Quarterly Threat Landscape Report

Q3 2026 has shown that attackers exploit new high-severity vulnerabilities in an average of just three days.

Ungated research - no sign-up required

Of exploited vulnerabilities rated 7-10 CVSS required no authentication and no user interaction (34 of 43)

Government-sector ransomware incidents from the top Q3 countries

Ransomware leak-site listings in the U.S. - roughly 8x Germany

Advertising RDP or network access; access-for-sale listings dominated the quarter

If you only keep one number from this report, make it 3. That's the average time between a new high-severity vulnerability going public and someone using it against somebody else. Not three weeks. Not "at the change window." Three days. And 71% of all the exploitation we tracked landed inside the first seven. So if your patch cycle still has the word "monthly" in it, congratulations: It's perfectly calibrated for an adversary who stopped existing a while ago.

On the ransomware side, The Gentlemen and Qilin finished in a near photo finish, 342 versus 339 leak-site posts, before the field falls off a cliff to 99 for INC Ransom. The U.S. alone accounts for 1,112 listings, roughly eight times Germany, and in the government sector its among the top ten countries jumped from 33% to 45%. Group names come and go like startups in a hype cycle. The tradecraft stays. Meanwhile on the underground forums, 41 of 63 posts were someone selling a way in, and the "exploits" on offer were mostly last week's advisories in a fresh jacket. No zero-day apocalypse, just a very well-run retail market for your RDP.

Despite talk of AI agents running wild, this quarter’s AI-related cases remain human-directed for both targets and objectives, with AI assisting in the tactical middle of the attack chain as opposed to acting autonomously.

Which brings us to what's different on our side this quarter. We announced the Rapid7 Intelligence Organization, built on a simple idea: The research, the incident response front line, and the underground monitoring shouldn't sit in separate rooms, nodding politely at each other in meetings. You'll see that in this report: The vulnerability data, the leak sites, the forums, and what our responders keep running into come together as one story instead of four. We've also given the website a new look and feel.

At some point "three days" stops being a statistic and becomes a design requirement. Welcome to day three. You're already late.

Welcome to day three. You're already late. - Rapid7 Intelligence, Q3 2026

Welcome to day three. You're already late.

Five signals that defined Q3 2026

Government-sector incidents are concentrated more heavily at the U.S. among the countries we tracked in the ransomware top 10, with the U.S. making up 45% of 55 Q3 government-centric incidents.

Q3 2026's APT and cybercrime landscape shows continuity at the technique level - command and scripting interpreter, credential theft, and remote-access exploitation remain the backbone of both espionage and criminal intrusions.

Attackers are rapidly weaponizing vulnerabilities, exploiting new CVEs in an average of just 3 days. This speed is fueled by the fact that 79% of the quarter's exploited flaws were remote, unauthenticated "holy grail" vulnerabilities. With 71% of all active exploitation occurring within the first 7 days, traditional weekly or monthly patching cycles are fundamentally too slow for defense.

Most underground posts selling, sharing, or discussing exploits referenced CVEs already in vendor advisories or CISA KEV within days of disclosure, indicating rapid commercial repackaging rather than a wave of genuinely novel zero-day sales.

Ransomware activity reached a near photo finish

The Gentlemen led Q3 with 342 victims, narrowly ahead of Qilin at 339. The United States accounted for 1,112 listed incidents, with business services and manufacturing identified as the top targeted sectors.

Nation-state activity across regions and industries

Distinct APT and cybercrime actors tracked

Events mapped to Command and Scripting Interpreter

CVEs actively abused by tracked actors

Tracked reporting citing AI as an operational component

DPRK-linked activity against South Korea

Rapid7 Intelligence disclosed a previously undocumented Linux toolkit - a backdoor named "ted" compiled directly into a trojanized HAProxy 2.8.12 build, paired with an SSH keylogger and a curl-based RAT ("curlRAT") - used against South Korean automotive and media organizations, likely since early 2025.

A Russia-affiliated espionage actor whose publicly documented targeting has consistently centered on government organizations and law enforcement agencies, alongside defense, transportation, media, and healthcare, primarily in NATO member states and Ukraine. Government is a core, not incidental, target sector.

A Pakistan-linked espionage operation whose targeting has centered specifically on Indian government and military personnel since at least the mid-2010s, using spear phishing and mobile spyware against military and diplomatic staff. Its appearance in our CVE-to-actor tracking this quarter (CVE-2021-4034) is consistent with this actor's established government-focused profile. Government and military personnel are the defining target, not a side effect.

Top adversary techniques (MITRE ATT&CK)

Command and Scripting Interpreter

Obfuscated Files or Information

Sectors actively targeted

AI moved from drafting assistance to an operational role inside a meaningful number of tracked Q3 campaigns, and fragmented, multi-session prompting is emerging as the primary way threat actors evade AI provider safeguards. Disclosure data from at least one major AI provider this quarter indicated that single-session malicious requests were refused at a high rate, but safeguards performed less consistently once the same objective was split across multiple smaller sessions - a technique used deliberately by threat actors in disclosed cases.

