Cybersecurity Alert: Key Insights from Ontinue’s 2H 2024 Threat Intelligence Report

Same categories, moved goalposts. The report reads best as a side-by-side of what the threat used to look like and what it looks like now.

The Ontinue 2H 2024 Threat Intelligence Report describes a set of category shifts: ransomware traded payout size for attack volume, phishing traded the inbox for the phone, and malware delivery traded email attachments for browser extensions and paid ads.

None of these categories are new. What the report shows is the direction each one moved in the second half of 2024, and every arrow points the same way: toward blending in. A stolen session token, a cloned voice, a trusted admin tool. Each one looks legitimate to a defense built to spot the obviously malicious. That is the practical warning for a Katy or Houston business running yesterday's checklist.

The single biggest theme in 2H 2024 was token theft: attackers grabbing a valid session instead of cracking a password.

Adversary-in-the-middle phishing, or AiTM, is an attack where a malicious proxy sits between the user and a real login page, captures the session token after the user completes MFA, and replays that token to log in as the user without ever needing the password again.

The report names AiTM as the dominant threat of the second half of 2024, and the reason is that it defeats the control most businesses lean on. Multi-factor authentication stops a stolen password. It does not stop a stolen session. Once an attacker holds a valid token, the login looks exactly like the real employee. Ontinue's team saw this paired with several supporting tactics:

• Legitimate services as bait. Attackers staged initial landing pages on trusted platforms, then redirected victims to the credential-harvesting proxy so the first click looked safe.
• Voice phishing at scale. Vishing detections rose 1,633% quarter over quarter, using AI-cloned voices to impersonate executives and IT staff and bypass email security completely.
• Living off Microsoft's own tools. Quick Assist (remote help) and Windows Hello (authentication) were abused to gain access and operate quietly, because a built-in tool rarely trips an alarm.
• Password spray on Entra ID. Ontinue's top detections included password-spray attacks against Microsoft Entra ID, the identity service most Houston SMBs now run on.

Put together, these findings say the perimeter moved. It is no longer the firewall at the edge of your office; it is the identity of every person who can log in. That is a different thing to defend, and most small businesses have not caught up to it.

The economics inverted. Fewer victims paid, so groups ran more operations to make up the difference.

The Ontinue 2H 2024 report found ransomware attacks rose 132% while total ransom payments fell 35%, from $1.25 billion in 2023 to about $813.5 million in 2024, which means each attack earned less on average and groups compensated by attacking far more often.

More defenders refused to pay, better backups meant fewer businesses had to, and law enforcement disrupted several major groups. So the per-attack payout shrank. The response was volume. That changes the math for a smaller business in a way worth stating plainly: a lower average payout does not make you safer if the number of attacks more than doubled. The report's firmographic and sector findings sharpen the point:

• Smaller organizations reported more incidents than large enterprises. Firms under 50 employees logged more ransomware incidents than companies with 1,000-plus staff, because they are easier to reach and less likely to be defended.
• Manufacturing, services, and healthcare stayed the top targets. Sectors with low downtime tolerance and older systems keep drawing the most attention, which maps directly onto Houston's industrial and energy base.
• Critical infrastructure moved up the list. Attackers leaned toward targets where the stakes, and the pressure to pay, run higher, including operational technology and edge devices.

For a Houston SMB, the takeaway is that "we are too small to be a target" was already wrong, and the 2H-2024 numbers make it wronger. The volume shift means the small manufacturer in Cypress is now squarely inside the pool, not adjacent to it.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area, with the security stack and local support to turn a threat report's findings into working defenses.

CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees. A report tells you where the threat moved; keeping pace with it is the part most SMBs cannot staff alone:

• Phishing-resistant identity. We deploy MFA that resists token theft, conditional access, and monitoring on Microsoft Entra ID, directly answering the AiTM and password-spray findings.
• Ransomware resilience. Tested backups, endpoint detection and response, and segmentation so a breach does not become a shutdown, built for the higher attack volume the report documents.
• Tool-abuse detection. We watch for misuse of Quick Assist, Windows Hello, and PowerShell, the exact living-off-the-land tactics Ontinue flagged.
• Staff training against vishing. We teach your team to verify a voice request out of band, the human control that beats an AI-cloned call.

The businesses that stay ahead treat a threat report as a to-do list, not a headline. If you run a company in Houston or Katy and your defense is still built around the perimeter instead of the login, talk to CinchOps and we will close the gap the 2H-2024 report just mapped for you.