Fake IT Help Desk Calls and Rising Ransomware: What Cisco Talos Saw in Q3 2026

Cisco Talos Incident Response says phishing was still the most common way attackers got in during Q3 2026, appearing in slightly over one-third of engagements, down from over 50 percent the previous quarter. Alongside traditional phishing links and attachments, Talos saw attackers phone victims while pretending to be the IT help desk. The aim was to talk staff into allowing remote access through a legitimate remote monitoring and management (RMM) tool. Exploiting public-facing applications was the next most common route, also accounting for one-third of engagements, with attackers mostly targeting edge devices such as security gateways and remote network management interfaces.

Ransomware and pre-ransomware incidents made up 27 percent of engagements, up from a maximum of 20 percent in the previous four quarters. Talos responded to attacks involving The Gentlemen, Qilin, Rhysida and the closed group Interlock. Attackers mostly chose to disable endpoint detection and response (EDR) tools, often by exploiting vulnerable drivers or using Windows Defender Application Control. Talos also observed a new variant, VYPR, whose operators tested a range of tactics rather than following a standard playbook.

Talos also continues to see long-running espionage intrusions against the telecommunications sector, mostly attributed with high confidence to China state-sponsored actors including Salt Typhoon. These attackers commonly used valid credentials and a known vulnerability (CVE-2023-20198) in publicly accessible web management interfaces.