← Artículos y guías sobre fraude, ciberseguridad, privacidad y PLD
Fake IT help desk calls and Teams vishing: the road to ransomware
Cisco Talos says fake IT help desk callers used phone, email and Teams to get remote access; ransomware hit 27% of Q3 2026 cases. How the attack works and fixes.
Cisco Talos' incident response trends report for Q3 2026, published October 30, found attackers posing as IT help desk staff by phone, email and Microsoft Teams to talk employees into opening remote-access sessions — in one case leading to ransomware, according to Talos.
How does the fake help desk attack work?
Attackers seemed to know little more than employee names and email addresses, and targets varied across organizations, suggesting they wanted any susceptible user, per Help Net Security. In the VYPR ransomware case, a vishing call got a user to start Microsoft Quick Assist; existing RMM software then ran PowerShell to install an MSI from a remote IP, followed by MeshAgent, Rclone and PsExec. Data was exfiltrated over several days.
Who is behind VYPR?
Talos calls VYPR new and operationally immature, built on leaked Conti-derived code. It used bring-your-own-vulnerable-driver (BYOVD) techniques to kill EDR, dropping an unusually large number of drivers. Established groups seen in the quarter included The Gentlemen, Qilin, Rhysida and Interlock.
Key Q3 2026 numbers
- Ransomware and pre-ransomware: 27% of engagements, up from a max of 20% in the prior four quarters.
- Phishing as initial access: 37% (over 50% in Q2); exploited public-facing apps: 33%.
- Finance and public administration tied as top sectors at 18% each.
- Insufficient logging in over 40% of cases; weak MFA in 33%.
How to defend
- Set a rule: IT never cold-calls asking you to open a remote session. Hang up and call back on the official line.
- Move to phishing-resistant MFA (FIDO2/WebAuthn, hardware keys) — see passkeys and MFA.
- Require help desk verification before self-service MFA enrollment.
- Restrict Quick Assist and RMM tools; label or block external Teams chats.
- Keep centralized logs for at least 90 days, and have an incident response plan.
More on ransomware trends and the radar.
Fuente
- Cisco Talos — IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks (30/10/2026)
- Help Net Security — Fake IT help desk callers got by on little more than names and email addresses (30/10/2026)