Talos IR Q3 2026: Vishing, Remote Support Abuse, and BYOVD in Ransomware Incidents

1. Basic Information

• Title: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• Source: Cisco Talos
• Published: 2026-10-29
• Original: Cisco Talos
• Related Sources: None
• Associated Malware: VYPR, BadCandy, Interlock
• Associated Threat Groups: Salt Typhoon-affiliated activity, Interlock
• Associated CVEs: CVE-2023-20198
• Affected Products: Quick Assist, RMM, Cisco IOS XE, Defender, WDAC
• Severity: high

2. Executive Summary

In Talos IR cases for Q3 2026, initial access via phishing accounted for 37%, and public-facing application exploitation accounted for 33%. In a separate metric, ransomware and pre-ransomware cases accounted for 27%, with the VYPR incident involving the use of Quick Assist, RMM, and BYOVD.

The reported incidents and recurring weaknesses are directly relevant to SOC operations: attackers used phone-based social engineering, legitimate remote support, RMM, and vulnerable drivers. The specific pretext used in the VYPR phone call remains unconfirmed.

3. Attack Flow

VYPR: Initial Access Sequence from Primary Source

1. The user is guided via vishing, and the user initiates a Quick Assist session. It is unconfirmed whether the phone pretext in this incident was an IT help desk impersonation.
2. Using access obtained via Quick Assist, existing RMM is used to download and install an MSI via PowerShell.

VYPR: Subsequent Activity Observed in the Same Incident (Order of Listing Does Not Indicate Execution Sequence)

1. The use of MeshAgent, Rclone, PsExec, IP scanning, and MSTSC has been reported, but the exact chronological order of all tools is not shown.
2. Data exfiltration spanning multiple days, EDR/AV termination via BYOVD, and ransomware execution have been reported. These should not be treated as a single mandatory path common to all victim environments.

4. Attacker Position and Execution Location

• The attacker uses a phone call to persuade the user to start a legitimate remote support session, then uses the endpoint as a foothold.

5. Victim and Administrator Perspective

Victim Perspective

• Appears as a phone-guided prompt and approval screen for remote assistance. Help desk impersonation was also observed in other Q3 cases.

Administrator Perspective

• Appears as Quick Assist, RMM, PowerShell MSI, Rclone, and driver loading.

6. Success and Failure Conditions

Success Conditions

• The user approves the remote session.
• Subsequent tools are successfully executed.

Failure Conditions and Mitigations

• Enforce identity verification and approval gates.
• Apply driver blocklists and application control.

7. Impact upon Success

• Credential theft, lateral movement, and exfiltration.
• Disabling of EDR and logging.

8. Observable Logs

Inference: The following are candidate logs to check within your organization. This depends on log collection and retention settings as well as product visibility, and does not mean recording of all items was confirmed in the primary source.

• Email: No relevant information
• Proxy / SWG / DNS: No relevant information
• Endpoint / EDR: Check for QuickAssist, RMM, MSI, MeshAgent, PsExec, Rclone, and driver load.
• Identity / IdP: No relevant information
• SaaS / Cloud: No relevant information
• Network: Check for RMM C2, Rclone destination, scans, and MSTSC.

9. Attack Success Determination

Inference: The following criteria are for internal assessment and do not imply that the source observed every success phase.

• User Action Confirmed: Criteria: Verify remote assistance approval. Target: user
• Initial Execution Confirmed: Criteria: Verify execution of MSI or similar files. Target: endpoint
• Data or Session Compromise Confirmed: Criteria: Corroborate Rclone transfer. Target: data

10. Investigation Playbook

• Trigger: Vishing report, remote session, PowerShell MSI, driver load
• Initial Checks: Verify target product versions, exposure scope, time synchronization, and log retention.
• Endpoint: Preserve target device settings, processes, files, and reboot history.
• Identity and Cloud: Check administrator authentication and API operations.
• Follow-on Activity: Track subsequent internal connections, credential usage, configuration changes, and outbound traffic.
• Containment: Isolate the target, apply patches, perform credential rotation, and restore from a known-good configuration.
• Assessment Categories: Record attempts, initial execution, successful authentication, data theft, and subsequent compromise separately.

11. Defense and Detection Ideas

• Single Events: Detect MSI execution, Rclone use, or driver loading immediately following Quick Assist.
• Timeline Correlation: Correlate remote session -> tool installation -> exfiltration.
• Hunting: Investigate unusual commands originating from RMM.
• Logging Gaps: Screen interaction intent may be difficult to determine from logs alone.
• Priority Controls: Prioritize identity verification, RMM governance, MFA, and central logging.

12. Facts, Inferences, and Hypotheses

Facts

• Initial access vectors in Talos IR Q3 cases were 37% phishing and 33% public-facing application exploitation. Ransomware/pre-ransomware cases at 27% represent a separate metric and should not be added together as mutually exclusive totals. These do not represent global ratios.
• Vishing involving help desk impersonation was confirmed in Q3. However, the specific pretext for the VYPR incident was not confirmed.
• In the VYPR incident, after Quick Assist, an MSI was downloaded and executed via PowerShell using existing RMM. The use of MeshAgent, Rclone, PsExec, scanning, MSTSC, multi-day exfiltration, EDR/AV termination via BYOVD, and ransomware execution were also reported, but the exact chronological order of all actions is not indicated.
• Talos attributes many telecommunications compromises with high confidence to Chinese state-sponsored actors, including Salt Typhoon. Reports include the use of valid credentials, CVE-2023-20198, BadCandy, VPNs, and traffic mirroring, but do not attribute all cases solely to Salt Typhoon activity.
• In the Interlock case, attempts to uninstall CSE, PsExec/taskkill, Defender disabling, and log clearing were reported. Malicious WDAC policies were part of the actor's past activity and should be distinguished from confirmed execution in this Q3 case.
• Insufficient logging was present in over 40% of cases, MFA issues in 33%, and secret management issues in 33%.
• In AI-related cases, no evidence of malicious activity or data exfiltration was confirmed regarding the introduction of the Copilot CLI or Claude Code, whereas a separate trojanized macOS app collected Claude Code keychain credentials.

Inferences

• Inference: Correlate legitimate remote-tool activity over time, from the initial support-related contact through any observed exfiltration. In the VYPR case, do not assume that the caller specifically impersonated an IT help desk.
• Inference: Do not extrapolate quarterly percentages to global figures.

Hypotheses

No additional hypotheses. Unconfirmed items are listed under "Unknowns and Limitations".

13. MITRE ATT&CK Mappings

ID	Technique	Confidence	Basis
T1566	Phishing	high	Incidents where users were guided via telephone vishing.
T1219	Remote Access Tools	high	Abuse of Quick Assist and RMM.
T1685	Disable or Modify Tools	high	BYOVD used to disable EDR/AV, and separately reported Defender disabling. BYOVD alone is not evidence of privilege escalation.

14. Unknowns and Limitations

• Total case count, geographic distribution, and compromise success rate are unknown.

15. Impact on SOCs and Organizations

Inspect help desk identity verification, Quick Assist/RMM controls, vulnerable driver blocklists, and log tamper resistance.

16. Summary by Target Role

• SOC: Correlate remote sessions with MSI execution, BYOVD, and Rclone.
• Administrators: Strengthen RMM approvals, MFA, driver blocklists, and central logging.
• Users: Call back known official channels when contacted by phone regarding help desk matters.