Search — “Interlock”

Cisco Talos IR's Q3 2026 trends report finds phishing (37%) and public-facing app exploitation (33%) led initial access; actors impersonated IT help desks via vishing to get victims to start Quick Assist/RMM sessions. VYPR ransomware operators used RMM-launched PowerShell to download an MSI, then MeshAgent, Rclone, PsExec and BYOVD to kill EDR; Interlock actors tried uninstalling Cisco Secure Endpoint, used taskkill/PsExec, disabled Defender and cleared logs. Salt Typhoon-linked actors exploited CVE-2023-20198 in web-based management interfaces, deploying BadCandy, creating privileged accounts and disabling logging. Hunt for Quick Assist sessions followed by RMM-spawned PowerShell/msiexec, taskkill against security processes, loads of known-vulnerable drivers, and new privileged accounts on network devices.