Talos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements
THREAT ACTORCVE-2023-20198redteam/daily · 1 source
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
Talos IR found phishing was the top initial access method at just over one-third of engagements, down from over 50 percent, with vishing and help desk impersonation used to get victims to allow remote access via legitimate RMM tools. Exploitation of public-facing applications, mainly edge devices, accounted for one-third. Ransomware and pre-ransomware activity reached 27 percent, involving The Gentlemen, Qilin, Rhysida, Interlock and the newer VYPR, with EDR disabled via vulnerable drivers or WDAC.
For IT people · Written by AI from 1 source · Wrong?
What to do
- CVE-2023-20198 is being exploited: treat it as urgent.
- CISA’s required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised…
- Check whether you use Cisco IOS XE Web UI: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Cisco Talos