Skip to content
Ransomware and Mobile Malware Trends in Q3 2026

Ransomware and Mobile Malware Trends in Q3 2026

First seen 10 Nov 2026, 15:22 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 15:23 UTC
  • •Kaspersky blocked over 311 million attacks, with 81,000 ransomware incidents reported.
  • •Qilin ransomware exploited CVE-2026-0257, compromising network security.
  • •Mobile malware threats surged, with 1.66 million attacks blocked in Q3 2026.

In Q3 2026, Kaspersky reported over 311 million blocked attacks, including 81,000 ransomware incidents. The report highlighted significant threats from ransomware groups like Qilin, which exploited CVE-2026-0257, allowing unauthorized network access. Additionally, mobile malware attacks surged, with 1.66 million incidents blocked, predominantly targeting Android users. Notable mobile threats included a Trojan-Banker variant and a malicious app disguised as Google Play Protect, which utilized AI for fraud automation. The report also detailed vulnerabilities in systems such as Palo Alto Networks and SonicWall, with several CVEs actively exploited. The ongoing risk from ransomware and mobile threats necessitates heightened vigilance among users and organizations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-29
CVE-2026-0257 added to KEV
CVE-2026-0257 was added to CISA's KEV catalog for active exploitation, allowing attackers to bypass authentication.
Securelist
2026-07-01
CVE-2026-45659 added to KEV
CVE-2026-45659 was added to CISA's KEV catalog due to active exploitation, affecting Microsoft SharePoint Server.
Securelist
2026-07-14
CVE-2026-15409 published
CVE-2026-15409 was published with a CVSS score of 10.0 and added to CISA's KEV catalog for active exploitation.
Securelist

More articles in this cluster (3)

Following this threat?

Track Qilin, Btmob and CVE-2026-0257 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (22)

1 / 3

Common questions

What ransomware groups are active?
Groups like Qilin and Ryuk are currently active, with significant ransomware incidents reported.
What mobile threats should I watch for?
Watch for Trojan-Banker variants and malicious apps disguised as legitimate software, particularly on Android.
How can I protect my organization?
Implement strong security measures, monitor for CVE exploits, and ensure all systems are regularly patched.