Ransomware and pre-ransomware incidents made up 27 percent of Cisco Talos Incident Response engagements in the third quarter of 2026, up from a maximum of 20 percent in each of the previous four quarters. The original report also flags a rise in phone-based social engineering, with attackers posing as IT help desks to talk employees into opening remote sessions.
Talos handled cases involving established ransomware-as-a-service operations such as The Gentlemen, Qilin and Rhysida, as well as Interlock, which runs as a closed group. A recurring theme was destroying security tools rather than hiding from them.
The phone call is the new phishing link
Phishing was still the leading way in, appearing in 37 percent of engagements, but that was down from over 50 percent last quarter. Alongside links and attachments, Talos saw numerous actors combine voice phishing (vishing) with IT help desk impersonation to get victims to grant access through a legitimate remote monitoring and management tool. Exploitation of public-facing applications came a close second at 33 percent, mostly aimed at edge devices such as security gateways and remote management interfaces. It is the same playbook behind recent Teams help desk intrusions.
A new crew that is still learning
Talos observed an emerging ransomware variant called VYPR that it assesses is new and operationally immature. The ransom note referenced no leak site, and its leak site infrastructure was only created after the engagement. VYPR appears to rely on older leaked Conti-derived source code with minimal changes. The actor got in by vishing a user into starting a Microsoft Quick Assist session, then used existing remote management software to pull down an installer, and leaned on MeshAgent, Rclone, PsExec and Remote Desktop. Exfiltration ran over multiple days, which Talos calls uncommon, and the actor dropped an unusually large number of vulnerable drivers to knock out endpoint protection, a technique known as bring your own vulnerable driver.
Interlock operators made repeated attempts to uninstall Cisco Secure Endpoint, killed security services and integrity checkers, disabled Windows Defender real-time protection and cleared event logs.
Telecom espionage and AI credentials
Talos continues to see long-running espionage intrusions against telecommunications providers, most of which it attributes with high confidence to China state-sponsored actors including Salt Typhoon. The attackers used valid credentials and exploited CVE-2023-20198 in exposed web management interfaces, created privileged accounts, disabled logging and in one campaign deployed the BadCandy web shell.
Two cases involved AI tooling. In one, an insider hired under false credentials used privileged access to install GitHub Copilot CLI and Anthropic Claude Code; Talos found no evidence of malicious activity or data theft, but notes the access could have enabled automated abuse. In another, a macOS machine infected through a trojanized application was scripted to scrape keychain credentials tied to Claude Code.
Finance rose to 18 percent of engagements, tying public administration as the most targeted sector, while health care fell to third after leading for two quarters.
Fix logging and MFA first
The top weakness was insufficient logging, seen in over 40 percent of engagements. Talos recommends centralized logging with at least 90 days of retention, forwarded off-device so attackers cannot wipe it. Missing or weak authentication and MFA appeared in 33 percent of engagements; Talos advises moving to phishing-resistant methods such as FIDO2 and hardware keys, requiring help desk verification for MFA enrollment and blocking legacy authentication. Train staff that the real help desk will not cold-call asking them to launch Quick Assist.
The quarter's numbers point the same way: attackers are spending less effort on clever malware and more on persuading a person, or a forgotten admin panel, to open the door.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.