Cisco Talos reports that ransomware and pre-ransomware incidents made up 27 percent of its Q3 2026 incident-response engagements, an increase from the maximum of 20 percent seen across the previous four quarters. Phishing remained the leading initial-access technique, appearing in slightly over one-third of engagements, while exploitation of public-facing applications accounted for another one-third. (Cisco Talos incident-response report)

The report describes repeated voice-phishing campaigns in which attackers impersonated IT help desks and persuaded victims to allow remote access through legitimate tools. In one VYPR ransomware engagement, Talos says the actor gained initial access after tricking a user into starting a Microsoft Quick Assist session. The actor then used existing remote-monitoring software to run PowerShell and install an MSI package from a remote IP address. Talos reports that the actor used MeshAgent, Rclone, PsExec, IP scan and MSTSC, and exfiltrated data over multiple days while testing different techniques.

Talos also attributes most of its reported telecommunications-sector espionage intrusions with high confidence to China-backed actors, including Salt Typhoon. It says the actors used valid credentials and exploited CVE-2023-20198 in publicly accessible web-based management interfaces. The fetched report does not identify the affected product or provide an official patch or mitigation link for that CVE, leaving the specific product exposure and response scope unresolved.

The help-desk technique is technically distinct from the SaaS-focused activity described by Mandiant in its January report. Mandiant reports that attackers impersonated IT staff to harvest SSO credentials and MFA codes, then accessed cloud applications; it says those compromises were not caused by vulnerabilities in vendors’ products or infrastructure. Mandiant recommends moving toward phishing-resistant MFA, including FIDO2 security keys or passkeys, because those methods resist the social-engineering techniques described in its cases. (Mandiant threat-intelligence report)

The available reporting therefore documents both remote-access-enabled ransomware activity and credential-focused SaaS intrusions, but does not establish that either tactic affects every organization or provide a product-specific fix for CVE-2023-20198.