Cisco Talos IR Says Ransomware Made Up 27% of Its Q3 Engagements as Fake IT Help Desk Callers Opened Remote Sessions, Operators Disabled EDR and Logging Gaps Hampered More Than 40% of Cases

LONDON - Ransomware and pre-ransomware cases made up 27 percent of Cisco Talos Incident Response engagements in the third quarter of 2026, a larger share than in any of the previous four quarters, and the operators behind them increasingly went after endpoint detection and response tools directly instead of trying to slip past them, Talos said Thursday in its quarterly incident response trends report.

The report, written by Aliza Johnson, also found that callers posing as corporate IT help desks repeatedly talked employees into opening remote sessions, and that the single most common weakness across all engagements was not a missing patch but missing evidence: insufficient logging created visibility gaps in more than 40 percent of cases.

Phishing, by phone as well as email

Phishing remained the leading initial access technique, appearing in 37 percent of engagements, down from more than 50 percent the previous quarter. Talos said that besides links and attachments, it saw numerous actors run voice phishing alongside IT help desk impersonation to persuade victims to grant remote access through a legitimate remote monitoring and management tool.

Exploitation of public-facing applications accounted for 33 percent of engagements. Talos said attackers predominantly targeted edge devices such as security gateways and remote network management interfaces. In prolonged espionage intrusions against telecommunications providers, which Talos attributed with high confidence to China state-sponsored actors including Salt Typhoon, the attackers used valid credentials and a known flaw, CVE-2023-20198, in web-based management interfaces. In one campaign they deployed BadCandy, a web shell implant, then created privileged accounts, disabled logging and altered configurations to blend in with routine administration.

A new strain called VYPR

Talos described a ransomware variant called VYPR that it assesses is new and operationally immature. The ransom note referenced no data leak site, and the group's leak infrastructure was not created until after the engagement. Talos said the operators relied on older leaked Conti-derived source code with minimal changes.

The intrusion started with a vishing call that led a user to open a Microsoft Quick Assist session. From there the actor used existing RMM software to run PowerShell that downloaded and installed an MSI package from a remote IP address, and worked with tools that Talos said are common in ransomware cases: MeshAgent, Rclone, PsExec, an IP scanner and the Microsoft Terminal Services Client. Exfiltration ran over multiple days, which Talos called unusual for a ransomware investigation. To blind defenses, the actor used Bring Your Own Vulnerable Driver techniques and deployed an unusually large number of vulnerable drivers, possibly to build redundancy.

"Why evade detection when you can destroy it?"

That is the heading Talos put over its account of EDR tampering. Interlock operators made multiple attempts to uninstall Cisco Secure Endpoint, used PsExec.exe and taskkill.exe to terminate security services and integrity checkers including cscm.exe and sfc.exe, disabled Windows Defender real-time protection and cleared event logs. Talos tied that to earlier Interlock activity in which the group deployed a malicious Windows Defender Application Control policy to terminate EDR. Across the quarter, Talos said, threat actors predominantly chose to disable EDR, often by exploiting vulnerable drivers or using WDAC. Other ransomware families in its caseload included The Gentlemen, Qilin and Rhysida.

Talos also recorded two cases involving AI tools. In one, an insider hired under false credentials used privileged access to install GitHub Copilot CLI and Anthropic's Claude Code; Talos found no evidence of malicious activity or data theft. In the other, a macOS endpoint infected through a trojanized application was scripted to scrape credentials from the macOS keychain associated with Claude Code.

Who was hit

Finance and public administration tied as the most targeted sectors, each at 18 percent of engagements. Health care, the most targeted industry in each of the previous two quarters, fell to third.

What the SOC should take from it

The weaknesses Talos listed map directly onto detection work. Improper credential and secret management and absent or poorly implemented MFA each appeared in 33 percent of engagements. On logging, Talos recommended a SIEM or centralized platform with at least 90 days of retention, forwarding logs from servers, workstations, network gear, cloud identity providers and security appliances off the device so they survive tampering and rebuilds, and enabling process creation, command line and cloud API auditing such as Microsoft Graph. On identity, it recommended phishing-resistant methods such as FIDO2 and hardware keys, requiring help desk verification for self-service MFA enrollment, blocking legacy authentication through Conditional Access and enforcing number matching where stronger methods are not yet possible.

The report's own artifacts give hunters a starting list: Quick Assist sessions that follow inbound calls, RMM agents launching PowerShell that fetches MSI packages, Rclone and MeshAgent on hosts that should not run them, attempts to uninstall or stop EDR services, the loading of multiple known vulnerable drivers, unexpected WDAC policy changes, and event log clearing. Talos said its incident responders will review the quarter's most significant cases in a webinar on Nov. 12.