Status box
| Field | As of 31 October 2026 |
|---|---|
| Name | VYPR, the name Cisco Talos uses for the ransomware variant. Talos does not say whether it comes from the ransom note, the file extension or the actor's own branding. No APT number, CrowdStrike name or Microsoft name exists for the operators. |
| Classification | Emerging ransomware variant with unidentified operator(s). Talos's own wording is "operator(s)", so even the number of hands is open. |
| Code lineage | Older leaked Conti-derived source code with minimal modifications, in Talos's assessment. Lineage of the code, not continuity of the people. |
| Evidence base | One Talos Incident Response engagement in Q3 2026 (1 July to 30 September), published on 29 October 2026. TIR found no second vendor investigation, incident-response write-up or government notice on 31 October 2026. |
| Leak site | None referenced in the ransom note; Talos says the associated leak-site infrastructure was created after the engagement. |
| Confidence | High that the behaviours below occurred in that engagement (first-hand vendor observation). Low for any generalisation to other intrusions. |
Current assessment, 31 October 2026
Talos's Q3 2026 incident-response review, published on 29 October, is the only primary account of VYPR. It describes one engagement: remote assistance obtained by a phone call, an MSI delivered through remote-management software, exfiltration spread over several days, an unusually large set of vulnerable drivers used to disable endpoint protection, and a Conti-derived encryptor. Talos assesses the variant as relatively new and operationally immature. Talos Q3 2026 review
TIR assessment: this is a single-case profile and should be read as one. The useful content is the sequence of mechanisms, each of which a defender can test for independently. Nothing in the evidence supports a nationality, an affiliate programme, a victim count or a standard playbook, and Talos's point is that there was no playbook: the operators were trying things.
What changed
Research was checked on 31 October 2026. Since Talos published, no further primary reporting has appeared: no second vendor investigation, incident-response write-up or government notice. Leak-site aggregators and vendor statistical round-ups mention the name, but they relay criminal claims rather than investigate them, and this profile does not use them for a victim count or a chronology.
This version also adds a mechanism reference for Quick Assist and a mitigation reference for vulnerable drivers. Both are Microsoft documentation about the technique, not evidence about VYPR.
Operations timeline
| When | What | Basis |
|---|---|---|
| Within Q3 2026 (exact date not stated) | Vishing call; the user starts a Quick Assist session; the actor has remote access to the endpoint | Talos, first-hand |
| Same engagement | Existing RMM software executes PowerShell that downloads and installs an MSI package from a remote IP address | Talos, first-hand |
| Same engagement | MeshAgent, Rclone, PsExec, an IP scanner and MSTSC are used | Talos, first-hand |
| Over several days | Data exfiltration, with different exfiltration parameters tested | Talos, first-hand |
| Same engagement | Multiple vulnerable drivers deployed to disable EDR and antivirus; ransomware executed | Talos, first-hand |
| After the engagement | Leak-site infrastructure created; the ransom note had referenced none | Talos, first-hand |
| 29 October 2026 | Talos publishes the Q3 review | Publication date |
Talos gives no engagement date, no victim sector or geography, no ransom-note text, no file extension, no driver names, no RMM product name and no indicators for VYPR. Talos Q3 2026 review
Observed intrusion chain
Access by remote assistance
The actor gained access through voice phishing: the user was tricked into initiating a Microsoft Quick Assist session, which gave the actor remote access to the endpoint. Talos did not confirm the pretext in this case. It notes that help-desk impersonation during vishing calls appeared in several other Q3 engagements, which is context, not a finding about VYPR. Talos Q3 2026 review
Microsoft's May 2024 description of Quick Assist misuse explains what the user actually does in such a session: press Ctrl + Windows + Q, enter a security code supplied by the caller, approve screen sharing, then approve a Request Control prompt that gives the helper full control. That report concerns Storm-1811 and Black Basta; it is cited here only for the mechanism and the telemetry, and it is not evidence of any link to VYPR. Microsoft Quick Assist report
Remote management and MSI delivery
Talos says the actor was then able to use existing RMM software, which executed PowerShell commands to download and install an MSI package from a remote IP address. The word "existing" is Talos's; it does not say whether the RMM was the organisation's own deployment or something the actor introduced during the session, nor what the MSI contained. MeshAgent appears in the tool list and remote-access agents are often delivered as installer packages, but treating it as the MSI payload is a hypothesis for responders to test, not a reported fact. Talos Q3 2026 review
Tooling, exfiltration and encryption
The tools Talos names are common in ransomware investigations: MeshAgent, Rclone, PsExec, an IP scanner and Microsoft Terminal Services Client (MSTSC). Two things were not common. Exfiltration ran over multiple days, which Talos says it rarely sees in ransomware cases, and the actor took an unusually long time to exfiltrate and encrypt while testing different exfiltration parameters. Talos does not report the destination, the volume or the parameters that were tried. Talos Q3 2026 review
Defence impairment
EDR and antivirus were disabled with Bring Your Own Vulnerable Driver (BYOVD) techniques before the ransomware ran. Talos's distinctive observation is quantity: an unusually large number of vulnerable drivers in the environment, possibly to build redundancy and raise the chance that at least one worked. The drivers are not named. Talos Q3 2026 review
ATT&CK mapping
TIR mapping against reported behaviour. "Observed" means Talos describes the behaviour; "inferred" means the technique follows from a named tool and was not described.
