ANNUAL REPORT: Cisco Talos Incident Response trends Q3 2026: public administration tied with finance as the most targeted sector, help-desk vishing into remote-management tools, and ransomware operators uninstalling and killing EDR

Cisco Talos Incident Response reports that in Q3 2026 financial organisations made up 18 percent of its engagements, tying with public administration as the most targeted sector (Cisco Talos, 2026-10-29). Phishing was the leading initial-access technique at 37 percent of engagements and exploitation of public-facing applications second at 33 percent; the phishing cases include numerous actors who phone the victim as the IT help desk to get remote access allowed through a legitimate remote monitoring and management (RMM) tool (Cisco Talos, 2026-10-29). Ransomware and pre-ransomware cases were 27 percent of engagements, with The Gentlemen, Qilin, Rhysida and the closed group Interlock among the families and a new variant, VYPR, that Talos calls operationally immature: it had no leak site when seen, reused leaked Conti-derived source code and exfiltrated over several days (Cisco Talos, 2026-10-29).

The VYPR intrusion began with a vishing call that had the user start a Microsoft Quick Assist session; the actor then used RMM software that ran PowerShell to download and install an MSI from a remote address, with MeshAgent, Rclone, PsExec, an IP scanner and mstsc as tools, and disabled EDR with several vulnerable drivers (Cisco Talos, 2026-10-29). Interlock operators repeatedly tried to uninstall Cisco Secure Endpoint, used PsExec and taskkill to end security services and integrity checkers, turned off Windows Defender real-time protection and cleared event logs (Cisco Talos, 2026-10-29). Talos names insufficient logging (over 40 percent of engagements), weak credential and secret handling, and absent or incomplete MFA as the most common weaknesses, and recommends centralised logging with at least 90 days of retention (Cisco Talos, 2026-10-29).