Cisco Talos reports ransomware share rose in Q3 incident response engagements

Cisco Talos Incident Response handled ransomware and pre-ransomware incidents in 27 percent of Q3 2026 engagements, up from a maximum of 20 percent in each of the prior four quarters. That figure compares with a ceiling of 20 percent in each of the four preceding quarters. Cisco Talos published the incident response trends report on October 29, 2026.

Phishing remained the leading initial access technique in Q3 2026 Talos IR engagements, appearing in 37 percent of cases after exceeding 50 percent in the prior quarter. Public-facing application exploitation came in second among initial access vectors in Q3 2026, making up 33 percent of Talos IR engagements.

The financial industry and public administration tied as the most targeted sectors in Q3 2026, each representing 18 percent of Talos IR engagements. Health care dropped to third place after holding the top spot for the two previous quarters.

Threat actors used voice phishing together with IT help-desk impersonation to persuade victims into permitting remote access through legitimate remote monitoring and management tools (software for remotely accessing and managing computers). In one case, voice phishing convinced a user to launch Microsoft Quick Assist for remote endpoint access, giving the VYPR actor initial access. Talos IR recommends requiring helpdesk verification for self-service multifactor authentication enrollment.

Cisco Talos assessed the emerging VYPR ransomware variant as new and operationally immature, noting reliance on older leaked Conti-derived source code. VYPR exfiltration occurred over multiple days, which Cisco Talos said is not commonly observed in ransomware investigations.

The actor leveraged MeshAgent, Rclone, PsExec, IP scan, and Microsoft Terminal Services Client during the attack. The actor used existing remote monitoring and management software to execute PowerShell commands that downloaded and installed an MSI package from a remote IP address.

Vulnerable drivers were possibly deployed by the VYPR actor, perhaps to build in redundancy and improve the odds of turning off endpoint defenses. Using Windows Defender Application Control and exploiting vulnerable drivers, ransomware actors disabled endpoint detection and response systems (tools that monitor and block threats on devices).

Talos IR observed ransomware-as-a-service variants The Gentlemen, Qilin, and Rhysida, along with Interlock, a closed ransomware cartel, in Q3 2026 engagements. Interlock actors tried to uninstall Cisco Secure Endpoint and used PsExec.exe and taskkill.exe to stop security services including cscm.exe and sfc.exe.

Talos IR found that insufficient logging created visibility gaps across more than 40 percent of Q3 2026 engagements. The logging shortfall ranked as the leading security weakness observed during the quarter. Missing or insufficient authentication and multifactor authentication controls appeared in 33 percent of engagements.

Improper credential and secret management appeared in 33 percent of engagements. Talos IR found no evidence of multifactor authentication in affected environments, and a key weakness was reliance on password-only authentication. SNMP in plaintext and outdated VPN encryption were among the legacy and weak management protocols observed.

Adversaries targeted edge devices such as remote network management interfaces and security gateways through exploitation of public-facing applications, according to Talos IR. Adversaries who compromise edge devices may gain wide-ranging access to user credentials or internal networks.

Salt Typhoon-affiliated actors exploited vulnerabilities in public-facing applications to conduct cyber espionage against telecommunications companies. Cisco Talos credited Salt Typhoon and other China state-sponsored threat actors, with high confidence, for most telecommunications intrusions.

Attackers in telecommunications intrusions created privileged accounts, disabled logging, and altered configurations to maintain persistence. Attackers also exploited CVE-2023-20198 in publicly accessible web-based management interfaces and deployed the BadCandy web shell to maintain stealthy remote access. Living-off-the-land tactics let adversaries blend in by making their actions look like routine administrative work.

Talos IR observed an internal threat actor hired under false credentials who installed AI-powered development tools including GitHub Copilot CLI and Anthropic Claude Code. A script on a macOS endpoint infected through a trojanized application scraped macOS keychain credentials for the Anthropic Claude Code AI assistant.

FIDO2/WebAuthn and hardware security keys are phishing-resistant options that Talos IR recommends in place of push and SMS-based multifactor authentication. If phishing-resistant multifactor authentication cannot be used yet, Talos IR recommends requiring number matching or verified push. Instead of relying on geographic location alone, Talos IR says to base access decisions on trusted infrastructure and device compliance.

Talos IR recommends blocking legacy authentication through Conditional Access. Talos IR recommends centralized logging with at least 90 days of retention and off-device forwarding from servers, workstations, network devices, cloud identity providers, and security appliances.

Detecting unusual activity gets easier with frequent reviews of privileged-credential access paired with thorough logging. Talos IR recommends enabling process-creation, command-line, and cloud API auditing such as Microsoft Graph. Talos IR recommends off-device storage for logs from cloud identity providers and for security-appliance logs, so they remain intact despite log tampering or a host rebuild.

Talos IR’s Log Architecture Assessment service can identify logging gaps and provide a roadmap to complete environment visibility. On November 12, Talos incident responders will host an exclusive unrecorded 30-minute webinar reviewing high-impact Q3 incidents; registration is required.

Effective secret management includes requiring unique passwords for every account and using password managers. Credentials no longer needed or suspected compromised should be promptly revoked and replaced. Staff training on safe credential handling and clear reporting procedures ensures staff address accidental disclosures quickly.