IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

Cisco Talos Incident Response's Q3 2026 report analyses the attack paths observed in customer environments. Phishing remained the most common initial access technique at slightly over one third of engagements, with voice phishing increasingly used alongside classic links and attachments: attackers posed as the IT help desk and persuaded employees to grant remote access through legitimate remote monitoring and management tools. Exploitation of public-facing applications came second, predominantly targeting edge devices such as security gateways and remotely reachable network management interfaces. The report names improper credential and secret management as the second most common weakness in around one third of engagements, and ransomware cases increased quarter over quarter. The trends report does not list specific vulnerability IDs or named threat actor groups.