Public-facing applications emerge as top cybercrime target, Cisco Talos warns

Public-facing applications have overtaken other entry points as the primary target for cybercriminals, according to Cisco Talos’ Q3 2025 Incident Trends Report.

The report, issued by one of the world’s largest commercial threat intelligence teams, highlights a surge in attacks exploiting newly disclosed Microsoft SharePoint vulnerabilities, alongside persistent ransomware activity and growing abuse of multi-factor authentication (MFA).

More than 60 per cent of incidents during the quarter began with the exploitation of public-facing applications, a steep rise from less than 10 per cent in the previous quarter. The increase was driven by attacks using the ToolShell exploit chain, which targeted on-premises SharePoint servers immediately after Microsoft’s vulnerability disclosure.

Cisco Talos noted that some attacks occurred within a day of the advisory, illustrating how quickly threat actors act once zero-day vulnerabilities are made public.

“The Talos data shows how quickly attackers exploit newly disclosed vulnerabilities in public-facing applications,” said Fady Younes, Managing Director for Cybersecurity at Cisco Middle East, Africa, Türkiye, Romania and CIS. “For organisations in the UAE expanding digital and cloud services, exploit protection and strong network segmentation are critical to reducing the risk of disruptive attacks.”

Ransomware accounted for around 20 per cent of incidents in Q3 2025, down from 50 per cent in the previous quarter, but remains a major threat. Cisco Talos identified several new ransomware variants, Warlock, Babuk, and Kraken, in addition to well-known families such as Qilin and LockBit.

In one instance, attackers deployed ransomware within two days of breaching an organisation’s network. The group Storm-2603, believed to operate from China, used Velociraptor, a legitimate security tool, marking its first known use in ransomware operations.

The report also found that nearly one-third of incidents involved attackers bypassing or abusing MFA. Common techniques included overwhelming users with repeated login prompts, known as “MFA bombing,” and exploiting weaknesses in configuration or implementation. Cisco Talos warned that while MFA remains essential, it must be paired with monitoring and strong policy enforcement to maintain its effectiveness.

Overall, the report urges organisations to prioritise rapid patching, network segmentation, and real-time threat intelligence as attackers continue to evolve their tactics and exploit newly exposed vulnerabilities in public-facing systems.