# Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198

> Cisco Talos IR Q3 2026 reports ransomware/pre-ransomware at 27% of engagements (up from a prior four-quarter maximum of 20%), with phishing (37%) and public-facing application exploitation (33%) as leading initial access vectors and vishing impersonating IT help desks increasingly prevalent. Salt Typhoon was observed exploiting CVE-2023-20198 and deploying the BadCandy web shell against the telecommunications sector.

- **Published:** 2026-11-01T09:22:43Z
- **Last reviewed:** 2026-11-01T09:22:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4980
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4980.png
- **ID:** TL-2026-4980
- **Severity:** HIGH (CVSS 10)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Salt Typhoon - G1045 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (2 shown free below)
- **CVEs:** CVE-2023-20198, CVE-2023-20273

## Description

Cisco Talos Incident Response's Q3 2026 trends report (published 2026-10-29) summarizes engagement data. Ransomware and pre-ransomware activity accounted for 27% of engagements, up from a maximum of 20% over the previous four quarters. Phishing was the initial access vector in 37% of engagements (down from over 50% the prior quarter) and exploitation of public-facing applications accounted for 33%. Financial and public administration each made up 18% of targeted sectors; healthcare fell to third after leading the previous two quarters. Recurring weaknesses were insufficient logging (over 40% of engagements), improper credential/secret management (33%) and missing or insufficient MFA (33%).

A prominent technique was vishing in which actors impersonate the IT help desk and coach victims into granting remote access, using Microsoft Quick Assist and other legitimate RMM tooling. In the VYPR ransomware intrusion, the chain was vishing, a Quick Assist session, RMM software, a PowerShell-executed MSI download and install, EDR disablement through vulnerable drivers (BYOVD), and tools including MeshAgent, Rclone, PsExec, an IP scanner and MSTSC. VYPR is described as new and operationally immature: it had no data leak site at the time of the engagement, reused older leaked Conti-derived source code with minimal changes, and ran an extended exfiltration phase while the operators experimented. Other ransomware families named in the report are The Gentlemen, Qilin, Rhysida and Interlock (closed group model). Defense evasion in these engagements included malicious WDAC policies used to stop EDR, BYOVD, PsExec/taskkill termination of security processes, attempts to uninstall Cisco Secure Endpoint, disabling Windows Defender real-time protection, event log clearing, and scheduled tasks for persistence. Multi-day exfiltration to cloud storage was observed, which is atypical for ransomware.

Talos attributes with high confidence a telecommunications-sector espionage campaign to the China-affiliated Salt Typhoon. The actor exploited CVE-2023-20198 in the Cisco IOS XE web UI on public-facing management interfaces, combined with valid credentials, and deployed the BadCandy web shell for persistent access. Post-compromise activity included creating privileged accounts, disabling logging, altering configurations and blending with normal administrative operations. Legacy management protocols (plaintext SNMP, outdated VPN encryption), password-only authentication and weak credential management enabled the activity. Per Talos's 2023 advisory, CVE-2023-20198 gives unauthenticated attackers privilege-15 access and local account creation, and CVE-2023-20273 was chained for root command injection; BadCandy is a non-persistent 29-line Lua implant at /usr/binos/conf/nginx-conf/cisco_service.conf. The Australian Signals Directorate reported BADCANDY activity on Australian devices since July 2025. Public reporting additionally describes Salt Typhoon using GRE tunnels on compromised Cisco devices to collect traffic.

