Vishing attacks impersonating IT help desks rise as ransomware incidents grow to 27% of engagements
The claim
Actors are increasingly using voice phishing and IT help-desk impersonation to gain remote access, and ransomware engagements rose to 27 % of Talos IR cases in Q3 2026
Published as: “IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases”
So what
Organizations should prioritize MFA, logging, and monitoring of remote access tools to counter the growing vishing-driven ransomware threat.
The five-minute version
Cisco Talos analyzed its Q3 2026 incident response engagements and found phishing still led initial access (≈37 % of cases) but vishing with IT-desk impersonation was common, enabling attackers to install RMM tools. Ransomware and pre-ransomware incidents increased to 27 % of engagements, up from a max of 20 % in the prior four quarters, with the new VYPR variant showing experimental tactics. The report also highlighted AI-related credential theft and state-sponsored espionage using web shells. Evidence is based on real-world Talos IR telemetry, but exact engagement counts are not disclosed.
What they found 4
- Phishing remained the leading initial access technique, appearing in slightly over one-third of all Talos IR engagements
“Phishing remained the leading initial access technique, appearing in slightly over one-third of all Cisco Talos Incident Response (Talos IR) engagements”
- Ransomware and pre-ransomware incidents made up 27 % of engagements in Q3 2026, up from a maximum of 20 % in the previous four quarters
“Ransomware and pre-ransomware incidents made up 27 percent of engagements in Q3 2026, an increase from a maximum of 20 percent seen in the previous four quarters.”
- Threat actors frequently impersonate IT help desks during vishing calls to manipulate victims into establishing remote connections
“threat actors frequently impersonate IT help desks during vishing calls to manipulate victims into establishing remote connections - a tactic observed in several other Q3 engagements.”
- The emerging ransomware variant VYPR relied on older Conti-derived source code and showed experimental exfiltration tactics
“The group also appeared to rely on older leaked Conti-derived source code with only minimal modifications, reflecting a relatively unsophisticated technical approach.”
What undercuts it the paper’s own results
- Phishing decreased from over 50 % of engagements last quarter, indicating the rise is not universal
- The investigation of the internal AI-tool abuse did not find evidence of malicious activity or data theft
Stated limits 3
- The exact social engineering technique was not confirmed in the VYPR case
- VYPR is described as relatively new and operationally immature
- The AI-related internal actor case lacked evidence of actual malicious use
What’s new here 4
- Rise of voice-phishing (vishing) where attackers impersonate IT help desks to obtain remote access
- Ransomware engagements grew to 27 % of Talos IR cases, driven by groups like Interlock and the emerging VYPR variant
- Emergence of VYPR ransomware, which uses BYOVD drivers and shows experimental exfiltration behavior
- Targeting of AI development tools and AI-related credentials, such as Anthropic Claude Code
Artifacts & methods 10
- VYPR ransomwareprimitive
- BadCandy web shellprimitive
- MeshAgentprimitive
- Rcloneprimitive
- PsExecprimitive
- Microsoft Quick Assistsystem
- Remote Monitoring and Management (RMM) toolssystem
- BYOVD vulnerable drivers
- GitHub Copilot CLI
- Anthropic Claude Code