| Technique | Basis |
|---|---|
| T1566.004 Phishing: Spearphishing Voice | Observed (vishing) |
| T1219 Remote Access Tools | Observed (Quick Assist, RMM, MeshAgent) |
| T1059.001 PowerShell | Observed |
| T1105 Ingress Tool Transfer | Observed (MSI from a remote IP) |
| T1218.007 System Binary Proxy Execution: Msiexec | Inferred from MSI installation |
| T1046 Network Service Discovery / T1018 Remote System Discovery | Inferred from the IP scanner |
| T1021.001 Remote Desktop Protocol | Inferred from MSTSC |
| T1569.002 Service Execution | Inferred from PsExec |
| T1562.001 Impair Defenses: Disable or Modify Tools | Observed (EDR and AV disabled) |
| T1068 Exploitation for Privilege Escalation | Inferred: Talos reports BYOVD used to disable EDR and AV; kernel-level escalation is the technique's general mechanism, and no driver or exploit detail is given |
| T1048 or T1567.002 Exfiltration | Observed exfiltration; destination not reported, so the sub-technique is open |
| T1486 Data Encrypted for Impact | Observed |
Targeting
Talos reports no sector, size or country for the VYPR victim. Its quarter-wide sector figures (finance and public administration tied at 18 percent, health care third) describe all Q3 engagements and must not be assigned to VYPR. Tracker-listed claims are discussed under open questions. Talos Q3 2026 review
Actor assessment: code lineage is not operator continuity
Talos's immaturity assessment rests on three observations: no leak site in the ransom note, with the infrastructure appearing only after the engagement; reliance on older leaked Conti-derived source with minimal changes; and experimentation in place of a refined playbook. Talos Q3 2026 review
TIR assessment: leaked Conti source has been reused by unrelated operations since it became public, so building on it says something about the operators' development effort and nothing about who they are. Nobody has published a victim census, a recruitment post, a negotiation transcript or an affiliate structure for VYPR, and Talos itself hedges with "operator(s)". Treat VYPR as a label on an encryptor and a leak site, not as a known crew. Inexperience is not a control: the engagement still reached multi-day data theft and encryption.
Persistence and dwell-time limits
Multi-day exfiltration is a lower bound on activity, not a dwell-time measurement. Access could have begun before the first transfer and persisted after encryption. Talos reports no VYPR-specific persistence mechanism; its quarter-wide findings on web shells and scheduled tasks are not attributed to this actor. Kernel access through a vulnerable driver is defence impairment, not evidence of firmware or UEFI persistence, and a slow intrusion is not evidence of pre-positioning or state direction. Talos Q3 2026 review
TIR assessment: closing the Quick Assist session removes one access path. The RMM channel, MeshAgent, any credentials exposed during the session and any RDP reach established with MSTSC each need their own evidence of removal.
Detection opportunities
Illustrative and untested; validate against local telemetry before relying on any row. The quarter-wide weakness Talos saw most often was insufficient logging (over 40 percent of engagements), so the first check is whether these logs exist at all. Talos Q3 2026 review
| Behaviour | Telemetry and where it lives | Assumptions | Likely false positives |
|---|---|---|---|
| Quick Assist session | Process creation for the Quick Assist app (EDR or Sysmon event 1). Microsoft Defender for Endpoint raises "Suspicious activity using Quick Assist". | Quick Assist is not a sanctioned support tool, or sessions are logged against tickets | Genuine IT or Microsoft support sessions |
| RMM agent spawning PowerShell that installs an MSI | Process trees: RMM service as parent, PowerShell with a download command, msiexec with an HTTP or IP-literal source (Security 4688 with command line, Sysmon 1); MsiInstaller events 1033 and 1040 in the Application log | Command-line auditing is on; RMM activity is attributable to a technician | Legitimate software deployment through the RMM |
| New remote-access agent | System log 7045 for a Mesh Agent service; new persistent outbound TLS to an unrecognised server | An inventory of approved remote-access agents exists | Authorised MeshCentral deployments |
| Sustained exfiltration | Rclone execution, including renamed binaries (Sysmon OriginalFileName); an rclone configuration file; proxy or firewall egress per host compared day over day | Egress volume baselines by host | Backup agents and cloud sync clients |
| PsExec and RDP movement | PSEXESVC service creation (7045) and named pipes (Sysmon 17 and 18); 4624 logon type 10 on targets from a user workstation | Admin tooling is restricted to admin hosts | Administrators who use the same tools |
| Internal scanning | One host opening connections to many internal addresses on common ports in a short window (firewall, flow or EDR network events) | Scanning from workstations is unusual | Vulnerability scanners and monitoring |
| Multiple vulnerable drivers | Sysmon event 6 driver loads; 7045 for kernel-driver services; CodeIntegrity audit or block events where a driver blocklist is applied; several new kernel drivers on one host within hours; EDR sensor heartbeat loss and tamper-protection events | Driver-load telemetry is forwarded off host before the agent dies | Hardware utilities and overclocking tools |
The redundancy Talos describes is itself the signal: one host receiving several new kernel drivers in a short period is rare in normal administration, whatever the individual driver hashes.
