Overview of Q3 2026 Incident Response Trends
The third quarter of 2026 saw significant shifts in threat actor methodologies, with a notable increase in ransomware activity, the emergence of sophisticated vishing attacks, and persistent state-sponsored cyber espionage campaigns. According to Cisco Talos Incident Response (Talos IR) analysis, traditional phishing decreased slightly, but was offset by the rise of voice phishing (vishing) techniques impersonating IT help desks. Simultaneously, ransomware and pre-ransomware incidents climbed to 27% of engagements, marking an increase from previous quarters. Critical infrastructure, particularly the telecommunications sector, remained a target for advanced persistent threat (APT) groups like Salt Typhoon. The growing role of Artificial Intelligence (AI) as both a tool for attackers and a target for credential theft also presents an emerging area of concern for security professionals.
Key Initial Access Vectors and Threat Activity
Phishing, while still the leading initial access technique, has evolved beyond simple links and attachments. Talos IR observed numerous instances of threat actors conducting vishing attacks, where they impersonated IT help desk personnel. These attackers socially engineered victims into allowing remote access via legitimate Remote Monitoring and Management (RMM) tools, bypassing traditional email security controls. This highlights the ongoing challenge of detecting IT help desk vishing attacks that leverage social engineering and trusted tools.
Exploitation of public-facing applications was the second most common initial access vector, accounting for one-third of Talos IR engagements. Threat actors primarily targeted edge devices such as security gateways and remote network management interfaces. These components are vital for managing authentication, network traffic, and sensitive data, making their compromise a gateway to broader internal network access or user credentials.
Ransomware Surge and Emerging Variants
Ransomware and pre-ransomware incidents escalated to 27% of all engagements in Q3 2026, up from a maximum of 20% in the preceding four quarters. Talos IR responded to attacks involving well-established ransomware-as-a-service (RaaS) variants such as The Gentlemen, Qilin, and Rhysida, alongside the closed group Interlock. A notable emerging ransomware variant, VYPR, was also observed. Its operators are still testing a range of tactics, techniques, and procedures (TTPs) rather than adhering to a standard playbook, indicating an evolving threat landscape. A common TTP involved disabling endpoint detection and response (EDR) systems, often through exploiting vulnerable drivers or manipulating Windows Defender Application Control (WDAC).
Mitigating Salt Typhoon Cyber Espionage in Telecommunications
Talos IR continues to track prolonged cyber espionage intrusions primarily targeting the telecommunications sector. Many of these intrusions are attributed with high confidence to China state-sponsored threat actors, including Salt Typhoon. These attackers routinely achieve initial access by leveraging valid credentials and exploiting a known vulnerability (CVE-2023-20198) in publicly accessible web-based management interfaces. Once inside, Salt Typhoon deployed tools like BadCandy, a malicious web shell implant, for persistent and stealthy remote access.
The adversaries extensively employ living-off-the-land (LOTL) tactics, utilizing legitimate network infrastructure features like VPN access and management protocols to establish backdoors, exfiltrate data, and conduct reconnaissance. They created privileged accounts, disabled logging to hide activities, and altered configurations to maintain persistence. Common security weaknesses observed in victim environments included reliance on password-only authentication without multi-factor authentication (MFA), use of legacy and weak management protocols (e.g., plaintext SNMP), and inadequate credential management practices.
AI: A Dual-Edged Sword for Cyber Defense
Q3 2026 investigations highlight AI’s growing role in cyber activity, both as a tool for malicious actors and a target for credential theft. In one instance, an insider with false credentials abused privileged access to install AI-powered development tools like GitHub Copilot CLI and Anthropic Claude Code. While no direct malicious activity was confirmed, the potential for automating harmful actions is significant.
Another investigation revealed a macOS endpoint compromised by a trojanized application specifically scraping credentials from the macOS keychain related to the Anthropic Claude Code AI assistant. This points to an emerging threat focusing on securing AI platforms and development tools by targeting AI-specific credentials, which could grant access to sensitive data and advanced automation capabilities.
Actionable Recommendations for Defenders
To effectively counter these evolving threats, organizations should prioritize the following actions:
- Enhance Vishing Defenses: Educate users on social engineering tactics, especially those involving IT help desk impersonation. Implement strict policies for remote access tools, requiring out-of-band verification for any RMM installation or session initiation.
- Patch Public-Facing Applications: Immediately identify and patch all known vulnerabilities in internet-facing applications and edge devices, particularly those involving web-based management interfaces. Regularly audit these systems for unauthorized accounts or configuration changes.
- Strengthen Ransomware Resilience: Implement strong backup and recovery strategies. Deploy and maintain EDR solutions, ensuring they are configured to prevent tampering (e.g., driver exploitation, WDAC bypasses). Conduct regular penetration testing to identify weaknesses.
- Implement Strong Authentication: Mandate multi-factor authentication (MFA) across all systems, especially for privileged accounts and public-facing applications. Review and update credential management practices to eliminate legacy protocols and weak passwords.
- Secure AI Ecosystems: Monitor privileged access to AI development tools and platforms. Implement strict access controls and conduct regular audits of AI-related credentials. Educate developers on the risks associated with installing unauthorized AI tools.
- Proactive Threat Hunting: Monitor network traffic for anomalous activity, especially related to management protocols and outbound connections to unfamiliar destinations, which could indicate living-off-the-land tactics. Focus on detecting indicators of compromise (IoCs) associated with known groups like Salt Typhoon.
Related: Blinder Tunnel Campaign Targets Iraqi Critical Infrastructure, 39 Methods Compromise Passkey Authentication: Threat Analysis