Q3 2026 Incident Response: Vishing, Edge Vulnerabilities and Ransomware

The clearest shift in Cisco Talos incident response work in Q3 2026 was the rising weight of ransomware, alongside attackers’ continued success with familiar entry points. Ransomware and pre-ransomware cases reached 27 percent of engagements, up from a high of 20 percent across the previous four quarters. Phishing remained the most common initial access route, but its share fell to 37 percent from more than half in the prior quarter. Exploitation of public-facing applications followed at 33 percent.

Those figures point to a practical challenge for defenders: attackers are combining user manipulation with weaknesses in exposed systems, then trying to neutralize endpoint controls before deploying payloads or stealing data. Talos observed phone-based social engineering used to persuade employees to start remote support sessions, while ransomware operators also worked to disable endpoint detection and response (EDR). In parallel, long-running intrusions into telecommunications networks continued to exploit valid credentials and vulnerable web management interfaces.

The report covers Talos incident response engagements, so its percentages describe that caseload rather than the prevalence of attacks across all organizations. Still, the patterns are useful for teams assessing where their controls may fail: access to edge devices, authentication around remote support, endpoint protection, log retention, and the handling of credentials and AI development tools.

Initial access: user trust and exposed interfaces

Phishing appeared in 37 percent of engagements and remained the leading initial access method. Its declining share does not mean the tactic has lost relevance. Talos saw both conventional links and attachments and voice phishing, often paired with impersonation of an IT help desk. The caller’s goal is to get a user to authorize a remote connection through legitimate software, including remote monitoring and management (RMM) tools.

That method complicates response because the first step may look like ordinary support activity. A user initiates a session, and an attacker can then operate through software that may already be allowed in the environment. In one ransomware case, the victim was persuaded to start a Microsoft Quick Assist session. Talos did not confirm the precise script used in that incident, but reports that help desk impersonation appeared in several Q3 engagements.

Public-facing application exploitation accounted for 33 percent of cases. Attackers mainly targeted edge devices, including security gateways and remote network management interfaces. These systems sit at sensitive junctions: they can handle authentication, route traffic, and expose access into internal networks. A successful compromise may therefore offer more than control of a single server. It can create a path to credentials, network visibility, or wider access.

Talos’ incident data also shows how these routes can overlap. In prolonged intrusions targeting telecommunications organizations, attackers used valid credentials and exploited CVE-2023-20198 in publicly accessible web management interfaces. Talos attributed most of the intrusions with high confidence to China state-sponsored actors, including Salt Typhoon. In one campaign, the attackers deployed BadCandy, a malicious web shell associated with Salt Typhoon, to preserve remote access.

The attackers also used legitimate network features to hide their activity in normal administration. VPN access, traffic mirroring, and management protocols supported backdoor access, reconnaissance, and data theft. After exploiting a management interface, they created privileged accounts, disabled logging, and changed configurations to retain access. That combination makes edge device security and auditability central concerns: a vulnerable interface can give an intruder the foothold, while weak monitoring allows the intrusion to persist.

The affected environments showed recurring control gaps. Talos found password-only access with no evidence of multi-factor authentication (MFA), legacy or weak management protocols such as plaintext SNMP, outdated VPN encryption, and poor credential management. Attackers could create privileged accounts, alter settings, and suppress logs without meeting effective barriers. These findings echo the broader quarter’s most common weaknesses: inadequate logging, mishandled credentials and secrets, and missing or poorly enforced authentication controls.

Ransomware operators are targeting the defenses themselves

Ransomware and pre-ransomware cases climbed to 27 percent of engagements. Talos responded to activity involving established ransomware-as-a-service variants The Gentlemen, Qilin, and Rhysida, as well as Interlock, which operates as a closed group. Across incidents, operators frequently tried to disable EDR, including through vulnerable drivers and Windows Defender Application Control (WDAC).

Interlock activity illustrates the direct approach. Operators made repeated attempts to uninstall Cisco Secure Endpoint from compromised machines. They also used PsExec.exe and taskkill.exe to stop security services and integrity checkers, including cscm.exe and sfc.exe. Windows Defender real-time protection was disabled, and event logs were cleared to reduce visibility and complicate investigation. Talos links this pattern to earlier Interlock activity involving a malicious WDAC policy used to terminate EDR products.

