IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

As cited

Copy frozen at 2026-10-29 17:00 UTC (site build).

threat intel

IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

Cisco Talos Incident Response analyzed Q3 2026 incident trends and found phishing remained the leading initial access vector at 37 percent, while exploitation of public-facing applications accounted for 33 percent. Ransomware activity increased to 27 percent of engagements, with attackers using voice phishing and IT help desk impersonation alongside remote monitoring and management (RMM) tools. China-linked Salt Typhoon actors exploited CVE-2023-20198, a known vulnerability in web-based management interfaces with a CVSS score of 10.0, to target telecommunications providers and deploy the BadCandy web shell for persistent access.

Why it matters: Security teams must update public-facing applications immediately to patch CVE-2023-20198 and enforce multifactor authentication (MFA) on management interfaces; financial and public administration sectors face heightened ransomware risk as operators disable endpoint detection and response (EDR) systems and test emerging variants like VYPR; organizations should centralize logging with 90-day retention and transition to phishing-resistant MFA methods like FIDO2 to counter vishing attacks and the credential management weaknesses exploited in over 40 percent of engagements.

Source published

2026-10-29 14:00 UTC

First seen by Cybersecurity Tracker

2026-10-29 16:09 UTC