IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

Strategic summary

In the third quarter of 2026, phishing remained the most common initial access vector but fell to just over one third of incident response engagements. Voice phishing attacks increased, with actors impersonating IT help desks to trick victims into granting remote access via legitimate RMM tools. Ransomware and pre-ransomware incidents rose to 27 percent, involving established ransomware-as-a-service groups and the new VYPR variant. Targeted cyber espionage campaigns also focused on the telecommunications sector, exploiting known vulnerabilities in publicly accessible management interfaces.

Key findings

• Phishing remains the dominant initial access vector, but at about one third of engagements it is significantly less common than the previous quarter.
• Vishing with IT help desk impersonation and social engineering leads to remote access via legitimate RMM tools.
• Ransomware activity rises to 27 percent of engagements; attackers often disable EDR systems using vulnerable drivers or Windows Defender Application Control.
• Cyber espionage targets telecommunications companies and uses CVE-2023-20198 and BadCandy web shells for persistent access.
• Weak authentication without MFA, legacy protocols, and inadequate credential management make it easier for attackers to spread.