The report also notes emerging targeting of AI platform credentials: a trojanized macOS application scraped Anthropic Claude Code credentials from the macOS keychain, and an insider with false credentials used privileged access to install GitHub Copilot CLI and Claude Code. The report's MITRE appendix lists GoGRPC RAT (fly.exe), Node RAT, BadCandy, Overlord RAT, SideSlipRAT, Impacket SMBexec, MeshAgent, Rclone, PsExec, MSTSC and Rundll32. The article provides no IP, hash or domain IOCs of its own; network and host indicators below come from Talos's 2023 IOS XE advisory and are historical.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.004 Phishing: Spearphishing Voice
- T1078 Valid Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1569.002 System Services: Service Execution
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1218.011 System Binary Proxy Execution: Rundll32
- T1555.001 Credentials from Password Stores: Keychain
- T1021.001 Remote Services: Remote Desktop Protocol
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Cisco IOS XE CVE-2023-20198 Exploitation - Rogue Accounts, Web UI Install Operations and Talos IOC Sources** (`TL-2026-4980-SPL-001`)

Detects exploitation of CVE-2023-20198 (Cisco IOS XE web UI, Salt Typhoon / BadCandy) in IOS XE syslog: creation or use of the rogue local accounts cisco_tac_admin, cisco_support and cisco_sys_manager, any reference to the Talos 2023 suspicious IPs 5.149.249.74 and 154.53.56.231, or a web UI login followed by a %WEBUI-6-INSTALL_OPERATION_INFO event on the same device. Unauthenticated privilege-15 access on an internet-exposed management plane is the entry point for the BadCandy Lua implant (TL-2026-4980).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1136.001, T1078
- **Data sources:** cisco_ios_xe_syslog, index=network sourcetype=cisco:ios, Syslog table (Microsoft Sentinel)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype="cisco:ios" earliest=-24h ("%WEBUI-6-INSTALL_OPERATION_INFO" OR "%SEC_LOGIN-5-WEBLOGIN_SUCCESS" OR "%SYS-5-CONFIG_P" OR "cisco_tac_admin" OR "cisco_support" OR "cisco_sys_manager" OR "5.149.249.74" OR "154.53.56.231")
| eval indicator=case(match(_raw,"cisco_tac_admin|cisco_support|cisco_sys_manager"),"rogue_account_CVE-2023-20198", match(_raw,"5[.]149[.]249[.]74|154[.]53[.]56[.]231"),"talos_ioc_ip", match(_raw,"WEBUI-6-INSTALL_OPERATION_INFO"),"webui_install_operation", match(_raw,"SEC_LOGIN-5-WEBLOGIN_SUCCESS"),"webui_login", true(),"config_change")
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators by host
| where isnotnull(mvfind(indicators,"rogue_account_CVE-2023-20198")) OR isnotnull(mvfind(indicators,"talos_ioc_ip")) OR (isnotnull(mvfind(indicators,"webui_install_operation")) AND isnotnull(mvfind(indicators,"webui_login")))
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("%WEBUI-6-INSTALL_OPERATION_INFO", "%SEC_LOGIN-5-WEBLOGIN_SUCCESS", "%SYS-5-CONFIG_P", "cisco_tac_admin", "cisco_support", "cisco_sys_manager", "5.149.249.74", "154.53.56.231")
| extend Indicator = case(
    SyslogMessage has_any ("cisco_tac_admin", "cisco_support", "cisco_sys_manager"), "rogue_account_CVE-2023-20198",
    SyslogMessage has_any ("5.149.249.74", "154.53.56.231"), "talos_ioc_ip",
    SyslogMessage has "WEBUI-6-INSTALL_OPERATION_INFO", "webui_install_operation",
    SyslogMessage has "SEC_LOGIN-5-WEBLOGIN_SUCCESS", "webui_login",
    "config_change")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Indicators = make_set(Indicator) by Computer, HostIP
| where set_has_element(Indicators, "rogue_account_CVE-2023-20198") or set_has_element(Indicators, "talos_ioc_ip") or (set_has_element(Indicators, "webui_install_operation") and set_has_element(Indicators, "webui_login"))
| project FirstSeen, LastSeen, Computer, HostIP, EventCount, Indicators
```

### Sigma

