Source: Cisco Talos Blog

Cisco Talos has published its Incident Response trends report for the third quarter of 2026, based on engagements from July to September. Phishing remained the leading initial access technique, appearing in slightly over one third of all Talos IR engagements, although that is a decrease from over 50 percent the previous quarter. What has changed is the follow up: Talos observed numerous threat actors conducting voice phishing, or vishing, together with IT help desk impersonation, socially engineering victims into allowing remote access via a legitimate remote monitoring and management tool. Because the RMM tool is real and trusted, the access looks like ordinary administration to many security stacks.

Exploitation of public facing applications was the next most common vector, accounting for one third of engagements, with attackers predominantly targeting edge devices such as security gateways and remote network management interfaces. Compromising those components provides broad access to internal networks and user credentials.

Ransomware is rising again

Ransomware and pre-ransomware incidents made up 27 percent of engagements in Q3 2026, an increase from a maximum of 20 percent across the previous four quarters. Talos responded to attacks involving well established ransomware as a service variants such as The Gentlemen, Qilin and Rhysida, the closed group Interlock, and an emerging variant named VYPR whose operators tested a range of tactics rather than following a standard affiliate playbook. A dominant tactic was disabling endpoint detection and response tools, often by exploiting vulnerable drivers or abusing Windows Defender Application Control.

The quarter also saw prolonged cyber espionage intrusions against the telecommunications sector, attributed with high confidence to China state sponsored actors including Salt Typhoon, who gained access with valid credentials and by exploiting CVE-2023-20198 in public web based management interfaces, then used living off the land tactics such as VPN access, traffic mirroring and management protocols to maintain stealthy persistence.

Lessons for your organisation

The recurring weaknesses Talos found in victim environments are all fixable: password only authentication without MFA, legacy management protocols such as plaintext SNMP, outdated VPN encryption and poor credential management. Attackers created privileged accounts, disabled logging and altered configurations without meeting effective security barriers. Train staff to verify any unexpected IT help desk call through a separate known channel before granting remote access, enforce phishing resistant MFA everywhere, tighten help desk identity verification procedures, and control which RMM tools are permitted on endpoints.

If you want help hardening identity, help desk procedures or endpoint defences against vishing and ransomware, contact us for professional advice.