Cyber Threat Report: September 2026
2925
Threat Clusters
18956
Articles Analyzed
50.3
Avg Threat Score
151
Rising Entities
Top threats
Critical Zero-Day Vulnerability in Cisco ISE Under Active Exploitation
89.0
Critical Cisco FMC Vulnerabilities Under Active Exploitation
88.3
Critical Zero-Day Exploits Target F5 and Check Point Products
83.3
Critical Zero-Day Vulnerabilities in Citrix NetScaler Under Active Exploitation
82.3
Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited
82.3
Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution
82.3
Critical Zero-Day Vulnerability in Cisco Secure Email Gateway Exploited
82.3
Critical Citrix NetScaler Zero-Days Exploited Amid $387M Crypto Hack
81.0
Critical GitLab CVE-2026-85706 Exploited; Microsoft Issues Record 974 Patches
81.0
Critical GitLab Vulnerabilities Exploited Within Hours of Disclosure
81.0
BlueMoon Exploit Kit Targeting Chrome and Windows by Multiple State Actors
80.8
China-Linked QTFY Group Targets Critical Infrastructure with Advanced Exploits
80.8
Ransomware leak sites this month
905 victim listings across 81 groups, from ThreatCluster's own collection of ransomware leak sites. Listings are claims by the groups, not confirmed breaches.Most-listed sectors: Manufacturing (155), Professional Services (103), Not Found (100), Technology (100), Healthcare (90).
| Group | Listings |
|---|---|
| thegentlemen | 105 |
| qilin | 75 |
| akira | 39 |
| storm | 37 |
| krybit | 36 |
| incransom | 34 |
| auditteam | 32 |
| safepay | 32 |
| clop | 25 |
| emperador | 24 |
Ransomware tracker · Dark web API
Rising entities
Apt Group
- ShinyHunters+322%
- Midnight Blizzard+2100%
- Star Blizzard+1100%
- Violet Typhoon+800%
- FamousSparrow+233%
Attack Type
- Data Breach+107%
- Zero-day Exploit+263%
- Ransomware+177%
- Phishing+69%
- Malware+49%
Campaign
- Operation PowerOFF+200%
- Contagious Interview+400%
- Operation Economic Outcast+600%
- PolinRider+400%
- Project Glasswing+100%
Country
- United States+183%
- Russia+156%
- China+161%
- Australia+263%
- Iran+151%
Cve
- CVE-2026-35273+1700%
- CVE-2026-81578+650%
- CVE-2026-82078+400%
- CVE-2026-6471+275%
- CVE-2026-62911+300%
Cwe
Eth
Industry
- Government+58%
- Healthcare+106%
- Technology+154%
- Manufacturing+122%
- Financial+26%
Malware
- ClickFix+144%
- Pegasus+76%
- Cobalt Strike+200%
- MacSync+700%
- Trickbot+1000%
Mitre Attack
Platform
- Windows+239%
- Linux+82%
- Chromium+3071%
- Microsoft Edge+1539%
- Android+132%
Ransomware Group
- Clop+1167%
- Conti+236%
- Qilin+100%
- The Gentlemen+271%
- Ryuk+425%
Tool
- Google Chrome+1341%
- Hugging Face+62%
- PowerShell+127%
- Docker+235%
- Claude+272%
Vulnerability
- XSS+87%
- Path Traversal+414%
- Citrix NetScaler+475%
- OS Command Injection+133%
- SSRF+250%
Entity type distribution
| Entity type | Count |
|---|---|
| Cve | 4843 |
| Platform | 2519 |
| Company | 2181 |
| Tool | 1490 |
| Malware | 580 |
| Vulnerability | 522 |
| Campaign | 407 |
| Apt Group | 319 |
| Country | 222 |
| Mitre Attack | 186 |
| Industry | 171 |
| Ransomware Group | 147 |
| Attack Type | 112 |
| Eth | 103 |
| Cwe | 87 |
| Btc | 1 |