---
title: "IR Trends Q3 2026: Actors Impersonate IT Help Desks in Vishing Attacks as Ransomware Activity Increases"
metaTitle: "Talos Q3 2026: Vishing Drives Initial Access"
description: "Cisco Talos Q3 2026 data shows vishing with IT help desk impersonation driving initial access as ransomware engagements rise to 27% of cases."
slug: talos-ir-trends-q3-vishing
date: "2026-10-29T12:00:00-05:00"
featured: true
image:
  src: "https://cdn.securelogix.dev/slx/images/actors-impersonate-it-help-desks.webp"
  alt: "A slightly uncanny-looking help desk operator."
sourcePublisher:
  name: Cisco Talos Intelligence
  url: "https://talosintelligence.com/"
sourceArticle:
  url: "https://blog.talosintelligence.com/ir-trends-q3-2026/"
tags: [Vishing, Ransomware, Social Engineering]
status: published
---

Phishing remained the leading initial access technique, appearing in slightly over one-third of all Cisco Talos Incident Response (Talos IR) engagements — a decrease from over 50 percent last quarter. In addition to traditional phishing links and attachments, we observed numerous threat actors conducting voice phishing (vishing) in tandem with IT desk impersonation to socially engineer the victim into allowing remote access via a legitimate remote monitoring and management (RMM) tool. Exploitation of public-facing applications was the next most common vector, accounting for one-third of Talos IR engagements. Threat actors predominantly targeted edge devices such as security gateways and remote network management interfaces. These are critical components within enterprise environments, often responsible for managing authentication, network traffic, or sensitive data. Compromising them can provide broad access to internal networks or user credentials...