Analyzing Q3 2026 Incident Response Trends and EDR Killers

Security teams reviewing Q3 2026 incident metrics face an evolving threat landscape defined by the direct neutralization of endpoint defences and the convergence of social engineering with legitimate remote management tools. According to Cisco Talos incident response data, while traditional email-based phishing dropped from over fifty percent to just over one-third of all engagements, threat actors successfully pivoted to sophisticated voice phishing paired with IT help desk impersonation. At the same time, exploitation of public-facing applications matched phishing at 33 percent, underscoring the relentless targeting of enterprise edge infrastructure.

This period also exposed a dangerous shift in ransomware operations: rather than merely evading detection, groups such as Interlock and the emerging VYPR variant actively destroyed host-level security controls through kernel-level driver abuse and targeted service termination. Concurrently, state-sponsored espionage campaigns by actors like Salt Typhoon demonstrated how Living-off-the-Land techniques and unpatched management interfaces enable months of undetected persistence. Analysing these incident response trends requires a rigorous examination of defensive blind spots across edge devices, endpoint controls, and foundational logging architecture.

Evolving Initial Access Vectors and Edge Device Exploitation

The mechanics of initial access underwent a structural shift during the third quarter of 2026. While phishing retained the top spot, appearing in slightly over one-third of Talos IR engagements, its composition changed. Adversaries increasingly supplemented or replaced bulk credential harvesting with targeted voice phishing (vishing). In these scenarios, attackers impersonated internal IT help desk personnel, manipulating victims into granting remote access via legitimate Remote Monitoring and Management (RMM) software. This blending of social engineering with trusted administrative tooling allows attackers to bypass baseline behavioral alerts that typically trigger on anomalous remote desktop connections.

Simultaneously, the exploitation of public-facing applications surged to account for 33 percent of all engagements. Threat actors concentrated their efforts on enterprise edge devices—specifically security gateways, virtual private network terminators, and remote network management interfaces. These appliances sit at the perimeter, handling authentication states and traffic inspection. Compromising them grants adversaries broad access to internal network segments without requiring credential theft.

Espionage Campaigns and Living-off-the-Land Tactics

Prolonged cyber espionage operations during Q3 2026 highlighted the tenacity of state-sponsored groups targeting critical infrastructure. Cisco Talos attributed several intrusions within the telecommunications sector to China state-sponsored threat actors, including Salt Typhoon. These campaigns relied heavily on valid credentials and the exploitation of known vulnerabilities in publicly accessible web-based management interfaces, most notably CVE-2023-20198.

Once inside the perimeter, adversaries deployed advanced implants such as the BadCandy web shell to secure persistent, low-profile remote access. Rather than introducing novel custom malware, these threat actors predominantly relied on Living-off-the-Land (LotL) tactics. They abused native network features including VPN access, traffic mirroring, and standard management protocols to perform internal reconnaissance and data exfiltration. Attackers routinely created privileged local accounts, altered appliance configurations, and disabled local logging mechanisms. By operating within the parameters of legitimate administrative traffic, they successfully masked their telemetry among normal operational noise.

The success of these espionage intrusions exposed foundational architectural weaknesses across target networks. Environments frequently lacked multi-factor authentication for administrative interfaces, relied on legacy protocols such as plaintext SNMP and outdated VPN ciphers, and maintained lax credential management policies. Without compensating controls or immutable audit logs, adversaries maintained stealthy access for extended periods.

Ransomware Evolution: VYPR, Interlock, and RaaS Shifts

Ransomware and pre-ransomware incidents rebounded to 27 percent of all Talos IR engagements in Q3 2026, up from a maximum of 20 percent over the preceding four quarters. The threat ecosystem divided into two distinct operational models: highly refined Ransomware-as-a-Service groups such as The Gentlemen, Qilin, and Rhysida, and closed-membership syndicates like Interlock. Alongside these established actors, analysts tracked the emergence of the VYPR ransomware variant.

VYPR exhibited characteristics of operational immaturity. The group lacked an established data leak site at the time of initial attacks, publishing infrastructure only after engagements concluded. Technical analysis revealed that VYPR operators relied on older, Conti-derived source code with minimal modifications. Their operational cadence reflected experimentation rather than a streamlined playbook: exfiltration and encryption unfolded over multiple days while operators tested various parameters and deployed multiple vulnerable drivers. Initial access for VYPR typically began with vishing attacks that tricked users into starting Microsoft Quick Assist sessions, which subsequently enabled the installation of malicious payloads via downloaded MSI packages and RMM utilities such as MeshAgent.

