HighRansomware
IT threat evolution in Q3 2026. Non-mobile statistics
Securelist (Kaspersky)·Source published ·1 min read
What happened?
IT threat evolution in Q3 2026. Non-mobile statistics IT threat evolution in Q3 2026. Mobile statistics The statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated. The information was provided by Kaspersky users who consented to sharing statistical data. Quarterly figures In Q3 2026: Kaspersky products blocked more than 311 million attacks launched from online resources. Web Anti-Virus responded to 47 million unique links. File Anti-Virus blocked more than 23 million malicious and potentially unwanted objects.
Key details
- Kaspersky products blocked over 311 million web-based attacks and 47 million unique malicious URLs in Q3 2026.
- File Anti-Virus stopped more than 23 million malicious and potentially unwanted objects during the quarter.
- Researchers reported Qilin group exploiting CVE-2026-0257 in Palo Alto Networks firewalls to bypass authentication.
- CISA added several actively exploited vulnerabilities to its KEV catalog, including flaws in SonicWall, SharePoint, Windows, VMware, WatchGuard, and JetBrains TeamCity.
- Ransom Cartel creator sentenced to 16 years; Ryuk member got two years plus supervised release; Conti member received four years.
Affected
- Palo Alto Networks firewall software vulnerable to CVE-2026-0257.
- SonicWall SMA1000 remote access gateways affected by CVE-2026-15409 and CVE-2026-15410.
- Microsoft SharePoint Server impacted by CVE-2026-45659.
- Microsoft Windows affected by CVE-2025-60710.
- VMware vCenter vulnerable to CVE-2026-59310.
- WatchGuard Firebox affected by CVE-2025-14733.
What to look for
- Qilin ransomware group exploiting CVE-2026-0257 in Palo Alto Networks firewalls.
- Malicious npm package jscrambler delivering Rust infostealer targeting crypto wallets and AI agent API keys.
- Rust crates arrayref, internment, append-only-vec compromised to deliver Rust backdoor.
- Malicious MemTensor npm and PyPI packages delivering Go backdoor targeting secrets and API tokens.
- Updated MacSync crypto stealer and backdoor with changed payload delivery method.
- Telnet attacks on IoT honeypots dominated by Pakistan at 47.73% share.
Summarised by SecOraLens from Securelist (Kaspersky). Always read the original source before acting. How SecOraLens verifies advisories.