather than using more complex methods like exploiting vulnerabilities or deploying malware,” the report states.

Active Directory, the authentication system used by nearly every large organisation, became a prime target in 2024. In one case, ransomware operators used a legitimate sysadmin tool called ADExplorer to dump an entire Active Directory database, then methodically disabled security software before deploying their payload.

The attack succeeded because of misconfigured permissions – a basic security oversight with catastrophic consequences.

The Unpatchable Past

While security teams prepared for novel threats, attackers kept exploiting vulnerabilities discovered years or even decades ago.

The notorious Log4Shell flaw, first identified in late 2021, remained one of the most exploited vulnerabilities in 2024. The U.S. Department of Homeland Security estimates it will take at least a decade to eradicate Log4j vulnerabilities completely due to its pervasive use in software supply chains.

Even older weaknesses proved dangerous. Four of the twelve most-exploited vulnerabilities last year were over a decade old, including PHP and Bash scripting flaws affecting millions of systems. “Failure to apply security updates leaves organisations vulnerable to many attacks that could otherwise be prevented,” the report notes.

Perhaps most alarming were attacks targeting end-of-life hardware – devices manufacturers no longer support with security patches. D-Link network storage devices, for example, were actively exploited despite having no available fixes. Many organisations continue running outdated infrastructure, essentially leaving digital backdoors unlocked.

Ransomware’s Relentless March

Ransomware groups refined their tactics in 2024, focusing on soft targets with limited cybersecurity resources.

Higher education institutions bore the brunt, suffering six times more attacks than other schools. Universities’ vast research databases and reliance on IT infrastructure made them ideal victims – attackers knew disruptions to online classes or scientific projects would pressure administrators to pay quickly.

Healthcare organisations and local governments followed close behind, both sectors struggling with tight budgets and bureaucratic hurdles that delay security upgrades.

Attackers timed many strikes for summer months when IT staffs were stretched thin. In one incident, a LockBit ransomware operator hijacked an IT administrator’s account while the employee was on vacation, then created new admin accounts to cement control.

Recommended reading

• Amazon Confirms Data Breach Linked to MOVEit Vulnerability
• Report: Mitigating the Vulnerability Exploit Surge
• Report: Vulnerability Exploitation Surge Endangers Cybersecurity

Security tools offered little protection when improperly configured. In nearly half of ransomware cases Cisco Talos investigated, attackers successfully disabled endpoint detection systems early in their attacks. “They almost always tried to disable security solutions, and succeeded nearly 50% of the time,” the report reveals.

The AI Letdown

While security vendors hyped artificial intelligence threats, 2024 saw limited offensive use of AI by cyber-criminals. Generative AI tools like ChatGPT were occasionally used to polish phishing emails or debug malicious code, but they didn’t revolutionise attacks as many feared.

“Threat actor use of AI and machine learning largely fell short of industry projections in 2024,” the report concludes. Instead of developing AI-powered supermalware, attackers stuck to what worked—just doing it more efficiently.

That may change in 2025. Cisco Talos warns of “agentic AI” systems that could autonomously seek out vulnerabilities or conduct multi-stage attacks. For now though, the real threats remain stubbornly low-tech: weak passwords, unpatched systems, and human error.

Fighting Back

Talos’ top 10 tips for securing network devices:

1. Update devices as aggressively as possible. This includes patching current hardware and software against known vulnerabilities
and replacing end-of-life hardware and software.
2. Implement robust authentication methods. Use multifactor authentication, select complex passwords and community strings,
and avoid default credentials.
3. Adhere to security best practices, including conducting regular updates, managing access controls, implementing user education,
and enforcing network segmentation.
4. Encrypt all monitoring and configuration traffic, including SNMPv3, HTTPS, SSH, NETCONF, and RESTCONF.
5. Stay informed and up-to-date on security advisories from the U.S. government and industry. Consider suggested configuration
changes to mitigate issues captured by these reports.
6. Lock down and actively monitor credential systems, such as TACACS+ and any jump hosts.
7. Store configurations centrally and push to devices. Do not allow devices to be the trusted source for their configurations.
8. Use authentication, authorisation, and accounting (AAA) to deny configuration changes for key device protections, such as local
accounts, TACACS+, and RADIUS.
9. Monitor your environment for unusual changes in behavior or configuration. Be on the lookout for exposure of administrative or
unusual interfaces (such as SNMP, SSH, and HTTP(S)), and monitor syslog and AAA for unusual activities.
10. Profile your devices’ baseline to identify any changes. Fingerprint network devices via NetFlow and port scanning for a shift in
surface view, including new ports opening/closing and traffic to/from. When possible, develop NetFlow visibility to identify
unusual volumetric changes.

As one security engineer quoted in the report put it: “We’re losing to attacks our grandparents’ IT systems could have stopped.” In 2024, the flashy futuristic threats never arrived. The old ones were enough.