CriticalRansomware
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Cisco Talos·Source published ·1 min read
What happened?
Phishing remained the leading initial access technique, appearing in slightly over one-third of all Cisco Talos Incident Response (Talos IR) engagements — a decrease from over 50 percent last quarter. In addition to traditional phishing links and attachments, we observed numerous threat actors conducting voice phishing (vishing) in tandem with IT desk impersonation to socially engineer the victim into allowing remote access via a legitimate remote monitoring and management (RMM) tool.
Key details
- Threat actors impersonated IT help desks during vishing calls to socially engineer victims into allowing remote access via RMM tools.
- Exploitation of public-facing applications accounted for 33% of Talos IR engagements, targeting edge devices like security gateways.
- Ransomware and pre-ransomware incidents increased to 27% of engagements, up from a maximum of 20% in previous quarters.
- VYPR is an emerging ransomware variant observed testing tactics rather than following a standard playbook.
Affected
- Edge devices such as security gateways and remote network management interfaces are targeted.
- Telecommunications sector is affected by Salt Typhoon cyber espionage.
- Financial industry comprises 18% of engagements, tying with public administration as most targeted sector.
Fixes and mitigations
- Transition from push- and SMS-based MFA to phishing-resistant methods such as FIDO2/WebAuthn and hardware security keys.
- Implement a SIEM or centralized logging platform with minimum 90 days log retention, forwarding logs off-device.
- Block legacy authentication through Conditional Access and enforce number matching or verified push where phishing-resistant methods are not yet feasible.
Summarised by SecOraLens from Cisco Talos. Always read the original source before acting. How SecOraLens verifies advisories.