```yaml
title: Cisco IOS XE CVE-2023-20198 Rogue Account or Web UI Install Activity
id: 3f7a1c52-8d4e-4b6a-9c21-5e0b7d4a1f01
status: experimental
description: Detects Cisco IOS XE logs referencing the rogue local accounts created via CVE-2023-20198 (cisco_tac_admin, cisco_support, cisco_sys_manager), the web UI install operation log event, or the Talos-reported suspicious source IPs. Associated with Salt Typhoon deployment of the BadCandy implant.
references:
  - https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
  - https://blog.talosintelligence.com/ir-trends-q3-2026/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/01
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
  - attack.persistence
  - attack.t1136.001
  - cve.2023.20198
logsource:
  product: cisco
  service: aaa
detection:
  keywords_rogue_account:
    - 'cisco_tac_admin'
    - 'cisco_support'
    - 'cisco_sys_manager'
  keywords_webui_install:
    - '%WEBUI-6-INSTALL_OPERATION_INFO'
  keywords_ioc_ip:
    - '5.149.249.74'
    - '154.53.56.231'
  condition: 1 of keywords_*
falsepositives:
  - Authorized administrators installing software packages through the IOS XE web UI
  - Legitimately named Cisco TAC support accounts provisioned by your organisation
level: high
```

**Known false positives:**

- Authorized administrators installing packages via the IOS XE web UI and then logging in the same day
- A legitimately provisioned account that happens to share a rogue account name such as cisco_support

**Tuning notes:** Restrict to IOS XE hosts via a lookup of management-plane devices, add change-window suppression for the webui_install_operation + webui_login pairing, and allowlist any sanctioned account that reuses a listed name. Talos IPs are historical (2023); treat matches as leads, not proof. Ensure logging buffered/host syslog forwarding is enabled so %WEBUI and %PARSER events reach the SIEM.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Help Desk Vishing - Quick Assist Session Followed by MeshAgent RMM Deployment (locked: unlock with TL Creds)
- EDR Disablement - Security Process Termination, Defender Tampering, Kernel Driver Services and WDAC Policy Drops (locked: unlock with TL Creds)
- Rclone Multi-Day Exfiltration to Cloud Storage (locked: unlock with TL Creds)
- BadCandy Implant Probe - [indicator] and logoutconfirm logon_hash Requests to IOS XE Web UI (locked: unlock with TL Creds)
- Windows Event Log Clearing and Suspicious Scheduled Task Persistence (locked: unlock with TL Creds)
- PowerShell MSI Download and Install, Remote msiexec and Rundll32 Proxy Execution from User-Writable Paths (locked: unlock with TL Creds)
- Cisco IOS XE Post-Exploitation - Privilege-15 Account Creation, GRE Tunnel and Logging Disablement (locked: unlock with TL Creds)
- Lateral Movement - PsExec, Impacket SMBexec Services and Non-Interactive MSTSC Launches (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 22)

Defanged, TLP:CLEAR.

- IP address: `5.149.249[.]74`
- IP address: `154.53.56[.]231`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases](https://blog.talosintelligence.com/ir-trends-q3-2026/)
- [Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerability (Talos)](https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/)
- [Cisco Security Advisory cisco-sa-iosxe-webui-privesc-j22SaA4z](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z)
- [NVD CVE-2023-20198](https://nvd.nist.gov/vuln/detail/CVE-2023-20198)
- [CISA Known Exploited Vulnerabilities Catalog entry for CVE-2023-20198](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20198)
- [ASD ACSC: BADCANDY implant on Cisco IOS XE devices](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/badcandy)
- [Cybersecurity Dive: Hackers implant BADCANDY on Cisco IOS XE devices](https://www.cybersecuritydive.com/news/hackers-cisco-ios-xe-devices-badcandy-implant/804753/)
- [Vulert: China-linked Salt Typhoon exploits Cisco CVE-2023-20198 to breach Canadian telecom](https://vulert.com/blog/salt-typhoon-critical-cisco-cve-2023-20198/)
- [Talos IR Trends Q2 2026](https://blog.talosintelligence.com/ir-trends-q2-2026/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4980