Cyber Threat Report: September 2026
296
Threat Clusters
1110
Articles Analyzed
53.4
Avg Threat Score
128
Rising Entities
Top threats
China-Linked QTFY Group Targets Critical Infrastructure with Advanced Exploits
80.8
SonicWall SMA1000 Faces Critical Zero-Day Exploitation
80.8
Critical Vulnerabilities in SonicWall SMA1000 Series Allow Remote Code Execution
80.2
SonicWall SMA 1000 Series Faces Critical Zero-Day Exploits
80.0
SonicWall SMA1000 Faces Third Zero-Day Attack with MFA Seeds Compromised
80.0
Critical Exploitation of Sangoma Switchvox Vulnerabilities Underway
78.8
Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware
78.5
AI Cyberattacks Targeting Critical Infrastructure Escalate
78.0
GeoNetwork Vulnerabilities Enable Unauthenticated RCE in Government Systems
78.0
UAC-0099 Uses GuardBreaker to Evade AI Malware Detection
77.7
Serbian Activists Targeted by Advanced Spyware Ahead of Elections
77.0
Critical Langflow flaw exploited to steal OpenAI and AWS keys
77.0
Ransomware leak sites this month
106 victim listings across 32 groups, from ThreatCluster's own collection of ransomware leak sites. Listings are claims by the groups, not confirmed breaches. Most-listed sectors: Not Found (14), Manufacturing (12), Other (11), Technology (11), Professional Services (11).
| Group | Listings |
|---|---|
| krybit | 15 |
| settra | 9 |
| incransom | 8 |
| storm | 8 |
| akira | 7 |
| qilin | 7 |
| silentransomgroup | 7 |
| direwolf | 5 |
| thegentlemen | 4 |
| everest | 3 |
Ransomware tracker · Dark web API
Rising entities
Apt Group
- Stardust ChollimaNEW
- APT IranNEW
- PLUMP SPIDERNEW
- Earth BerberokaNEW
- KillNetNEW
Attack Type
Campaign
Company
- OpenSUSE+17%
- Sonicwall+40%
- Langflow+12%
- Aesto Health+50%
- Kaspersky+100%
Cve
- CVE-2026-6471+150%
- CVE-2026-32327+600%
- CVE-2026-14663+250%
- CVE-2026-14662+250%
- CVE-2026-14664+250%
Cwe
Industry
- BankingNEW
- MiningNEW
- Water SectorNEW
- Government & DefenseNEW
- IT & TelecomNEW
Malware
- RevStealer+150%
- C2Looper+67%
- XWorm+100%
- Mirax+200%
- Guildma+200%
Mitre Attack
Platform
Ransomware Group
- Jadepuffer+500%
- Interlock+300%
- Ryuk+25%
- Black Basta+100%
- 8Base+100%
Tool
- Google Chrome+76%
- Dropbox+114%
- Cellebrite+500%
- ScreenConnect+43%
- Mythos+300%
Vulnerability
Entity type distribution
| Entity type | Count |
|---|---|
| Platform | 457 |
| Cve | 448 |
| Company | 266 |
| Tool | 216 |
| Malware | 154 |
| Country | 109 |
| Apt Group | 100 |
| Mitre Attack | 92 |
| Campaign | 54 |
| Vulnerability | 46 |
| Ransomware Group | 38 |
| Industry | 37 |
| Cwe | 34 |
| Attack Type | 31 |
| Btc | 1 |