The telecom attribution has changed

Cisco Talos’s Q3 incident-response report now describes most of the telecom espionage intrusions as high-confidence activity by sophisticated actors conducting targeted attacks. An earlier retained version explicitly named China state-sponsored actors, including Salt Typhoon. The current version removes that attribution from the paragraph; its publication metadata records a revision at 17:51 UTC on 4 November. Talos Q3 report

The wording change does not establish a different operator, nor does it retract every reference to Salt Typhoon. BadCandy remains described as an implant known to be used by that actor. TIR assessment — likely (B2): the operational findings should be retained with their source-specific scope, while the broader attribution removed from that paragraph should not be repeated as the report’s current conclusion. Talos does not explain the reason for the wording change in the retained report. The analysis below separates that attribution issue from the reported access routes, ransomware observations and caseload statistics.

The quarter’s operational findings

Cisco Talos Incident Response (Talos IR) published its Q3 2026 trends report on 29 October 2026. It covers Talos IR's own customer engagements in July to September 2026. Phishing remained the most common initial access technique at 37 percent of engagements, down from over half the previous quarter. Exploitation of public-facing applications, mostly against edge devices, was second at 33 percent. Ransomware and pre-ransomware incidents rose to 27 percent. Talos Q3 2026

Phishing remains the largest reported initial-access category, including voice phishing. The report does not quantify email-only phishing, so that aggregate cannot determine the priority of email controls over other channels. The distinctive addition is the telephone. Several engagements began with a vishing call, often with the caller posing as IT support, that ended with the victim opening a legitimate remote-access session. Talos does not count those engagements. The only case it describes in detail is VYPR, and in that case it did not confirm the pretext. TIR assessment — likely (B2): the new controls this report argues for are remote-support tool restriction and help-desk verification that does not trust the caller. Kernel-driver blocking is a lesson from the single VYPR case, not a quarter-wide finding.

What the numbers cover

Every percentage below is a share of Talos IR engagements. Talos does not publish the number of engagements, so a one-point change cannot be converted into cases. The figures describe one responder's customer mix, not the threat landscape.

The denominators also move. The Q4 2025, Q1 2026 and Q2 2026 reports give initial-access shares as a share of engagements "where initial access could be determined", although their summaries sometimes say "all engagements". The Q3 report, like those summaries, says "all Cisco Talos Incident Response (Talos IR) engagements", and nowhere gives the determinable-vector basis. Talos Q4 2025, Talos Q1 2026, Talos Q2 2026, Talos Q3 2026 The Q2 report adds that logging gaps in several engagements prevented Talos from determining the initial access vector at all. Talos Q2 2026 The trend table is therefore directional.

Measure (Talos IR engagements) Q4 2025 Q1 2026 Q2 2026 Q3 2026
Phishing, initial access 32% over a third (35%) over half 37%
Exploitation of public-facing applications nearly 40% 18% not quantified 33%
Ransomware and pre-ransomware about 13% 18%, no encryption observed over 20% 27%
Insufficient logging not compared here 18% 42% over 40%
Most targeted sector not compared here public administration and health care, 24% each health care 17% finance and public administration, 18% each

Sources: Talos Q4 2025, Talos Q1 2026, Talos Q2 2026, Talos Q3 2026. The Q1 phishing figure of 35 percent is the one the Q2 report gives for the previous quarter.

Two of Talos's own statements need reconciling. The Q3 summary describes 27 percent as up from "a maximum of 20 percent" across the previous four quarters, while its ransomware section says the previous quarter was "a little over 20 percent". The Q2 report itself gives "over 20 percent", so the ransomware section is the accurate one. Talos Q2 2026, Talos Q3 2026 Separately, the Q3 ATT&CK appendix refers to "the rise of phishing" in a quarter when phishing's share fell. Talos Q3 2026

The authentication rows are not comparable across quarters. Q2 measured "authentication abuse" (65 percent), while Q3 measured "absent or improperly implemented authentication and MFA" (33 percent). These are different categories, not a halving. Talos Q2 2026, Talos Q3 2026

