IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

Phishing remained the leading initial access technique in Q3 2026, appearing in slightly over one-third of all Cisco Talos Incident Response engagements, down from over 50 percent last quarter. Threat actors increasingly combined voice phishing (vishing) with IT desk impersonation to convince victims to grant remote access through legitimate remote monitoring and management (RMM) tools. Exploitation of public-facing applications accounted for one-third of engagements, with edge devices such as security gateways and remote network management interfaces being frequent targets. Ransomware and pre-ransomware incidents rose to 27 percent of engagements, up from a maximum of 20 percent in the prior four quarters, featuring variants like The Gentlemen, Qilin, Rhysida, Interlock and the emerging VYPR. Actors also disabled endpoint detection and response (EDR) systems, often by exploiting vulnerable drivers or using Windows Defender Application Control (WDAC). ¹