Skip to content
NewA calmer, faster ZeroHour
Threat actorhighExploited in the wild

Talos Q3 2026 IR trends: help-desk vishing and rising ransomware

Original title: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

Cisco Talosby Aliza Johnson ()12 min read1
Read at blog.talosintelligence.com
Part of a story covered by 2 sourcesTalos: fake IT help-desk vishing rose alongside ransomware in Q3Merged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Phishing led initial access in just over one-third of engagements, down from over 50 percent, while ransomware rose to 27 percent.

Cisco Talos says phishing was the top initial-access method in slightly over one-third of Q3 2026 engagements, down from over half last quarter. Attackers combined voice phishing and fake IT help desks to get victims to approve legitimate remote-management tools. Public-facing edge devices accounted for about one-third of cases. Ransomware activity rose to 27 percent, and Salt Typhoon-linked telecom intrusions exploited CVE-2023-20198 and deployed the BadCandy web shell.

Unconfirmed: Talos attributes most telecom cases to China-sponsored actors, including Salt Typhoon, with high confidence; VYPR's immaturity is Talos's assessment.

Key facts
  • Named strains included The Gentlemen, Qilin, Rhysida, Interlock, and immature variant VYPR.
  • Actors disabled EDR, often through vulnerable drivers or Windows Defender Application Control.
  • One insider hired under false credentials installed GitHub Copilot CLI and Claude Code.
  • A trojanized macOS app scraped keychain credentials tied to Claude Code.
  • Telecom victims lacked MFA and used plaintext SNMP and outdated VPN encryption.
Security assessment · AI, from the articleExploited in the wild

Impact: initial access, espionage persistence, credential theft, and ransomware

What to do
  1. 1.Require MFA and tighten credential management, including accounts for AI tools.
  2. 2.Check exposed web management interfaces for exploitation of CVE-2023-20198.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2023-20198
ATT&CK
T1566.004 Spearphishing VoiceT1219 Remote Access SoftwareT1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1505.003 Web Shell
Tags
salt-typhoonransomwarevishingqilintelecommunicationsbadcandy
Vendors
AnthropicGitHub
Products
Claude CodeGitHub Copilot CLI
Threat actors
Salt TyphoonInterlock
Malware
BadCandyVYPRQilinRhysidaThe Gentlemen
Countries
China

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2023-20198
Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited)
10.0100%KEV
KEV

From the original article

12 min read at blog.talosintelligence.com

Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries.

Cisco Talos

By Aliza Johnson · blog.talosintelligence.com

Read the full article at Cisco Talos

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.