UAT-11764 (QR campaign, not attributed to a known group) · Sinobi operators · Warlock / Storm-2603high
Phishing is back on top, and it walks straight past MFA: what Talos saw last quarter
On 28 July 2026 Cisco Talos Incident Response published its second-quarter report. Two numbers capture the shift: phishing was the initial access vector in more than half of engagements (up from roughly a third the previous quarter), and authentication abuse appeared in 65% of cases against 35% before. In between sit QR-code PDFs that bypass mail gateways, adversary-in-the-middle proxies stealing session tokens, and ransomware operators using legitimate remote management tools instead of malware. The picture is consistent: no exploit walked in, a credential did.
Two numbers, one shift
Quarterly incident response reports have an advantage over threat intelligence write-ups: they do not describe what attackers might do, but what happened inside someone who then picked up the phone. On 28 July 2026 Cisco Talos Incident Response published its report for April to June. Two numbers frame it.
Phishing is the top initial access vector again, and not out of nostalgia: because it got more effective. Talos lists how attackers defeated or bypassed multi-factor authentication in these engagements: adversary-in-the-middle proxies with session-token theft, MFA fatigue attacks, registration of attacker-controlled devices as a factor, and legacy authentication protocols that skip MFA entirely.
That point deserves isolating, because it contradicts a widespread belief: turning MFA on is not a box you tick once. Talos explicitly recommends moving from push- and SMS-based MFA to phishing-resistant methods — FIDO2/WebAuthn and hardware keys — alongside restricting self-service MFA enrolment behind helpdesk verification and blocking legacy authentication through Conditional Access.
The PDF with the QR code
Since April, Talos has tracked a QR-code phishing campaign, still running in late June, hitting mostly Australian organisations. The mechanism is cheap and well built: auto-generated, victim-tailored PDFs containing a QR code that leads to attacker-controlled Microsoft 365 credential harvesting pages.
If the credentials work, the attacker gets into the account and does three things: creates inbox rules to hide traces, uses SharePoint to host malicious documents, and sends further internal and external phishing mail using the contact list of the mailbox just taken. The campaign funds itself: every compromised mailbox is fuel for the next. Talos attributes the activity to an actor it calls UAT-11764 and assesses with high confidence that it will continue.
The defensive takeaway is specific and implementable: Talos recommends policies that block or flag emails containing QR codes inside PDF attachments, phishing-resistant MFA on M365 accounts, and monitoring for suspicious inbox rule creation and anomalous SharePoint file staging.
Ransomware that brings no malware of its own
The part of the report that changes what you hunt for is the tooling. Talos responded to Sinobi for the first time — a ransomware-as-a-service operation active for nearly a year with very little public reporting. As their command-and-control channel, the operators used a trojanized MeshAgent binary: MeshAgent is the open-source agent component of the MeshCentral remote management platform, weaponised here into a durable backdoor installed as a SYSTEM-level auto-start service, communicating over encrypted WebSocket to an attacker-controlled server.
The advantage, for the attacker, is statistical: that traffic looks like legitimate remote administration. Talos reports the access went undetected for roughly three days before ransomware deployment. The rest of the chain is ordinary and instructive precisely for that: lateral movement over RDP and WinRM using a service account with a weak password pulled from the domain credential store ntds.dit; domain-wide ransomware deployment via a GPO logon script; exfiltration staging with rclone.exe; files encrypted with the .SINOBI extension.
In another engagement, Warlock operators (also tracked as Storm-2603) installed Zoho Assist Unattended Agent, a remote management tool designed to control an endpoint with no user logged in. That case did not reach encryption, but the technique had not previously been attributed to the group.
- 01No new malware to detectthe agent is a legitimate, signed product
- 02Traffic looks like administrationencrypted WebSocket to an external server
- 03Defence changes shapefrom signatures to behaviour and allowlisting
Who gets hit, and why
For the second quarter running, healthcare is the most targeted vertical at 17% of engagements; public administration and manufacturing follow at 14% each. Talos identifies the shared trait, and it is not wealth: it is very low downtime tolerance. Almost all targeted healthcare organisations directly supported clinical or diagnostic operations; in public administration they were nearly all local governments; in manufacturing, links inside industrial supply chains.
Two structural weaknesses complete the picture, and they are the ones you can work on without buying anything. First, insufficient logging, present in 42% of engagements against 18% the previous quarter — domain controller logs kept for hours, host logs overwritten before collection, absent NetFlow, cloud telemetry too short to reach the true initial-access date. In several engagements this prevented determining how they got in. Talos gives an operational benchmark: centralised logging with at least 90 days of retention, forwarded off-device. Second, unlimited outbound email thresholds, which in almost 15% of engagements let the attack propagate — in one case more than 6,600 phishing emails sent from a single compromised mailbox shortly after credential theft.
ATT&CK techniques, copied from the report
Talos publishes the table of observed techniques. We reproduce only those in the document, without inferring others: T1566 Phishing and T1078 Valid Accounts for initial access; T1564.008 Hide Artifacts: Email Hiding Rules as the most observed persistence technique; T1534 Internal Spearphishing for lateral movement; T1219 Remote Access Software for command and control; T1111 Multi-Factor Authentication Interception and T1621 Multi-factor Authentication Request Generation for credential access; T1486 Data Encrypted for Impact for impact.
One caveat on the sample: these are the engagements of one incident response firm in one quarter, not a measurement of the whole landscape. The direction, though, is consistent with Q4 2025 and Q1 2026, and it matches what recent dossiers keep showing: the technology perimeter holds better than it used to, and the attack has moved to identity.
