Cisco Talos: Help-Desk Vishing Fuels Ransomware Intrusions

Cisco Talos’ Q3 2026 incident-response observations show attackers combining familiar weaknesses rather than relying on a single breakthrough technique. Phishing remained the most frequently observed initial-access method, while voice phishing that impersonated IT support helped adversaries persuade users to establish remote sessions. From there, attackers could use legitimate remote-management software, built-in scripting tools, and stolen or newly created access to move deeper into an environment.

The same engagements also show how ransomware operators are increasingly treating defensive controls as obstacles to remove. Talos reported attempts to uninstall or terminate endpoint detection and response (EDR) components, disable Windows protections, clear logs, and use vulnerable drivers to interfere with security software. These behaviors make identity assurance, centralized logging, and rapid verification of remote-support requests especially important for enterprises, managed service providers, and smaller organizations with limited response capacity.

What Cisco Talos observed

Phishing appeared in 37 percent of Talos Incident Response engagements in Q3, down from more than half of engagements in the previous quarter but still the leading initial-access technique. Exploitation of public-facing applications followed at 33 percent. Talos said attackers commonly targeted edge devices, including security gateways and remote network-management interfaces, because compromise of those systems can expose authentication paths, traffic, or internal network access.

Ransomware and pre-ransomware incidents accounted for 27 percent of engagements. That was higher than the maximum of 20 percent observed in each of the preceding four quarters, according to Talos. The incidents included established ransomware-as-a-service operations associated with The Gentlemen, Qilin, and Rhysida, as well as Interlock, which Talos described as a closed group. Talos also investigated an emerging variant called VYPR.

These figures describe Talos’ own incident-response caseload, not the prevalence of every attack across the internet. They should therefore be read as an operational view of the cases handled by the organization rather than as a universal measurement of threat activity.

How help-desk impersonation changes the attack chain

In the vishing activity described by Talos, the phone call is not necessarily the end goal. Its purpose is to persuade a user to perform an action that creates a technically legitimate access path. Attackers impersonating IT personnel may direct a victim to initiate a remote-support connection, including a session through Microsoft Quick Assist. Once the user authorizes the connection, the adversary can operate through an approved workflow instead of having to exploit the endpoint immediately.

Talos observed this pattern in several Q3 engagements. In the VYPR incident, the actor gained initial access through vishing and convinced a user to start a Microsoft Quick Assist session. The precise social-engineering script was not confirmed in that case, so it would be inappropriate to assume that every incident used the same help-desk pretext. Talos nevertheless noted that IT help-desk impersonation was a recurring feature of other engagements.

After remote access was established in the VYPR case, the actor used existing remote-monitoring and management software. That software executed PowerShell commands, which downloaded and installed an MSI package from a remote IP address. The actor then used tools including MeshAgent, Rclone, PsExec, an IP-scanning utility, and Microsoft Terminal Services Client. Talos reported that data exfiltration continued over multiple days before encryption, an unusually extended period for the ransomware investigations described in the report.

The sequence matters defensively. A user-approved remote session, execution of PowerShell by an RMM product, installation of an MSI, network discovery, and extended outbound data transfer may each appear explainable in isolation. In combination, and especially when they occur outside a normal support ticket or maintenance window, they form a stronger indication of a developing intrusion.

Ransomware operators target visibility as well as data

Talos reported multiple examples of attackers trying to disable EDR rather than merely evade it. In incidents involving Interlock, responders observed attempts to uninstall Cisco Secure Endpoint and efforts to terminate security services and integrity-checking processes with tools such as PsExec.exe and taskkill.exe. The operators also disabled Windows Defender real-time protection and cleared event logs. Talos connected this behavior with earlier Interlock activity involving a malicious Windows Defender Application Control policy.

In the VYPR investigation, the actor used Bring Your Own Vulnerable Driver techniques. This approach abuses trusted but flawed drivers to obtain kernel-level access and interfere with security controls. Talos noted that the actor deployed an unusually large number of vulnerable drivers, possibly to provide redundancy. The explanation is a researcher assessment, not a confirmed statement of the actor’s intent.

Talos assessed VYPR as relatively new and operationally immature. The assessment was based on several observations: there was no established data-leak site referenced in the ransom note, related leak-site infrastructure appeared only after the engagement, and the code appeared to derive from older Conti-related source material with limited changes. The actor also spent an unusually long time testing exfiltration settings and deploying different drivers. These details indicate experimentation, but they do not establish the group’s identity or predict how its operations will evolve.

