IR Trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

According to Cisco Talos Incident Response, phishing was the most common initial access technique in Q3 2026, accounting for 37% of engagements. Actors also used voice phishing, or vishing, and IT help-desk impersonation to persuade victims to allow remote access through legitimate RMM tools. Exploitation of public-facing applications accounted for 33% of engagements, while ransomware and pre-ransomware incidents accounted for 27%. Talos observed prolonged cyber espionage intrusions targeting telecommunications and attributed most of them with high confidence to China state-sponsored actors, including Salt Typhoon.