• Initial access: phishing 37% (down from over 50%), often vishing that impersonates IT and gets the user to open Quick Assist or an RMM tool; exploitation of public-facing apps 33%, mostly edge devices and management interfaces.
• Ransomware: 27% of engagements, up from at most 20% in the previous four quarters: The Gentlemen, Qilin, Rhysida, Interlock and a new, immature group, VYPR (Conti-derived code, no leak site at the time, many vulnerable drivers dropped to kill EDR, multi-day exfiltration with MeshAgent, Rclone, PsExec). Interlock tried to uninstall Cisco Secure Endpoint and has used malicious WDAC policies.
• Espionage: Salt Typhoon-linked telecom intrusions via valid credentials and CVE-2023-20198 on exposed IOS XE web UIs, with the BadCandy implant, new privileged accounts and disabled logging.
• AI: one insider hired under false credentials installed Copilot CLI and Claude Code with developer access; a trojanized macOS app scraped keychain items for Claude Code.
• Sectors: finance and public administration tied at 18%; healthcare fell to third.

Top weaknesses: insufficient logging (over 40%), poor secret handling (33%) and missing or weak MFA (33%). Talos recommends at least 90 days of central log retention, phishing-resistant MFA, and help-desk verification before MFA enrollment.