PSTS Cyberattacks Rise 69% as ReliaQuest Urges Faster Edge Defense
Summary
ReliaQuest reports a 69% quarterly rise in attacks on professional, scientific, and technical services firms, with more web-shell activity and faster exploitation. It recommends hardening internet-facing systems and promotes its GreyMatter platform.
Key points
- ReliaQuest reports PSTS-sector cyberattacks rose 69% last quarter; phishing's share of observed techniques fell from 23% to 17%, while web-shell activity rose from 2% to 6%.
- The company says exploited vulnerabilities rose from 62 to 109 and same-day exploitation from 17 to 32; it cites rapid weaponization of flaws affecting Ivanti Connect Secure and Microsoft SharePoint.
- The article says two SonicWall SMA1000 zero-days exposed more than 400 devices to full remote code execution, and describes CVE-2026-76504 in Cisco Catalyst SD-WAN Manager as enabling API-authentication bypass and administrative access.
- ReliaQuest says ransomware groups including The Gentlemen, Qilin, Inc Ransom, DragonForce, and Dire Wolf posted PSTS victim numbers above all-sector averages.
- Recommended measures include phishing-resistant MFA for VPN and RDP, disabling unused remote services, promptly patching edge appliances, restricting exposure and management access when patches are unavailable, and monitoring unusual API activity.
- The article also recommends blocking unauthorized tools such as Rclone and searching internet-facing systems for web shells; it promotes GreyMatter's automated detection and response capabilities.
Article Details
- Topic
- Cybersecurity risks and defensive strategies for professional, scientific, and technical services organizations
CVE
Threat Actors
Dire WolfDescribed as a newcomer among ransomware groups focused on the PSTS sector; the article says it posted PSTS victim numbers well above all-sector averages.DragonForceIdentified as a ransomware group focused on the PSTS sector; the article says it posted PSTS victim numbers well above all-sector averages.INC RansomIdentified as a ransomware group focused on the PSTS sector; the article says it posted PSTS victim numbers well above all-sector averages.QilinIdentified as a ransomware group focused on the PSTS sector; the article says it posted PSTS victim numbers well above all-sector averages.The GentlemenIdentified as a ransomware group focused on the PSTS sector; the article says it posted PSTS victim numbers well above all-sector averages.
Vendors
CiscoCisco Catalyst SD-WAN Manager: CVE-2026-76504, a maximum-severity CVSS 10 flaw, allows attackers to bypass API authentication and gain full administrative access.Ivantijumped from 62 to 109, while same-day exploitation nearly doubled from 17 to 32. High-profile flaws in Ivanti Connect Secure and Microsoft SharePoint were weaponized as soon as they were disclosed.Microsoftsame-day exploitation nearly doubled from 17 to 32. High-profile flaws in Ivanti Connect Secure and Microsoft SharePoint were weaponized as soon as they were disclosed.ReliaQuestReliaQuest’s agentic AI security operations platform, GreyMatter, addresses this architectural challenge.SonicWallSonicWall SMA1000: Two zero-days left over 400 devices exposed to full remote code execution.
Products
Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager: CVE-2026-76504, a maximum-severity CVSS 10 flaw, allows attackers to bypass API authentication and gain full administrative access.GreyMatterReliaQuest’s agentic AI security operations platform, GreyMatter, addresses this architectural challenge.Ivanti Connect Securefrom 62 to 109, while same-day exploitation nearly doubled from 17 to 32. High-profile flaws in Ivanti Connect Secure and Microsoft SharePoint were weaponized as soon as they were disclosed.Microsoft SharePointexploitation nearly doubled from 17 to 32. High-profile flaws in Ivanti Connect Secure and Microsoft SharePoint were weaponized as soon as they were disclosed.SonicWall SMA1000SonicWall SMA1000: Two zero-days left over 400 devices exposed to full remote code execution.