IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Our summary
Cisco Talos' latest incident-response report finds phishing still topping the initial-access charts in a third of Q3 2026 cases, but with a twist: attackers increasingly combine voice phishing with fake IT help-desk calls to trick victims into granting remote access through legitimate RMM tools. Exploiting internet-facing applications came in close behind, often targeting edge devices like VPN gateways and management interfaces. Ransomware and pre-ransomware incidents jumped to 27% of engagements, involving groups such as The Gentlemen, Qilin, Rhysida, and the closed Interlock gang, alongside a newly spotted, technically unpolished variant dubbed VYPR that relied on leaked Conti code and Bring-Your-Own-Vulnerable-Driver tricks to kill EDR. Separately, Talos tied several long-running telecom intrusions with high confidence to Chinese state-sponsored actors including Salt Typhoon, who abused valid credentials and the known flaw CVE-2023-20198 in web management interfaces to deploy the BadCandy web shell and maintain stealthy persistence, exposing weak MFA and poor credential hygiene as recurring failure points.
Below is the opening; the full story is at Cisco Talos.
From Cisco Talos
Thursday, October 29, 2026 10:00
Phishing remained the leading initial access technique, appearing in slightly over one-third of all Cisco Talos Incident Response (Talos IR) engagements — a decrease from over 50 percent last quarter. In addition to traditional phishing links and attachments, we observed numerous threat actors conducting voice phishing (vishing) in tandem with IT desk impersonation to socially engineer the victim into allowing remote access via a legitimate remote monitoring and management (RMM) tool. Exploitation of public-facing applications was the next most common vector, accounting for one-third of Talos IR engagements. Threat actors predominantly targeted edge devices such as security gateways and remote network management interfaces. These are critical components within enterprise environments, often responsible for managing authentication, network traffic, or sensitive data. Compromising them can provide broad access to internal networks or user credentials.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.