Sector targeting also shifted during this period. Financial institutions and public administration sectors tied as the most targeted industries at 18 percent each. While financial entities remain lucrative, sustained investment in security posture often mitigates impact, leaving public administration — which has featured in top targeting tiers for four consecutive quarters — exposed due to resource constraints. Healthcare dropped to third place after leading the two previous quarters.

Anatomy of EDR Neutralisation via BYOVD and Process Termination

A defining characteristic of Q3 ransomware engagements was the deliberate focus on disabling endpoint detection and response systems before deploying encryption payloads. Attackers recognized that evading telemetry is insufficient when behavioral analysis can trigger automated isolation; consequently, they turned to direct destruction of security controls.

Interlock ransomware operators executed multi-pronged attacks against host defenses. Investigators observed Interlock actors attempting to uninstall Cisco Secure Endpoint directly from compromised hosts. When uninstallation failed, they utilised tools such as PsExec.exe and taskkill.exe to terminate critical security services and operating system integrity checkers, including cscm.exe and sfc.exe. Furthermore, adversaries disabled Windows Defender real-time protection and cleared event logs to impede forensic triage. Previous reporting indicates that Interlock has also deployed malicious Windows Defender Application Control (WDAC) policies specifically engineered to block security tooling.

In the VYPR engagements, threat actors bypassed antivirus and EDR agents by deploying Bring Your Own Vulnerable Driver techniques. By leveraging flawed, signed drivers, the operators gained kernel-level execution rights to strip security software of its monitoring capabilities. Uniquely, VYPR operators deployed an unusually high volume of distinct vulnerable drivers during single engagements, demonstrating redundancy-seeking behaviour designed to ensure at least one driver successfully executed its destabilising routine.

Emerging Attack Surfaces: AI Platforms and Developer Tools

The quarter also introduced new risk vectors stemming from the enterprise adoption of artificial intelligence development tools. Cisco Talos investigators examined an insider threat incident where an individual hired under false credentials abused privileged access to deploy and configure advanced AI developer frameworks, including GitHub Copilot CLI and Anthropic Claude Code. While the investigation found no immediate data exfiltration, the presence of developer-level repository access and database connectors highlights the risk of granting automated execution tools broad internal privileges.

In a separate incident investigated by Talos, threat actors compromised a macOS endpoint via a trojanized application designed specifically to scrape credentials from the system keychain. The malicious script targeted authentication tokens and API secrets associated with the Anthropic Claude Code assistant. This targeting of AI-specific developer credentials represents an emerging trend: adversaries increasingly seek out tokens tied to automated platforms that hold keys to downstream cloud resources, proprietary repositories, and extended enterprise APIs.

These incidents establish that AI development platforms must be governed with the same rigour applied to production infrastructure credentials. Organisations must extend multi-factor authentication, strict secret management, and continuous logging to cover AI tooling and developer assistants.

Addressing Core Security Weaknesses: Logging, MFA, and Secrets

Underlying technical analysis of Q3 incidents reveals that advanced attacks succeed not due to novel zero-day exploits, but because of persistent foundational security gaps. Three primary weaknesses dominated Talos IR engagements:

• Insufficient Logging and Visibility Gaps: Present in over 40 percent of engagements. These gaps stemmed from a combination of inadequate log retention policies, disabled audit configurations, and active log deletion by threat actors using utilities like taskkill.
• Improper Credential and Secret Management: Observed in 33 percent of engagements. Common failures included storing plaintext credentials in browser password stores, enabling browser autofill, and widespread password reuse across accounts.
• Absent or Inadequate MFA: Present in 33 percent of engagements. Many victim environments relied entirely on single-factor authentication, failed to enforce MFA for privileged access, or left legacy authentication protocols enabled.

Without centralised, immutable logging, incident responders struggle to reconstruct attack timelines or verify the scope of data exfiltration. Similarly, when legacy protocols remain active alongside weak password policies, multi-factor authentication controls can be bypassed entirely.