Mitigation and recovery
- Remote assistance. Microsoft recommends blocking or uninstalling Quick Assist and other remote-management tools that are not in use, and notes it is installed by default on Windows 11. Where Intune Remote Help is used, block Quick Assist. Give staff a known channel to verify a support call before any session starts. Microsoft Quick Assist report
- Vulnerable drivers. Microsoft's vulnerable driver blocklist is on by default since the Windows 11 2022 update and is enforced wherever memory integrity (HVCI), Smart App Control or S mode is active. The blocklist is refreshed quarterly and through monthly updates; the newest version can be applied as an App Control policy, in audit mode first. The ASR rule that blocks abuse of exploited vulnerable signed drivers stops a driver being written to disk but not one already present; a reboot is needed before an already-loaded driver is blocked. Microsoft driver block rules
- Logging. Talos's quarter-wide recommendation is centralised logging with at least 90 days of retention, forwarded off device, with process-creation and command-line auditing. For this chain it is what preserves the RMM-to-PowerShell-to-MSI tree after the endpoint agent is killed. Talos Q3 2026 review
- Recovery. Enumerate every access mechanism: the Quick Assist session, the RMM channel, MeshAgent, RDP paths and credentials used during the session. Rotate from trusted systems. Confirm endpoint protection is running and reporting, and remove any vulnerable drivers before trusting the host. Treat the multi-day transfers as data theft for notification purposes even though the ransom note named no leak site; Talos saw the site appear afterwards.
Open questions
- When within Q3 2026 was the engagement? Talos does not say, beyond placing it in the quarter and the leak site after it. No primary source dates it more precisely.
- Whose RMM? Was the "existing" RMM the victim's own tool, and was the MSI a MeshAgent installer? Both are testable in the victim's telemetry and neither is reported.
- Which drivers? Talos names none. Whether they are already on Microsoft's blocklist determines how much the default control would have helped.
- Where did the data go, and what was being tested? Destination, volume and the "parameters" are unreported.
- Are the tracker-listed claims real? Any victim listings on the leak site are criminal claims. None had been confirmed by a victim statement or a second investigation when this profile was researched.
- How much of Conti survives? No sample, extension or note has been published. A public sample would allow the "minimal modifications" assessment to be checked.
- One team or several? Talos's "operator(s)" leaves this open. The profile will not assume an affiliate model until one is evidenced.
Related TIR coverage
Talos's Q3 review also names The Gentlemen, Qilin, Rhysida and Interlock; it does not connect them to VYPR. See the The Gentlemen, Qilin and Rhysida profiles and the Interlock Cisco FMC article. For help-desk impersonation as an access method, see Black Basta, Teams help-desk impersonation and UNC6671 help-desk vishing. For defence impairment and recovery, see The Gentlemen: remote access and defence impairment. None of these pages is evidence about VYPR.
Sources
- Cisco Talos, IR trends Q3 2026, 29 October 2026. Talos Q3 2026 review
- Microsoft Threat Intelligence, Threat actors misusing Quick Assist in social engineering attacks leading to ransomware, 15 May 2024 (updated June 2024). Mechanism and telemetry reference only. Microsoft Quick Assist report
- Microsoft Learn, Microsoft recommended driver block rules, last updated 4 May 2026. Mitigation reference only. Microsoft driver block rules
Version history
Version 1 — 31 October 2026: initial profile from the single Talos engagement. Preserves the engagement's limits; separates Conti code lineage from operator continuity; adds the access-to-encryption sequence, an observed-versus-inferred ATT&CK mapping, telemetry-level detection rows, Quick Assist and driver-blocklist mitigations, and a dated search showing no second primary report. Leak-site tracker claims are held as open questions, not findings.