Vishing Attacks Impersonating IT Help Desks Surge as Ransomware Activity Rises in Q3 2026
What Happened — Cisco Talos’ Q3 2026 Incident Response (IR) report shows that phishing remains the top initial‑access technique, but a notable shift is the rise of voice‑phishing (vishing) where threat actors pose as IT help‑desk staff. Victims are coaxed into granting remote access through legitimate Remote Monitoring and Management (RMM) tools. Public‑facing application exploitation follows closely, with attackers targeting edge devices such as security gateways and remote‑network management interfaces. Ransomware‑related engagements grew to 27 % of all cases, up from a quarterly high of 20 %, and include variants like The Gentlemen, Qilin, Rhysida, Interlock and the emerging VYPR. State‑sponsored actors (e.g., Salt Typhoon) continue to exploit a known CVE‑2023‑20198 vulnerability in web‑based management consoles for espionage, deploying the BadCandy web‑shell for persistence.
Why It Matters for Trust & Control Assurance — The surge in vishing‑driven RMM abuse highlights gaps in identity verification and security‑awareness controls, directly testing an organization’s access‑control and user‑training objectives.
Who Is Affected — Technology‑SaaS providers, managed‑service providers (MSPs), telecom operators, and any enterprise that relies on remote support tools.
Recommended Actions
- Enforce multi‑factor authentication (MFA) for all remote‑access and RMM sessions.
- Institute a formal “call‑back” verification process for any unsolicited IT‑support requests.
- Conduct regular vishing simulation exercises and refresh security‑awareness training.
- Continuously monitor privileged‑account activity and RMM tool logs for anomalous behavior.
Source: Cisco Talos IR Trends Q3 2026
Technical Notes
- Attack vector: vishing (voice phishing) combined with legitimate RMM tools.
- Notable CVE: CVE‑2023‑20198 (web‑based management interface vulnerability).
- Ransomware variants observed: The Gentlemen, Qilin, Rhysida, Interlock, VYPR.
Source: Cisco Talos IR Trends Q3 2026