Engineering Remediation: Hardening Architecture Against Modern TTPs

Mitigating the trends observed in Q3 2026 requires moving beyond compliance checklists toward resilient architectural engineering. Security teams must systematically address logging pipelines, authentication boundaries, and endpoint control integrity.

Centralising and Protecting Audit Logs

To defeat attacker log tampering, organisations must decouple log generation from local host storage. Implement a centralised SIEM or log management platform enforcing a strict minimum retention period of 90 days. Configure all servers, endpoints, network gear, cloud identity providers, and security appliances to forward logs off-device in real time.

# Test in staging: Example Windows PowerShell audit policy hardening
Auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
Auditpol /set /subcategory:"Special Group Logon" /success:enable /failure:enable
Auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable

Ensure that command-line auditing (Event ID 4688 with command-line argument logging enabled) and PowerShell script block logging (Event ID 4104) are active across the fleet. Off-device forwarding ensures that even if an adversary executes log-clearing scripts or rebuilds a host, the forensic record remains intact in the SIEM.

Enforcing Phishing-Resistant Authentication

Transition authentication controls away from vulnerable SMS and push notifications toward phishing-resistant standards. Enforce FIDO2/WebAuthn hardware security keys for all high-privilege administrative accounts and developer environments. Utilise Conditional Access policies to block legacy authentication protocols (such as IMAP, POP3, and older Exchange Web Services) which bypass modern MFA challenges.

Secret Management and Credential Hygiene

Eliminate browser-based credential storage and autofill via Group Policy or Mobile Device Management (MDM) profiles. Mandate enterprise password managers for all personnel to enforce unique, complex passwords across every service. Establish automated secret rotation for API keys, service accounts, and database credentials, and implement continuous scanning repositories for accidentally committed secrets.

Key Takeaways for Technical Leaders

The threat data from Q3 2026 demonstrates that security strategy must evolve alongside attacker methodologies. The primary vector of risk has shifted from passive credential theft to active, aggressive security control destruction via BYOVD and driver-level tampering. Engineering teams cannot rely solely on signature-based EDR agents to maintain safety; they must harden the underlying host kernel, restrict administrative tools, and enforce strict application controls.

Furthermore, the convergence of social engineering with legitimate remote management utilities highlights that human-targeted attacks remain exceptionally potent. Protecting the enterprise requires prioritizing foundational hygiene—immutable logging, hardware-token MFA, and rigorous asset visibility across edge devices and AI development platforms—over complex, unverified auxiliary controls. By closing these foundational gaps, engineering leadership can drastically reduce the dwell time and impact of modern intrusions.

Frequently asked questions

What initial access vectors dominated Q3 2026 incident response engagements?

Phishing remained the leading initial access vector, appearing in slightly over one-third of Cisco Talos engagements, though it was closely matched by the exploitation of public-facing applications at 33 percent. Phishing operations increasingly incorporated voice phishing (vishing) alongside IT desk impersonation to trick victims into establishing remote access sessions. Simultaneously, attackers targeted enterprise edge devices such as security gateways and remote management interfaces to gain initial network entry.

How do ransomware operators bypass EDR systems using BYOVD techniques?

Bring Your Own Vulnerable Driver attacks involve threat actors loading legitimate, cryptographically signed third-party drivers that contain known vulnerabilities into the Windows operating system kernel. Because the drivers carry valid signatures, the OS permits them to load. Once inside ring 0, attackers exploit the flaws in these drivers to directly manipulate kernel memory, effectively stripping EDR minifilter drivers and kernel callbacks of their monitoring capabilities before deploying encryption payloads.

What role did CVE-2023-20198 play in recent cyber espionage campaigns?

CVE-2023-20198 is a vulnerability affecting publicly accessible web-based management interfaces. State-sponsored threat actors, including Salt Typhoon, leveraged this flaw alongside valid credentials to gain initial access to telecommunications sector networks. Once inside, attackers used this access to deploy web shell implants like BadCandy, create privileged local accounts, alter configurations, and disable logging to maintain persistent, stealthy remote access.

What are the primary logging requirements recommended to prevent log tampering?

To ensure audit logs survive host compromises and tampering, organisations must implement a centralised SIEM or logging platform with a minimum retention period of 90 days. Logs from servers, workstations, network appliances, and cloud identity providers must be forwarded off-device in real time. Organisations should also enable comprehensive process creation auditing, command-line logging, and PowerShell script block auditing.