Security Operations

Talos IR: help desk vishers and EDR killers push ransomware to 27%

Cisco Talos IR says ransomware hit 27% of Q3 2026 cases, driven by fake help desk calls, Quick Assist abuse and EDR-killing drivers.

Radar graphic illustrating the rise in ransomware linked to fake IT help desk calls

Cisco Talos says ransomware and pre-ransomware made up 27% of its incident response work in the third quarter of 2026, the highest share it has recorded in a year. The intrusions it describes rarely needed clever exploits: a phone call, a remote support tool and a vulnerable driver were often enough.

What happened

On 29 October 2026 Cisco Talos published its quarterly incident response trends report for July to September. It draws on the engagements its own responders worked, so it reflects real intrusions, although the figures describe its caseload rather than global ratios.

The headline number is ransomware. Ransomware and pre-ransomware activity accounted for 27% of engagements, compared with no more than 20% in any of the previous four quarters. Talos named The Gentlemen, Qilin, Rhysida and Interlock among the groups it dealt with, and described a newer operation, VYPR, as operationally immature.

Phishing remained the most common way in, at roughly 37% of cases, although that is down from more than half in the previous quarter. Exploitation of public-facing applications came a close second at 33%, mostly against edge kit such as security gateways and remote management interfaces. Finance and public administration were joint most targeted at 18% each, with healthcare slipping to third after leading for two quarters.

A large part of the phishing was not email at all. Talos saw attackers pretend to be the IT help desk over the phone, by email and in Microsoft Teams, then talk employees into opening a remote session. Fake help desk approaches over Teams have been reported repeatedly this year; the Talos data shows the same tactic turning up across a wider caseload and leading straight to ransomware.

The technical picture

The VYPR case is the clearest illustration. A user received a call and was guided into starting a Microsoft Quick Assist session. From there the intruder used remote management software that was already installed to pull down and run an installer package through PowerShell. Reported follow-on activity included MeshAgent, Rclone, PsExec, network scanning and Remote Desktop, several days of data theft and encryption with lightly reworked Conti-derived code that has been circulating since the Conti leaks.

Talos’s Aliza Johnson told Help Net Security that the attackers seemed to know staff names and email addresses, but Talos saw no clear sign of detailed profiling of each victim company. That points to a numbers game: ring enough people and someone will say yes.

Once inside, disabling endpoint protection was routine. The most common methods were loading a legitimate but vulnerable driver to kill security processes (bring your own vulnerable driver, or BYOVD) and abusing Windows Defender Application Control policies to block EDR from running. In an Interlock case, the operators tried to uninstall Cisco Secure Endpoint, stopped security services with PsExec and taskkill, turned off Defender real-time protection and wiped event logs.

The espionage side of the report is about telecoms. Talos attributes most of the long-running intrusions in that sector, with high confidence, to Chinese state-sponsored actors including Salt Typhoon. They combined valid credentials with CVE-2023-20198, an older flaw in web management interfaces, and planted the BadCandy web shell for persistence.

Two smaller cases involved AI coding tools: a trojanised macOS app that hunted the keychain for Claude Code credentials, and an insider hired under false credentials who installed GitHub Copilot CLI and Claude Code on a privileged system. Talos found no malicious use in either, but the tokens these tools hold are now part of the attack surface.

Key figures from Cisco Talos incident response trends for Q3 2026, including ransomware at 27% of engagements and logging gaps in over 40%

Why it matters for UK organisations

None of this is exotic, which is the point. Help desk social engineering is well known to UK security teams, and the Talos data suggests attackers will try almost any employee, not only privileged staff. Finance and public administration topping the target list should concern UK banks, insurers, councils and central government suppliers in particular.

The weakness that stands out is visibility. Insufficient logging appeared in more than 40% of engagements, making it the most common problem Talos found. Poor handling of credentials and secrets, and weak or missing MFA, each featured in a third of cases. Without logs, telling a regulator or data subjects what was taken becomes guesswork.

The edge-device figure also has a UK echo. A third of initial access came from exploited public-facing systems, which fits the NCSC’s August warning that disruptive activity highlights the risk from internet-exposed systems and edge devices.

Expert view

In my experience, the organisations that fare worst in incidents like these are not those with the weakest tools but those that cannot reconstruct what happened. When the logs only go back a fortnight, or live on the very server the attacker cleared, the investigation turns into guesswork, and so does every decision that follows.

The help desk pattern is the one I would brief boards on. Quick Assist and similar tools are built-in, signed and trusted, so a session started by a user who has been talked into it looks entirely legitimate. When we test service desks, the controls that hold up are dull ones: a call-back to a known number, a verification step that cannot be skipped under pressure, and a rule that support staff never ask users to start a remote session from an unsolicited call.

The EDR-killing trend deserves more attention than it gets. Too many teams never alert when their endpoint agent goes quiet. An agent that stops reporting is a priority alert, not a housekeeping ticket.

What to do now

  1. Fix logging first. Send logs off the device to a central platform and keep at least 90 days, as Talos recommends. Include process creation, command lines and cloud API activity, and alert when logs are cleared.
  2. Lock down remote support tools. Remove or block Quick Assist where it is not needed, keep an approved list of remote management software and alert on anything else appearing. This maps to Cyber Essentials secure configuration.
  3. Harden the help desk. Require identity checks before resetting passwords or enrolling new MFA methods, and tell staff plainly that IT will not phone them asking to start a remote session.
  4. Move to phishing-resistant MFA. Replace push and SMS prompts with FIDO2 security keys or passkeys, starting with administrators, block legacy authentication and enforce MFA on every privileged account (Cyber Essentials user access control).
  5. Defend the defences. Turn on Microsoft’s vulnerable driver blocklist, protect EDR from tampering and treat an agent going offline as an incident (Cyber Essentials malware protection).
  6. Patch the edge. Prioritise firewalls, VPNs and management interfaces, and keep management planes off the internet (security update management and firewalls).
  7. Bring AI tools into scope. Inventory AI coding assistants on endpoints, control who may install them and treat their tokens as secrets to rotate and monitor.

Bottom line

The Talos figures describe attackers who succeed by being persuasive and patient rather than technically brilliant. They phone, borrow tools the victim already trusts and switch off the alarms first. The controls that stop them are well understood; too many organisations still lack them, and the logging to know when they have been hit.

Sources

Related Posts