Talos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
Ransomware and pre-ransomware cases rose to 27 percent of engagements from a previous maximum of 20 percent. Actors commonly disabled EDR by exploiting vulnerable drivers or using WDAC. Talos attributed telecom espionage intrusions mostly with high confidence to China state-sponsored actors including Salt Typhoon, who used valid credentials and CVE-2023-20198 in web management interfaces, deployed the BadCandy web shell, created privileged accounts, disabled logging and used LOTL techniques. Weaknesses included password-only authentication, plaintext SNMP, outdated VPN encryption and poor credential management. Defenders should enforce strong MFA, harden credential management including for AI platforms and developer tools, and secure edge devices and management interfaces. A trojanized macOS application was also used to scrape Claude Code keychain credentials.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- CVE-2023-20198 is being exploited: treat it as urgent.
- CISA’s required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised…
- Check whether you use Cisco IOS XE Web UI: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data