Critical exploit tracking

All data below covers vulnerabilities rated 7-10 CVSS.

Average time from CVE disclosure to exploitation in Q3 2026

Median time between public disclosure and appearing on the CISA KEV list

Down 7% quarter over quarter, but still 19% higher year over year

PoC to exploitation conversion

One in ten proofs of concept becomes an active attack within 30 days.

Remote code execution accounted for 2,082 CVEs out of 2,930 across all four impact types. Eighteen of those RCE CVEs were exploited, while authentication bypass had the highest exploitation rate at 1.57% (3 of 191).

Vulnerability exploitation: CVE activity by actor

Our MISP dataset links 15 distinct CVEs to six tracked actors or clusters this quarter.

Active adversary trends and statistics

Government-sector incidents are concentrated further into the U.S. among the countries we tracked in the top 10. Among the top 10 reporting countries for government-sector ransomware, the U.S. rose from 33% in Q2 (16 of 48 incidents) to 45% in Q3 (25 of 55 incidents). Qilin, The Gentlemen, KryBit, and SafePay are the most consistent government-sector operators across both quarters. The turnover among the remaining groups is notable - eight groups seen in Q2's government breakdown do not appear in Q3's, while seven new groups appear in Q3 that were absent in Q2.

Incidents attributed to The Gentlemen

Ransomware incidents across all sectors

Across the top 10 reporting countries

Increase in government-sector incidents

Top ransomware groups

Ransomware incidents by region

Sectors targeted by ransomware

Underground forum signals

Forum, market, and paste posts in Q3 2026

Posts advertising RDP or network access

Posts trading zero-days or exploits

Posts selling government or corporate access

Access-broker activity was the single largest category this quarter. Listings ranged from individual compromised accounts (bank logins bundled with “full” identity data for at least three major U.S. banks) to full enterprise footholds - an "Enterprise access with tailscale + RDP" listing bundling certified webmail access for a named footwear company.

Fourteen underground posts this quarter involved the sale, sharing, or discussion of exploits and zero-days. The majority referenced CVEs already in vendor advisories or CISA KEV within days of disclosure (for example, a September 25 forum thread on CVE-2026-94127, the F5 BIG-IP APM flaw disclosed September 22), indicating rapid commercial repackaging of known flaws rather than a wave of genuinely novel zero-day sales.

0 1 For public-sector defenders, the practical takeaway is that group-specific threat intelligence (for example, “watch for Group X”) has a shorter shelf life in this sector than the country- and technique-level patterns. Prioritizing detection and response capability against common ransomware tradecraft - rather than a static list of “the” government-targeting groups - is likely to hold up better across quarters.

For public-sector defenders, the practical takeaway is that group-specific threat intelligence (for example, “watch for Group X”) has a shorter shelf life in this sector than the country- and technique-level patterns. Prioritizing detection and response capability against common ransomware tradecraft - rather than a static list of “the” government-targeting groups - is likely to hold up better across quarters.

0 2 None of this quarter's AI-related cases describe AI replacing a human attacker's judgment targets or objectives - humans still chose what to attack and why in every documented case. What changed is how much of the tactical middle of an attack chain (technique selection, target triage, recovering from a failed step) can now run without a human present. For detection, this argues for monitoring AI API usage patterns from unexpected hosts and processes as a first-class telemetry source, not an afterthought.

None of this quarter's AI-related cases describe AI replacing a human attacker's judgment targets or objectives - humans still chose what to attack and why in every documented case. What changed is how much of the tactical middle of an attack chain (technique selection, target triage, recovering from a failed step) can now run without a human present. For detection, this argues for monitoring AI API usage patterns from unexpected hosts and processes as a first-class telemetry source, not an afterthought.

So what does this mean?

Let's clear up a misunderstanding we already see in plenty of board decks: Two different apocalypses are being sold as one. The VulnDiscoveryPocalypse is real, because AI is finding flaws faster than anyone can triage them. The VulnExploitPocalypse isn't in our data. Yet. Only 43 vulnerabilities were newly exploited this quarter, fewer than the quarter before. But when attackers do show up, it takes them three days on average, and they shop in one aisle: remote, unauthenticated, zero-click. So treat it as a risk appetite conversation, not a patching one. A risk appetite you can't express in days of exposure is just hope with a budget.

Eight percent of the reporting we tracked cites AI as an operational component. In every documented case, a human still chose the target and the reason why. What the machine took over is the tactical middle: which technique , who's worth the effort, what to do when step four fails. So if the middle of an attack no longer needs a human, what's left that is human is intent. Do you know what your adversary actually wants from you? Not the malware family. The want.

The clock isn't yours, and it was never going to be. You can complain the pace or start designing for it. Only one of those makes for a better report quarter.

A risk appetite you can't express in days of exposure is just hope with a budget. - Rapid7 Intelligence, Q3 2026

A risk appetite you can't express in days of exposure is just hope with a budget.

Research is only half the loop

Every Intelligence finding feeds the Command Platform, so the CVEs and detections here become prioritization and hunts you can act on.