Threat video1:00
Salt Typhoon BadCandy Talos IR Q3 2026: Detection & IOCs
Talos puts ransomware in 27% of Q3 2026 engagements; Salt Typhoon hits telecoms via BadCandy. Includes 9 detection rules, 22 IOCs and a free Splunk SPL rule.
Read the full threat intel for Salt Typhoon BadCandy Talos IR Q3 2026: Detection & IOCs →
Chapters
- 0:00The hookRansomware at record high: 27% of engagements.
- 0:04The storyVishing impersonates IT help desks.
- 0:10Attack pathExploit CVE-2023-20198 on routers, create privileged accounts.
- 0:28AttributionAttributed to Salt Typhoon - G1045.
- 0:34Indicators of compromise6 indicators to hunt: 2 IPs, 1 URL and 2 file names, and more.
- 0:40MITRE ATT&CK techniques16 ATT&CK techniques, from initial access to exfiltration.
- 0:44Remediation5 steps now: Remove IOS XE web UI exposure to the internet.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Ransomware at record high: 27% of engagements.
0:05Vishing impersonates IT help desks.
0:07Salt Typhoon deployed BadCandy web shell.
0:11Exploit CVE-2023-20198 on routers, create privileged accounts.
0:19Vish for Quick Assist and deploy RMM.
0:22Disable EDR with vulnerable drivers.
0:25Exfil to cloud storage via Rclone.
0:29Attributed to Salt Typhoon - G1045. Confidence: high.
0:346 indicators to hunt: 2 IPs, 1 URL and 2 file names, and more.
0:4016 ATT&CK techniques, from initial access to exfiltration.
0:455 steps now: Remove IOS XE web UI exposure to the internet.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.