In another case, VYPR operators used a Bring Your Own Vulnerable Driver (BYOVD) technique. This approach abuses a trusted driver with a known flaw to reach kernel-level functions, where it may interfere with security tools that are harder to disable through ordinary user processes. The VYPR actor deployed an unusually large number of vulnerable drivers, perhaps as a way to improve the odds that one would work. The incident reinforces a key operational risk: endpoint protection can be a deliberate target in the attack sequence, not merely a barrier the attacker hopes to evade.

VYPR looks experimental

Talos assesses VYPR as relatively new and operationally immature. The ransom note did not mention an established data leak site, and related site infrastructure appeared only after the incident. The code also seemed to draw on older leaked Conti-derived source with limited changes. These clues suggest a group still assembling its methods rather than following a mature affiliate playbook.

The pace of the operation supported that assessment. The actor spent an unusually long time exfiltrating and encrypting data, tried different parameters for data theft, and deployed multiple vulnerable drivers. That experimentation may make individual cases less predictable, but it also offers defenders opportunities to detect activity before encryption finishes. Extended staging and repeated tool deployment can create a longer window for monitoring and response.

After gaining remote access through the Quick Assist session, the actor used existing RMM software to run PowerShell commands. Those commands downloaded and installed a Microsoft Software Installer package from a remote IP address. The toolset included MeshAgent, Rclone, PsExec, IP scan, and Microsoft Terminal Services Client. Data exfiltration continued over several days, an uncommon pattern in the ransomware investigations described by Talos. For defenders, the sequence is a reminder to scrutinize unexpected support sessions, new package installs, command execution through RMM, and prolonged outbound transfers together.

AI tools introduce new credential paths

Two investigations showed AI appearing in different roles: as a tool used by a person with privileged access and as the focus of credential theft. In the first case, an internal actor hired with false credentials installed AI development tools, including GitHub Copilot CLI and Anthropic Claude Code. The investigation found no evidence of malicious activity or data theft. However, the actor’s developer permissions included cloning repositories, configuring plugins, and connecting to databases, creating potential routes to automate harmful actions with those tools.

A separate incident involved a compromised macOS endpoint infected through a trojanized application. A script on the device searched the macOS keychain for credentials associated specifically with Anthropic Claude Code. The targeting matters because AI platform secrets may connect to sensitive data or automation capabilities beyond a user’s ordinary account. AI development tools therefore add another category of credential that organizations need to inventory, protect, and monitor.

These cases do not establish that AI tools themselves caused a breach. They show instead that access controls around developer environments and AI services can shape the damage an insider or intruder might cause. Strong MFA and sound secret management apply to these platforms just as they do to cloud accounts, repositories, and databases. Teams should also consider which users can install extensions, configure tools, and grant them access to code or data.

Sector mix shifted in Q3

Financial organizations made up 18 percent of Talos engagements, tying with public administration as the most targeted sector. Finance had not appeared among Talos’ three most impacted sectors since 2024, despite its value as a target. Talos suggests that comparatively greater investment in cybersecurity may be one reason for its lower prior ranking; the report presents this as a possible explanation, not a demonstrated cause.

Public administration has remained among the most targeted sectors over the past year. Health care, which led the previous two quarters, fell to third place in Q3. The shift describes the distribution of this response caseload, not an indication that any sector has become safe. Organizations should use their own exposure, architecture, and incident history to set priorities.

Three control gaps deserve attention

Insufficient logging was the most common weakness, appearing in more than 40 percent of engagements. Some gaps reflected attackers deleting logs; others stemmed from short retention periods or incomplete customer configurations. Logs kept only on the affected machine may disappear during an intrusion or system rebuild. Talos recommends centralizing records in a security information and event management platform or comparable service, retaining at least 90 days, and forwarding data off-device.

Useful sources include servers, workstations, network infrastructure, cloud identity providers, and security appliances. Teams should enable auditing for process creation, command lines, and cloud API activity, including Microsoft Graph. These records can help reconstruct how an attacker entered, which tools ran, and whether accounts or configurations changed. Talos’ Log Architecture Assessment service is described as a way to identify visibility gaps and map improvements.

