> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Vishing and RMM abuse drive ransomware rise as Salt Typhoon targets telecoms - URL: https://f4n6.co.uk/security-feed/vishing-and-rmm-abuse-drive-ransomware-rise-as-salt-typhoon-targets-telecoms/ - Published: 2026-10-29T14:33:42.000Z - Updated: 2026-10-29T14:33:42.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2023-20198, The Gentlemen, Qilin, Rhysida, Interlock, VYPR ## 1\. Executive summary Cisco Talos Incident Response reports that ransomware and pre-ransomware incidents rose to 27 percent of its Q3 2026 engagements, up from a ceiling of 20 percent across the previous four quarters, with operators disabling EDR through vulnerable drivers and WDAC policies before encryption. Voice phishing paired with IT help-desk impersonation let actors talk users into opening remote sessions through legitimate RMM tools, and exploitation of public-facing edge devices accounted for a third of engagements. The financial sector reached 18 percent of engagements, tying public administration as the most targeted sector. Separately, Talos attributes prolonged telecom espionage to China state-sponsored actors including Salt Typhoon (MITRE G1045), which gained access using valid credentials and CVE-2023-20198, a CVSS 10.0 critical flaw in Cisco IOS XE web UI that is in CISA KEV (added 2023-10-16) with EPSS at 100 percent, and deployed the BadCandy web shell. For EMEA financial services the exposure is twofold: help-desk social engineering that defeats MFA by consent, and unpatched internet-facing management interfaces that give an espionage actor administrative reach. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 17 | Ransomware operators disabled EDR, cleared event logs and encrypted data in 27 percent of Talos IR engagements, and the report names insufficient logging in over 40 percent of cases | The incident management process must survive loss of the endpoint telemetry and event logs the actor deletes; detection and recovery cannot depend on host-resident logs alone | | DORA Art. 28 | Initial access ran through legitimate third-party RMM software (MeshAgent, Zoho Assist in the prior quarter) and a vishing-to-Quick-Assist path, so the remote-access tooling in the supply chain is the intrusion vector | Third-party risk assessment must cover remote monitoring and management tooling and help-desk remote-support workflows, not only contracted ICT providers | | NIS2 Art. 21(2)(d) | The same RMM and remote-support path is the entry point, and the actor used existing RMM software to run PowerShell and pull an MSI from a remote IP | Supply chain security measures must include controls on remote-access software and the help-desk process that grants it | ## 3\. Technical analysis & attack chain The report is a quarterly incident-response trends summary, not a single intrusion. The chain below is the sequence Talos describes for the VYPR ransomware engagement, which is the most detailed case in the source. Other engagements share the initial-access and defence-evasion steps but not every stage. 1. A user was tricked by voice phishing into starting a Microsoft Quick Assist session, giving the actor interactive remote access to the endpoint. Talos states the exact social-engineering technique was not confirmed in this case, but IT help-desk impersonation during vishing calls was seen in several other Q3 engagements. 2. The actor used RMM software already present on the host to run PowerShell, which downloaded and installed an MSI package from a remote IP address. 3. The actor ran MeshAgent, Rclone, PsExec, IP scan and Microsoft Terminal Services Client (MSTSC) during the intrusion. 4. The actor disabled EDR and antivirus using bring-your-own-vulnerable-driver (BYOVD) techniques, deploying an unusually large number of vulnerable drivers, which Talos suggests was to create redundancy. 5. Data was exfiltrated over multiple days, which Talos notes is uncommon in ransomware investigations, and encryption followed. VYPR is assessed by Talos as relatively new and operationally immature. The supporting observations: no data leak site was referenced in the ransom note and the associated leak-site infrastructure was not created until after the engagement; the code relies on older leaked Conti-derived source with minimal modification; and the operator tested different exfiltration parameters and multiple drivers rather than following a fixed playbook. That immaturity is a detection opportunity, because repeated driver loading and slow, parameter-tweaked exfiltration generate more telemetry than a rehearsed affiliate run. Interlock, a closed group, took a different route to the same objective. Talos observed Interlock actors making multiple attempts to uninstall Cisco Secure Endpoint, using PsExec.exe and taskkill.exe to terminate security services and integrity checkers including cscm.exe and sfc.exe, disabling Windows Defender real-time protection and clearing event logs. Talos notes this matches earlier Interlock activity in which the group deployed a malicious WDAC policy to terminate EDR. The Gentlemen, Qilin and Rhysida were the other RaaS variants named in Q3 engagements. The Salt Typhoon campaign is the espionage strand. Talos attributes most of the prolonged telecom intrusions to China state-sponsored