A parallel risk: public-facing systems and stealthy persistence

Phishing was not the only major route into affected environments. Talos also described prolonged intrusions against telecommunications organizations in which it attributed most activity, with high confidence, to China state-sponsored actors, including Salt Typhoon. The reported access paths included valid credentials and exploitation of CVE-2023-20198 in publicly accessible web-based management interfaces.

In one campaign, Talos observed BadCandy, a web-shell implant associated by the organization with Salt Typhoon, being used to maintain persistent access. The attackers also used legitimate network features such as VPN access, traffic mirroring, and management protocols. According to Talos, they created privileged accounts, disabled logging, and changed configurations while blending their activity with ordinary administration.

Talos identified several weaknesses in these environments: password-only authentication, no evidence of MFA, legacy or weak management protocols, and inadequate credential management. The report does not establish that every telecommunications organization has these weaknesses, nor does it identify all victims. It does show why internet-facing management interfaces and privileged identities require controls that do not depend solely on passwords or local logs.

AI credentials add another layer of exposure

Talos’ investigations also included two AI-related security scenarios. In one, an employee hired using false credentials installed development tools including GitHub Copilot CLI and Anthropic Claude Code. The investigation found no evidence of malicious activity or data theft, but the individual’s developer access could have enabled actions involving repositories, plugins, and databases.

In a separate case, a macOS endpoint was compromised through a trojanized application. The attack chain included scripted collection of credentials from the macOS keychain associated with Anthropic Claude Code. Talos presented this as evidence that secrets connected to AI assistants and development platforms may be valuable targets alongside conventional passwords and tokens. The supplied research does not identify the trojanized application or provide indicators for the macOS incident.

Detection priorities for defenders

Organizations should treat remote-support activity as an identity and endpoint-security event, not simply as a help-desk transaction. Useful monitoring opportunities include unexpected Quick Assist or RMM sessions, remote-management tools appearing on systems that do not normally require them, PowerShell launched by those tools, and MSI installation shortly after a support call. Correlating those events with new accounts, privilege changes, network scans, PsExec activity, or unusual outbound transfers can help identify the attack chain before encryption.

Security teams should alert on attempts to uninstall or stop EDR components, changes to Windows Defender settings, suspicious WDAC policy modifications, vulnerable-driver installation, and event-log clearing. These signals should receive high priority because they indicate an attempt to reduce the organization’s ability to observe or contain the intrusion. Monitoring should occur from systems or services that attackers cannot easily alter.

For public-facing applications and edge devices, defenders should maintain an accurate inventory, prioritize vendor security updates, restrict administrative interfaces wherever possible, and review accounts and configuration changes. CVE-2023-20198 is explicitly cited by Talos in the telecommunications intrusions; organizations should determine whether their relevant products and versions are affected through authoritative vendor guidance rather than assuming exposure from the CVE alone.

What organizations should do now

• Verify support requests out of band. Require staff to confirm unexpected calls through a known internal help-desk number or ticketing system. Do not approve remote access solely because a caller knows an employee’s name, department, or technical details.
• Control remote-management software. Maintain an approved-tool inventory, restrict installation and execution to authorized administrators, record session metadata, and review sessions that occur outside normal support workflows.
• Adopt phishing-resistant MFA. Talos recommends moving from push- or SMS-based methods to FIDO2/WebAuthn or hardware security keys where feasible. Block legacy authentication, protect privileged accounts, and require verification for MFA enrollment or reset.
• Centralize and protect logs. Talos recommends at least 90 days of retention and forwarding logs from endpoints, servers, network infrastructure, cloud identity providers, and security appliances to an off-device platform. Enable process-creation, command-line, and cloud-API auditing.
• Harden secrets and privileged access. Use unique passwords, password managers, encrypted secret storage, limited access, regular privilege reviews, and prompt revocation when credentials may be exposed. Apply the same discipline to API keys, tokens, certificates, and AI-platform credentials.
• Prepare for EDR impairment. Ensure response teams can isolate systems and preserve evidence if local security tooling is disabled. Review controls that can detect driver installation, security-policy changes, log tampering, and unusual administrative activity from outside the affected host.
• Test the response process. Tabletop exercises should cover a fraudulent help-desk call, an unauthorized remote session, suspected credential compromise, EDR disruption, data theft, and ransomware containment.

Conclusion

Cisco Talos’ Q3 findings describe an intrusion environment where social engineering, exposed management systems, valid access, and defensive-control impairment reinforce one another. Help-desk impersonation is particularly effective because it can turn a user into the facilitator of a legitimate remote session. Organizations can reduce the opportunity by verifying support interactions, enforcing strong authentication, controlling remote tools, protecting logs, and treating attempts to disable security software as urgent incidents.

Sources

Cisco Talos: IR trends Q3 2026