IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

What it is

Cisco Talos Incident Response (Talos IR) published its Q3 2026 trends report. It adds operational detail on help desk vishing, EDR-killing tactics, the new VYPR ransomware, and the most common control gaps seen in engagements.

How it works

Vishing to RMM. In the VYPR case, the actor phoned a user and got them to start a Microsoft Quick Assist session. The actor then used existing RMM software to run PowerShell that downloaded an MSI package from a remote IP address. Tools seen afterward: MeshAgent, Rclone, PsExec, IP scan and MSTSC. Exfiltration ran over multiple days, which is unusual for ransomware. Talos did not confirm the exact pretext in this case, but says help desk impersonation appeared in several other Q3 engagements.

VYPR. Talos judges it new and operationally immature. It has no data leak site referenced in the ransom note, and the DLS infrastructure was created only after the engagement. It reuses leaked Conti-derived source code with minimal changes. The actor deployed an unusually large number of vulnerable drivers (BYOVD) to disable EDR and AV, possibly for redundancy.

Interlock EDR tampering. The actors tried repeatedly to uninstall Cisco Secure Endpoint. They used PsExec.exe and taskkill.exe to kill security services and integrity checkers, including cscm.exe and sfc.exe. They also disabled Windows Defender real-time protection and cleared event logs. Earlier Interlock activity used a malicious WDAC policy to terminate EDR.

Salt Typhoon-linked telecom intrusions. Access came from valid credentials or CVE-2023-20198 in web-based management interfaces. One campaign deployed the BadCandy web shell. The actors created privileged accounts, disabled logging, changed configurations, and used VPN, traffic mirroring and management protocols for backdoors and exfiltration. Victims relied on password-only authentication, plaintext SNMP and outdated VPN encryption.

AI credentials. A trojanized macOS application led to a script that scraped the macOS keychain for Claude Code credentials. Separately, an employee hired under false credentials installed GitHub Copilot CLI and Claude Code. Talos found no evidence of malicious use.

Preconditions / Affected

• Environments with RMM tools or Quick Assist available to end users.
• Internet-facing edge devices and management interfaces, which were the main target of the 33 percent of engagements involving public-facing exploitation.
• Telecom operators for the Salt Typhoon activity.
• Weakness rates in Q3: insufficient logging in over 40 percent of engagements, credential and secret management in 33 percent, and authentication and MFA gaps in 33 percent.

What to do

• Centralize logs in a SIEM with at least 90 days of retention, forwarded off-device so they survive tampering and rebuilds. Cover servers, workstations, network gear, cloud identity providers and security appliances.
• Enable process-creation, command-line and cloud API (for example Microsoft Graph) auditing.
• Move from push and SMS MFA to FIDO2/WebAuthn or hardware keys. Where that is not yet possible, enforce number matching or verified push.
• Require help desk verification for self-service MFA enrollment.
• Block legacy authentication through Conditional Access.
• Enforce MFA on high-privilege accounts.
• Condition access on device compliance and trusted infrastructure, not geography alone.
• Use unique passwords and a password manager. Stop browser-stored credentials and autofill. Revoke and replace credentials promptly when no longer needed or suspected compromised.
• Treat AI tool credentials, such as Claude Code, as secrets under the same controls.

Caveats

• The report's figures are inconsistent. Ransomware is "a maximum of 20 percent" in one passage and "a little over 20 percent" in another.
• Phishing is described as both "slightly over one-third" and 37 percent.
• The page lists The Gentlemen among the ransomware groups, which the catalog summary omits.
• It gives no detection queries, indicators or patch versions for CVE-2023-20198.
• The MITRE ATT&CK appendix table was not in the fetched text.
• The report names web shells and scheduled tasks as the most-used persistence techniques.