Talos Q3 2026 IR trends: help-desk vishing and rising ransomware
Phishing led initial access in just over one-third of engagements, down from over 50 percent, while ransomware rose to 27 percent.
66
- Mentions · 7d0
- Mentions · 30d4
- All mentions10
- First seenSep 24, 2026
- Last mentioned13d ago
Timeline
10 articles · newest firstRansomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
84
Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families
Semperis says 37% of successful ransomware attacks included threats against employees’ friends or relatives.
74
September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
Germany Arrests Suspected Qilin Ransomware Leader After Japan Detention
Germany arrested a suspected Qilin leader extradited from Japan, while the gang kept listing new victims.
76
Japan confirms arrest of Russian Qilin operative, extradition to Germany
Japan arrested a 28-year-old Russian Qilin suspect in Osaka and extradited him to Germany.
66
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
A ThreatsDay roundup covers GlassWorm VS Code themes, VulcanRAT207, a Qilin extradition, and a rogue Gentlemen affiliate.
58
Japan hands over ‘Qilin’ hacker group member to Germany
Japan extradited a suspected Russian Qilin ransomware member to Germany.
60
Microsoft Finds Ransomware Group Using Same Attack Blueprint Across Multiple Malware Families
Microsoft says affiliate Storm-2570 reused one playbook across Qilin, DragonForce, Anubis, and BERT.
74
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, using consistent tradecraft across deployments.
70
Related CVEs
by mentions- CVE-2026-543022%10.0Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways
- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2022-22965100%9.8Unauthenticated RCE in VMware Spring Framework (Spring4Shell) - JDK 9+ Tomcat WARs
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-7136292%9.1Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento)
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2026-58704<1%8.8Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation
- CVE-2026-025796%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-4871070%6.5HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)
Appears with
- Qilinthreat actor · 6
- Microsoftvendor · 4
- Asahivictim · 2
- National Police Agencyorganization · 2
- CISAorganization · 2
- DragonForcemalware · 2
- Storm-2570threat actor · 2
- BERTmalware · 2
- Anubismalware · 2
- Semperisorganization · 1
- healthcarevictim · 1
- NightEaglethreat actor · 1
- City of Sugar Landvictim · 1
- PAN-OSproduct · 1
- Visual Studio Marketplaceproduct · 1
- Interlockthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.