Help-desk vishing into remote-support sessions

Talos says it saw numerous threat actors use vishing alongside IT-desk impersonation to persuade victims to allow remote access through a legitimate remote monitoring and management (RMM) tool. It reports help-desk impersonation in "several other Q3 engagements" besides VYPR. It does not count them, name the actors or give the sectors. Its ransomware section lists socially engineering victims into starting remote-management sessions among the frequently observed techniques. Talos Q3 2026

VYPR, the one detailed case. The actor tricked a user into starting a Microsoft Quick Assist session. Talos says the exact social-engineering technique was not confirmed in this case. The actor then used existing RMM software to run PowerShell that downloaded and installed a Microsoft Software Installer (MSI) package from a remote IP address. Talos Q3 2026 The TIR VYPR profile covers the rest of that engagement. Help-desk impersonation is a quarter-wide observation, not a VYPR finding.

The pattern is not new, and Talos is not its only witness. In 2024 Microsoft documented Storm-1811 using vishing and help-desk personas to get users to open Quick Assist, which led to RMM tools and Black Basta ransomware. Microsoft, May 2024 On 30 October 2026, Microsoft described two unattributed intrusions with the same opening: Teams calls posing as help-desk staff, Quick Assist, then a staged archive run with a portable Python, Bun or Java runtime from a KB-prefixed folder in the user profile. From there the attackers went for Active Directory Certificate Services (AD CS). Microsoft, 30 October 2026 These are Microsoft's cases, not Talos's, and nothing links them to VYPR.

A second variant ends at an identity-provider session instead of a desktop. On 28 October 2026 the Canadian Centre for Cyber Security warned of an ongoing help-desk vishing campaign against Canadian organisations, increasingly in finance and legal since July. The Cyber Centre judges its tradecraft and infrastructure consistent with publicly reported operations by a financially motivated actor, and cites the UNC6671 and BlackFile reporting that TIR has covered. That is the Cyber Centre's assessment, not a TIR attribution. Callers claim an urgent passkey migration, MFA enrolment or password change and steer staff to organisation-branded adversary-in-the-middle sign-in pages. These relay the credentials and MFA response to the real identity provider. Cyber Centre AL26-028 TIR assessment: Talos's rise in finance-sector engagements falls in the same period, but neither source links the two. Talos describes the remote-session variant, not the credential-relay one.

Edge devices and the telecommunications espionage cases

The 33 percent exploitation figure is quarter-wide. Talos says attackers "predominantly" targeted edge devices such as security gateways and remote network management interfaces. It does not break the figure down by product, vulnerability or actor. Talos Q3 2026

The telecommunications paragraph is specific. Talos continues to see prolonged espionage intrusions in telecommunications. In the current version, it attributes most of them with high confidence to sophisticated actors conducting targeted attacks. An earlier retained version named China state-sponsored actors, including Salt Typhoon; that attribution has been removed from the current paragraph, so it is not treated here as the report’s current conclusion. Entry routinely came through valid credentials and CVE-2023-20198 in publicly accessible web-based management interfaces. Once in, the actors created privileged accounts, disabled logging, altered configurations and used VPN access, traffic mirroring and management protocols for backdoors, collection and exfiltration. In one campaign they deployed BadCandy. The report's body calls BadCandy a web-shell implant; its appendix calls it a remote access trojan. Talos found password-only authentication with no evidence of MFA, plaintext SNMP, outdated VPN encryption and weak credential management. Talos Q3 2026 Talos gives no intrusion start dates or dwell times. BadCandy’s reported association with Salt Typhoon does not attribute every intrusion in this paragraph to that actor. The Salt Typhoon profile holds the alias, campaign and detection detail.

