Rhysida

Talos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements

Talos IR found phishing was the top initial access method at just over one-third of engagements, down from over 50 percent, with vishing and help desk impersonation used to get victims to allow remote access via legitimate RMM tools. Exploitation of public-facing applications, mainly edge devices, accounted for one-third. Ransomware and pre-ransomware activity reached 27 percent, involving The Gentlemen, Qilin, Rhysida, Interlock and the newer VYPR, with EDR disabled via vulnerable drivers or WDAC.