actors including Salt Typhoon with high confidence. Initial access came through valid credentials and exploitation of CVE-2023-20198 in publicly accessible web-based management interfaces. The actor deployed BadCandy, a web shell implant Talos associates with Salt Typhoon, for persistent remote access. Talos describes the actor creating privileged accounts, disabling logging and altering configurations to hold persistence, and using legitimate network features (VPN access, traffic mirroring, management protocols) for backdoors, exfiltration and reconnaissance. The victim weaknesses Talos lists are password-only authentication with no evidence of MFA, plaintext SNMP and outdated VPN encryption, and poor credential management. CVE-2023-20198 is recorded as CWE-420 (improper protection of alternate path) in NVD. The source does not assign a CWE, so there is no conflict to reconcile; the CVSS 10.0 critical rating, CISA KEV listing and 100 percent EPSS are the values to act on. The AI-related findings are single-sourced and thin. In one case an insider hired under false credentials installed GitHub Copilot CLI and Anthropic Claude Code with developer-level access; Talos found no evidence of malicious activity or data theft. In a second, a macOS endpoint infected through a trojanized application was scripted to scrape credentials from the keychain associated with Anthropic Claude Code. No tooling, hashes or command lines are given for either, so neither supports detection content here. Confidence caveats: all of the above rests on a single Cisco Talos report. The Salt Typhoon attribution is Talos's high-confidence assessment, not a multi-vendor consensus in this material. The Gentlemen, Qilin, Rhysida, Interlock and VYPR have no MITRE ATT&CK profile, so their naming here is Talos's and the group identities are unconfirmed beyond that source. The actor-to-technique mapping in the report's ATT&CK table is generic and is not attributed to specific groups. ## 4\. Mitigation & containment P1 within 24 hours - Inventory every internet-facing Cisco IOS XE web UI management interface and confirm patch status against CVE-2023-20198\. Where patching cannot be completed immediately, disable the HTTP server feature on internet-facing systems. This is the KEV-listed, EPSS 100 percent item and the confirmed Salt Typhoon access path. - Hunt for BadCandy web shell artefacts and for newly created privileged local accounts on network devices, then review device configurations for unauthorised changes and disabled logging. - Block or require approval for Microsoft Quick Assist and consumer RMM tools on managed endpoints. Alert on any Quick Assist session initiated outside a logged help-desk ticket. - Enforce a callback verification step in the help-desk process: any remote-support session request is verified against a known number or in-person confirmation before the session starts. P2 within 72 hours - Move high-privilege and remote-access accounts off push and SMS MFA to FIDO2/WebAuthn or hardware keys. Block legacy authentication through Conditional Access and require number matching or verified push where phishing-resistant methods are not yet deployed. - Restrict self-service MFA enrollment so it requires help-desk verification, closing the self-enrolled-device path. - Forward logs from servers, workstations, network infrastructure, cloud identity providers and security appliances off-device to a central platform with at least 90 days retention, so log clearing on a host does not erase the record. Enable process-creation, command-line and cloud API (for example Microsoft Graph) auditing. - Alert on PsExec.exe and taskkill.exe terminating cscm.exe, sfc.exe or Cisco Secure Endpoint processes, and on Windows Defender real-time protection being disabled. - Remove plaintext SNMP and retire outdated VPN encryption on network devices. P3 within 7 days - Enable Microsoft vulnerable driver blocklist or equivalent WDAC policy to stop BYOVD driver loading, and alert on repeated loading of unsigned or known-vulnerable drivers. - Baseline RMM and remote-access binaries in the environment and alert on MeshAgent, Rclone, IP scan and MSTSC executing outside sanctioned administrative workflows. - Review credential storage: block browser password autofill for privileged accounts, require unique passwords per account, and revoke and replace credentials suspected of exposure. - Run a log architecture review against the 90-day retention and off-device forwarding requirements above. ## 5\. Indicators of compromise No atomic network or file indicators (hashes, domains, IPs, file paths) are given in the source. The report names tools and processes but no values that can be pivoted on mechanically. | type | value | confidence | source | | ---- | ----- | ---------- | ------ | | n/a | n/a | n/a | n/a | The source describes observable behaviours but no atomic indicators. The table below lists those behaviours. ### Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | --------------------------------------------------------- | | Quick Assist session initiated following an inbound call | Endpoint process telemetry, help-desk ticketing | High (Talos describes the vector; exact lure unconfirmed) | | PowerShell spawning an MSI install from a remote IP via existing RMM software | Process creation and command-line logs, EDR | High | | MeshAgent, Rclone, PsExec, IP scan, MSTSC executing | Process creation logs, EDR | High | | Multiple vulnerable drivers loaded in sequence (BYOVD) | Driver load events, WDAC/blocklist logs | High | | PsExec.exe and taskkill.exe terminating cscm.exe, sfc.exe or Cisco Secure Endpoint | Process creation and termination logs | High | | Windows Defender real-time protection disabled; event logs cleared | Defender operational logs, Windows event log service | High | | Malicious WDAC policy deployed to terminate EDR | WDAC policy events, code integrity logs | High | | New privileged local accounts created on network devices; logging disabled; configuration altered | Device configuration and AAA logs, syslog | High (Salt Typhoon strand) | | BadCandy web shell present on web-based management interface | Web server and device file integrity monitoring | High (Talos associates BadCandy with Salt Typhoon) | | Multi-day exfiltration with changing parameters | Proxy, firewall and cloud storage egress logs | High | | macOS keychain access targeting Anthropic Claude Code credentials | macOS unified log, keychain access events | Low (single case, no artefacts given) | ## 6\. Detection The source gives process names and command-line tooling but no distinctive strings, mutexes, registry keys or file paths unique to the malware. A YARA rule built on tool names alone would detect reporting about the threat, not the threat, so none is emitted. The Sigma rule below targets the process and defence-evasion behaviours Talos describes. ```yaml title: Ransomware EDR Tampering and RMM Tool Abuse id: 8f2c1a4e-6b7d-4c9e-a1f3-2d5e9b0c7a61 status: experimental description: Detects process and defence-evasion behaviours described in Cisco Talos IR Trends Q3 2026, including security service termination, Defender tampering and RMM tool execution. author: Adverse Trace date: 2026-10-29 references: - https://blog.talosintelligence.com/ir-trends-q3-2026/ logsource: product: windows category: process_creation detection: selection_terminate: Image|endswith: - '\taskkill.exe' - '\PsExec.exe' CommandLine|contains: - 'cscm.exe' - 'sfc.exe' - 'Cisco Secure Endpoint' selection_rmm: Image|endswith: - '\MeshAgent.exe' - '\rclone.exe' - '\mstsc.exe' selection_defender: CommandLine|contains: - 'Set-MpPreference' - 'DisableRealtimeMonitoring' condition: selection_terminate or selection_rmm or selection_defender falsepositives: - Legitimate administrative use of PsExec, Rclone or MSTSC - Sanctioned help-desk remote sessions level: high ``` Tune the RMM selection against the environment's sanctioned tooling before enabling at high severity; MeshAgent and MSTSC have legitimate uses. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2023-20198](https://nvd.nist.gov/vuln/detail/CVE-2023-20198?ref=f4n6.co.uk) | 10.0 Critical | ⚠ KEV 2023-10-16 | 100% | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Sof… | ## Threat actor context **Salt Typhoon** · [G1045](https://attack.mitre.org/groups/G1045?ref=f4n6.co.uk) [Salt Typhoon](https://attack.mitre.org/groups/G1045?ref=f4n6.co.uk) is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). *No MITRE ATT&CK profile for: The Gentlemen, Qilin, Rhysida, Interlock, VYPR.* ## 7\. Sources - Cisco Talos, "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases", https://blog.talosintelligence.com/ir-trends-q3-2026/, 2026-10-29. - Cisco Talos, "IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains", https://blog.talosintelligence.com/ir-trends-q2-2026/ (prior-quarter baseline for RMM abuse and MFA weaknesses). - Cisco Talos, "You were onto something with 'It's the Climb,' Miley", https://blog.talosintelligence.com/you-were-onto-something-with-its-the-climb-miley/ (Q2 2026 summary; MeshAgent and Zoho Assist context). - NVD, CVE-2023-20198 record (CVSS 10.0, CWE-420), via the verified reference data supplied with this item. - CISA KEV catalogue, CVE-2023-20198 added 2023-10-16, via the verified reference data supplied with this item. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2023-20198 as the highest-priority item in this advisory: CVSS 10.0 critical, in CISA KEV since 2023-10-16, EPSS at 100 percent, and the confirmed access path for the Salt Typhoon campaign Talos describes. The ransomware trend is a process and controls problem more than a patch problem: the entry points are a phone call and a legitimate remote-access tool, and the defence evasion is driver-based EDR removal that a current blocklist and WDAC policy can interrupt. The financial sector's rise to 18 percent of engagements, tied with public administration as most targeted, puts EMEA clients in the current targeting set. All technical findings here are single-sourced to Cisco Talos; the Salt Typhoon attribution is Talos's high-confidence assessment and the ransomware group names have no MITRE ATT&CK profile, so we treat those identities as unconfirmed and will revise if other vendors corroborate. We will track CISA KEV additions and Talos's Q4 report, and we recommend clients confirm Cisco IOS XE web UI patch status and Quick Assist/RMM controls within the P1 window above. --- [Read the original source →](https://blog.talosintelligence.com/ir-trends-q3-2026/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*