CVE-2023-20198 is three years old. Cisco's advisory, final since 1 November 2023, says devices are affected when the web UI is enabled with ip http server or ip http secure-server. Cisco lists no workaround, and it recommends disabling the HTTP server on internet-facing systems or restricting it to trusted sources. Cisco advisory In Q4 2025 Talos recorded BadCandy-consistent activity on IOS XE that created an unauthorised account automatically, with no interactive access. That report did not attribute it. Talos Q4 2025 The Q1 2026 report also lists CVE-2023-20198 among exploited vulnerable infrastructure. Talos Q1 2026 TIR assessment (moderate confidence), limited to the telecom espionage cases: entry came through a three-year-old IOS XE flaw and valid credentials against exposed management interfaces, not through new vulnerabilities. Talos gives no product or CVE breakdown for the rest of the 33 percent.

Ransomware: what each named group actually did

Talos's summary says ransomware actors "predominantly" disabled endpoint detection and response (EDR), often with vulnerable drivers or Windows Defender Application Control (WDAC). That is a statement about the quarter. Only two groups get case detail. Talos Q3 2026

Group What the Q3 report says about this group specifically TIR profile
The Gentlemen Named as an established RaaS variant Talos responded to; no case detail The Gentlemen
Qilin Named as an established RaaS variant; no case detail Qilin
Rhysida Named as an established RaaS variant; no case detail Rhysida
Interlock Described as a closed group. Repeated attempts to uninstall Cisco Secure Endpoint; PsExec and taskkill used against security services and integrity checkers (cscm.exe, sfc.exe); Defender real-time protection disabled; event logs cleared. The WDAC policy is from earlier Interlock activity, not this case. Interlock
VYPR Quick Assist session after a vishing call; RMM-launched PowerShell installing a remote MSI; MeshAgent, Rclone, PsExec, an IP scanner and MSTSC; exfiltration over multiple days while testing parameters; an unusually large number of vulnerable drivers (BYOVD) to disable EDR and antivirus; Conti-derived code; leak-site infrastructure created after the engagement VYPR

Source: Talos Q3 2026

So the report attests BYOVD for VYPR and WDAC abuse only for Interlock's earlier activity. It does not tie either technique, or the vishing entry, to The Gentlemen, Qilin or Rhysida in this quarter. Their profiles carry their own dated evidence.

The tooling overlaps with the previous quarter. In Q2, Talos saw Sinobi operators use a trojanised MeshAgent as their main command-and-control channel, and a Warlock deployment of Zoho Assist. Talos Q2 2026 MeshAgent shows up again in VYPR's tool list. That points to RMM agents as a lasting delivery and persistence layer. It does not connect the operators.

AI tools as a target

Talos describes two cases. In the first, an insider hired under false credentials installed GitHub Copilot CLI and Anthropic Claude Code. Talos found no malicious activity or data theft, and its concern is what that developer-level access could have automated. In the second, malware from a trojanised application scraped a macOS endpoint's keychain for credentials tied to Claude Code. Talos Q3 2026 The defensive point is narrow: treat AI-assistant tokens on developer machines as privileged secrets in rotation and monitoring. These two cases do not establish a broader trend.

What defenders should change

Each item comes from a specific Q3 finding. The detections are illustrative and untested; tune them to local baselines.

  1. Close the remote-support door the calls aim at. If another remote-support product is sanctioned, block or remove Quick Assist, which ships by default on Windows 11. Microsoft names Intune Remote Help as the authenticated alternative. Microsoft, May 2024 Limit RMM to approved products, operators and workflows. Limit Teams external access to the domains the business needs. Microsoft, 30 October 2026 Illustrative detection: in EDR process telemetry, alert when an RMM agent starts powershell.exe, which then starts msiexec.exe with a remote URL or bare IP address, within an hour of a QuickAssist.exe session or an external Teams call. That is the VYPR sequence. Also alert when a portable runtime runs from a new folder in the user profile, which is Microsoft's variant. Assumption: the RMM agent is a parent process that your EDR records. False positives: IT pushing software through RMM. The discriminator is a source address outside your software-distribution infrastructure.

