Cisco Talos details Q3 2026 IT help desk vishing campaign linked to ransomware

Intruders pretending to be IT help desk staff called, e-mailed and messaged employees on Microsoft Teams across Q3 2026 Cisco Talos Incident Response engagements. They used employees’ names and e-mail addresses to seem legitimate and convinced staff to open remote access sessions.

The attackers drew on knowledge of IT support basics and Microsoft Quick Assist rather than deep profiling beyond names and contacts, said Cisco Talos researcher Aliza Johnson. Victims varied across and within organizations, showing the actors sought any accessible user for entry rather than privileged staff. Some attacks seemed opportunistic, including a victim who called a fake IT number from a pop-up and then granted access. In another case, the actor sent two phishing waves likely expecting at least one compromise.

In at least one incident, the remote access led to ransomware being deployed. In a VYPR case, a call led a user to start Microsoft Quick Assist, though Talos could not confirm what was said during the call. Talos assesses VYPR as new and immature, based on leaked Conti-derived code with minor changes and no leak site until later.

During the VYPR attack, the actor used MeshAgent, Rclone, PsExec, IP scan, and Microsoft Terminal Services Client. VYPR activity looked like testing rather than a set playbook, with slow data removal and encryption. The VYPR actor deployed many vulnerable drivers possibly to create backups and improve success odds.

Network remote management software ran PowerShell commands that downloaded and installed a Microsoft Software Installer package from a remote IP address. To disable security tools, the actors loaded flawed trusted drivers for kernel access and dropped many, possibly as backups. Data theft took place over many days, which Talos says is uncommon in ransomware cases.

Phishing led initial access in 37 percent of Q3 2026 engagements, down from over 50 percent last quarter. Ransomware and pre-ransomware attacks reached 27 percent of Q3 2026 engagements, up from a prior-quarter maximum of 20 percent. Talos handled ransomware-as-a-service attacks involving The Gentlemen, Qilin, Rhysida, and the closed group Interlock.

Exploitation of public-facing applications caused 33 percent of Q3 2026 engagements. Issues with credential and secret management appeared in another 33 percent of engagements, and weak authentication or multifactor authentication figured in a third 33 percent. Poor logging appeared in over 40 percent of engagements, partly from attacker deletions and partly from poor customer retention or configuration.

Finance targeting rose to 18 percent of engagements, tying with public administration as the top targeted sector. Talos has not ranked finance among the top three sectors since 2024. Health care fell to third place after leading targeting for the previous two quarters.

The attackers primarily focused on edge devices, including security gateways and remote management interfaces. Interlock actors tried to remove Cisco Secure Endpoint and used PsExec.exe and taskkill.exe to halt security services and checkers. Interlock disabled Windows Defender real-time protection and cleared logs, and used a malicious WDAC policy to stop EDR (endpoint detection and response) tools.

Salt Typhoon-affiliated actors tied to China state-sponsored threat actors hit telecoms using CVE-2023-20198 in public management interfaces. One telecom campaign used BadCandy, a web shell implant associated with Salt Typhoon. Intruders used VPN access, traffic mirroring, and management protocols to build backdoors, steal data, and scout networks. Through a management interface flaw, attackers made privileged accounts, disabled logging, and changed settings to remain inside, with weaknesses including password-only logins without multifactor authentication (MFA), plaintext SNMP, old VPN encryption, and poor credential handling.

On a Mac infected through a trojanized app, attackers scripted a keychain search for credentials tied to Anthropic’s Claude Code assistant. An attacker-controlled account used -w to print a Claude Code credential secret, though no evidence indicates the actor used it, said Aliza Johnson. An insider hired under false credentials installed GitHub Copilot CLI and Claude Code, and investigators found no evidence of malicious activity.

Talos IR recommends phishing-resistant multifactor authentication like FIDO2/WebAuthn and hardware keys instead of push and SMS. The team also recommends help desk verification before workers enroll new MFA methods. Talos IR says keep centralized logs for at least 90 days and send them off devices to survive tampering and rebuilds.

Talos IR advises blocking legacy authentication through Conditional Access and using verified push when phishing-resistant MFA is unavailable. The team urges conditioning access on device compliance and trusted infrastructure rather than location alone. Talos IR will hold an unrecorded 30-minute webinar on November 12 to review major Q3 incidents and requires registration.