Talos Q3 2026 IR trends: help-desk vishing and rising ransomware
Phishing led initial access in just over one-third of engagements, down from over 50 percent, while ransomware rose to 27 percent.
66
Malware
Rhysida
- Mentions · 7d1
- Mentions · 30d3
- All mentions5
- First seenSep 1, 2026
- Last mentioned1d ago
Timeline
5 articles · newest firstBaltimore suburb confirms August data breach after ransomware claims
Anne Arundel County confirmed hackers copied files in August after Rhysida claimed a $2 million extortion.
73
Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks
Forescout says ClickFix installed Lorem Ipsum Loader and a Python tunnel before suspected ransomware was stopped.
64
Risky Bulletin: BEC campaign steals €35 million from French notaries
Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.
72
Berlin refuses to be blackmailed after network breach
Rhysida extorts Berlin's state government after stealing 5.79 TB across 1.44 million files, demanding roughly 2 million euros in bitcoin.
78
Related CVEs
by mentions- CVE-2023-20198100%10.0Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited)
Appears with
- Rhysidathreat actor · 2
- Microsoft Teamsproduct · 1
- Liquid Networkproduct · 1
- UC Berkeleyvictim · 1
- Blockstreamvictim · 1
- Interlockthreat actor · 1
- Berlin city governmentvictim · 1
- City of Roanokevictim · 1
- Trezorvictim · 1
- Vice Societythreat actor · 1
- GitHub Copilot CLIproduct · 1
- ANSSIorganization · 1
- VYPRmalware · 1
- Anne Arundel Countyvictim · 1
- Conseil Supérieur du Notariatorganization · 1
- JetBrainsvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.