Authentication and MFA weaknesses appeared in 33 percent of engagements. Single-factor access was the most frequent problem, and some environments left legacy authentication enabled, allowing access without MFA. Others failed to require MFA for high-privilege accounts. Talos recommends moving from push- or SMS-based MFA toward phishing-resistant options such as FIDO2/WebAuthn and hardware security keys.

Where stronger methods are not yet practical, organizations can require number matching or verified push prompts. They can also restrict self-service MFA enrollment with help desk verification, block legacy authentication through Conditional Access, and make access depend on device compliance and trusted infrastructure rather than location alone. These controls address different failure modes: preventing an attacker from enrolling a new factor, reducing the value of stolen passwords, and limiting access from unmanaged devices.

Improper credential and secret management also affected 33 percent of engagements. Talos observed passwords saved in browser stores, autofill enabled for stored credentials, and reused or shared passwords. A formal process should cover passwords, API keys, tokens, certificates, and other secrets. Unique passwords and password managers reduce reuse and sharing; encrypted storage and access limited to people who need a secret reduce exposure.

When a credential is no longer needed or may have been exposed, teams should revoke and replace it promptly. Regular access reviews for privileged secrets, paired with logging, can surface unexpected use. Staff training and clear reporting paths help organizations respond quickly when someone shares a secret or stores it in an unsafe place. The practical thread across all three weaknesses is visibility and control: know what access exists, preserve evidence of its use, and make it possible to cut off compromised credentials.

What the technique data adds

The quarter’s MITRE ATT&CK mapping captures a broad range of observed behaviors, though Talos says the list is not exhaustive. The main pattern is continuity: phishing and the abuse of valid accounts remain effective, while known flaws in internet-facing applications continue to provide entry. Attackers also used remote services such as VPN and RDP, scripting through PowerShell and other interpreters, and legitimate remote access software.

For persistence, Talos highlights web shells and scheduled tasks. The telecommunications incidents show how a web shell can provide remote control through a management interface, while scheduled tasks and newly created local accounts can help an intruder return after initial access. Privileged account changes, system service modifications, and altered cloud roles also featured in the technique map.

Other observed behaviors span defense evasion, discovery, and data movement. Attackers masqueraded as legitimate components, disabled or changed security tools, cleared logs, obfuscated files, and used system binaries or process injection. They searched for hosts, accounts, network services, configuration details, and installed security products. For movement and command control, the map includes SMB shares, SSH, Windows Management Instrumentation, remote access tools, web and DNS traffic, proxies, and protocol tunneling.

Data collection and theft included gathering local files and shared-drive material, archiving collected data, and sending it through cloud storage, command channels, or alternative protocols. Credential techniques included password spraying, changes to authentication processes, theft or forgery of certificates and Kerberos tickets, and interception of communications. The mapped impact behaviors included file encryption and attempts to inhibit recovery by removing backups or shadow copies.

The appendix also names tools and malware observed in the quarter: GoGRPC RAT, Node RAT, BadCandy, Overlord RAT, SideSlipRAT, and Impacket’s SMBexec. The examples span remote control, command execution, file transfer, persistence, and data collection. Their presence in the mapping does not mean every incident used them; the appendix groups techniques and tools seen across engagements.

For operational planning, the technique list is most useful when paired with the report’s incident narratives. Attackers can combine familiar methods—stolen credentials, remote administration, scheduled tasks, and log removal—in ways that blend into routine system activity. Controls need to account for the sequence: an exposed interface or persuaded employee can establish access, legitimate utilities can extend it, and disabled logging or endpoint protection can delay detection. Q3’s figures make the case for reviewing those transitions, particularly at internet-facing management systems and around remote support workflows.

Briefing and practical takeaway

Talos said its incident responders would host an unrecorded, 30-minute briefing on November 12 covering high-impact customer incidents from Q3. Registration is required. Details are available at the event page.

The quarter’s most useful signal is the convergence of people, edge systems, and security tooling. Phishing still led initial access even as its share fell; exposed applications remained close behind; ransomware grew; and operators repeatedly attacked the controls meant to detect them. Teams reviewing their posture should start with durable logs, phishing-resistant MFA for privileged access, careful management of credentials and AI secrets, and clear verification steps for remote support requests. Those measures address the recurring weaknesses Talos observed while giving responders better evidence and more time when an intrusion begins.