Cyber Threat Report: April 2026
1937
Threat Clusters
17228
Articles Analyzed
51.9
Avg Threat Score
145
Rising Entities
Top threats
Critical WebLogic RCE Vulnerability Exploited in the Wild
86.2
Urgent CISA Directive: Patch Critical Ivanti EPMM Vulnerability CVE-2026-1340 by April 11
80.2
State-Sponsored Phishing Campaign Targets Signal Users
80.0
DPRK-Linked Malware Targeting Job Seekers via Wellfound
80.0
Critical Buffer Overflow Vulnerability in Silex Devices (CVE-2026-32956)
79.5
Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies
79.0
Critical NGINX UI Vulnerability CVE-2026-33032 Under Active Exploitation
78.8
CISA Alerts on Critical Flaws in SimpleHelp, Samsung MagicINFO, and D-Link Devices
78.0
New Vulnerabilities Discovered in Serial-to-IP Converters Threaten Critical Infrastructure
78.0
Critical SQL Injection Vulnerability in CodeAstro Attendance System (CVE-2026-37749)
78.0
Critical RCE Vulnerability in Marimo Exploited Within 10 Hours of Disclosure
78.0
Iranian APTs Target 5,219 Exposed Rockwell PLCs in U.S. Critical Infrastructure
78.0
Ransomware leak sites this month
585 victim listings across 48 groups, from ThreatCluster's own collection of ransomware leak sites. Listings are claims by the groups, not confirmed breaches. Most-listed sectors: Not Found (118), Business Services (99), Manufacturing (77), Healthcare (54), Consumer Services (48).
| Group | Listings |
|---|---|
| thegentlemen | 77 |
| qilin | 58 |
| dragonforce | 52 |
| akira | 45 |
| coinbasecartel | 43 |
| lockbit5 | 27 |
| nightspire | 27 |
| incransom | 24 |
| krybit | 19 |
| gunra | 16 |
Ransomware tracker · Dark web API
Rising entities
Apt Group
- Lazarus Group+800%
- Fancy Bear+329%
- Apt28+118%
- Forest Blizzard+433%
- UNC1069+275%
Attack Type
- Data Breach+13%
- Zero-day Exploit+29%
- Supply Chain Attack+13%
- Man-in-the-Middle+138%
- Worm+178%
Campaign
Company
- Ethereum+1067%
- Vercel+3800%
- Education+82%
- Rockstar Games+1200%
- OpenAI+182%
Country
- Russia+50%
- Ukraine+69%
- United States+48%
- China+62%
- North Korea+125%
Cve
- CVE-2025-20333+1000%
- CVE-2025-20362+900%
- CVE-2026-20128+800%
- CVE-2026-20122+800%
- CVE-2025-55182+233%
Cwe
Eth
Industry
- Energy+60%
- Financial+55%
- Transportation+230%
- Manufacturing+29%
- Technology+28%
Mitre Attack
Tool
- GitHub Actions+167%
- Docker+129%
- PowerShell+24%
- Microsoft Teams+46%
- Claude Code+143%
Vulnerability
- Follina+300%
- Log4Shell+100%
- Path Traversal+100%
- Copy FailNEW
- BlueHammerNEW
Entity type distribution
| Entity type | Count |
|---|---|
| Platform | 1209 |
| Company | 1183 |
| Cve | 621 |
| Tool | 544 |
| Malware | 442 |
| Apt Group | 234 |
| Country | 227 |
| Campaign | 221 |
| Mitre Attack | 129 |
| Vulnerability | 101 |
| Ransomware Group | 78 |
| Industry | 67 |
| Attack Type | 56 |
| Cwe | 35 |
| Eth | 4 |
| Xmr | 1 |