  2. Make help-desk verification independent of the caller. Talos recommends requiring help-desk verification for self-service MFA enrolment. Talos Q3 2026 Where the attacker is impersonating the help desk, that verification has to run the other way too: staff should call back on a known internal number before joining a session or changing MFA, whatever the caller ID says. MFA resets, recovery and new-device enrolments need stronger checks. Cyber Centre AL26-028 Phishing-resistant MFA (FIDO2, device-bound passkeys) is designed to resist the credential-relay variant. It does not stop a user granting a screen-control session.

  3. Assume more than one vulnerable driver. VYPR loaded many drivers, possibly for redundancy, so a single blocked driver is not enough. Enable Microsoft's vulnerable driver blocklist, which is on by default since the Windows 11 2022 update and enforced with memory integrity (HVCI). Add the attack surface reduction rule that blocks writing exploited vulnerable signed drivers. Microsoft notes that the rule does not stop a driver already on disk from loading, and that the blocklist is not guaranteed complete. Test enforced policies in audit mode first. Microsoft driver blocklist Illustrative detection: driver-load telemetry outside a change: Sysmon event 6 (driver loaded), EDR driver-load events, and CodeIntegrity block events where the blocklist is enforced. Several new drivers on one host would match what Talos describes for VYPR. System event 7045 (service installed, kernel driver type) helps, but assumption: a driver loaded without the Service Control Manager, for example through a registry key and NtLoadDriver, produces no 7045, so do not rely on it alone.

  4. Watch for policy and agent tampering, not just its result. Interlock tried to uninstall the EDR agent and kill integrity checkers, and earlier used a WDAC policy against EDR. Talos Q3 2026 Microsoft's documentation shows that activating an App Control (WDAC) policy writes event 3099 to the CodeIntegrity Operational log, with the policy name and ID. Microsoft driver blocklist Illustrative detection: a 3099 event whose policy ID is not in your approved list, an agent uninstall outside change control, or taskkill against the EDR's or integrity checker's processes. Raise these from the management console or forwarded logs, because the host itself may already be blind.

  5. Use the exfiltration window. VYPR's exfiltration ran for days. Rclone appears in VYPR, in Q4 2025 and in Microsoft's October case, where it was renamed SearchApp.exe and sent data to SFTP. Talos Q3 2026, Talos Q4 2025, Microsoft, 30 October 2026 Alert on Rclone-like command lines whatever the file name, and on sustained outbound transfer from file servers to cloud storage or SFTP.

  6. Take edge management planes off the internet. Disable or restrict the IOS XE HTTP server. Cisco's check is show running-config | include ip http server|secure|active. Cisco advisory Talos's telecom cases point to further fixes: MFA on device administration, SNMPv3 in place of plaintext community strings, and current VPN encryption. Forward device logs off the device so that "logging disabled" itself becomes an alert. Alert on new privileged local accounts. Talos Q3 2026

  7. Keep the logs that answer "how did they get in". Talos recommends at least 90 days of centralised logs forwarded off the device, with process-creation, command-line and cloud API auditing. Talos Q3 2026 Q2 shows the cost of missing them: domain-controller security logs kept for only hours, and initial-access vectors that could not be determined. Talos Q2 2026 Add Teams call records and RMM session logs, which Microsoft treats as the start of the reconstruction. Microsoft, 30 October 2026

  8. Do not stop recovery at the first workstation. In Microsoft's cases, a session from a help-desk call became privileged certificates. Microsoft warns that resetting the password or reimaging the workstation does not revoke an issued certificate or invalidate Kerberos tickets already issued. After a help-desk-led compromise, review AD CS issuance. Revoke unauthorised certificates and check active tickets as a separate step. Treat accounts excluded from automated containment as a decision someone must cover by hand. Microsoft, 30 October 2026

What remains unknown

  • How many Q3 engagements involved help-desk vishing, which groups ran them, and whether any led to the ransomware cases other than VYPR.
  • Whether the Q3 initial-access shares use all engagements or only those where the vector could be determined.
  • How the 33 percent exploitation share divides between the telecommunications espionage cases and criminal activity, and which edge products were involved apart from IOS XE.
  • Whether the rise in finance-sector engagements reflects attacker targeting or Talos's customer mix.

Related TIR coverage

Sources