Talos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements
THREAT ACTORCVE-2023-20198redteam/daily · 1 source
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
Cisco's incident response team reports that attackers are phoning staff while pretending to be the IT help desk, tricking them into allowing remote access. Ransomware made up more than a quarter of the cases Talos handled, up from earlier quarters. Attackers also targeted network edge devices and began going after login secrets tied to AI coding tools.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- CVE-2023-20198 is being exploited: treat it as urgent.
- CISA’s required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised…
- Check whether you use Cisco IOS XE Web UI: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Cisco Talos