Talos Reports Help Desk Vishing and Rising Ransomware Activity

Cisco Talos Incident Response reported that phishing was the leading initial access vector in its Q3 2026 engagements, accounting for 37 percent, followed by exploitation of public-facing applications at 33 percent. Ransomware and pre-ransomware incidents represented 27 percent of engagements, with attackers impersonating IT help desks in voice-phishing attacks, using social engineering to obtain remote access, and frequently disabling endpoint security. Investigators also identified an operationally immature ransomware variant, VYPR, and credential theft specifically targeting Anthropic Claude Code on a compromised macOS endpoint.

Talos attributed prolonged telecommunications espionage intrusions with high confidence primarily to China state-sponsored actors, including Salt Typhoon; attackers exploited CVE-2023-20198 and deployed the BadCandy web shell. Across investigations, insufficient logging, poor credential management, and missing or inadequate multifactor authentication repeatedly hindered defenses. Talos recommended centralized logging, phishing-resistant authentication, and stronger secrets management to address these recurring weaknesses.