The IT help desk kindly requests you read this newsletter
Summary: Cisco Talos reports in its Threat Source newsletter that ransomware actors are impersonating IT staff when contacting victims and instructing them to install remote access software, which gives the attacker long-term access to the device. The newsletter also notes that attackers increasingly use living-off-the-land binaries already present on compromised systems, so detecting an intruder is no longer a matter of simply finding their malware.
What you should know: An attacker who calls your help desk posing as IT and gets a user to install remote access software holds that device for the long term, and with LOLBins in play, malware signatures alone will not surface the intrusion.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026