Cyber Threat Report: October 2026
5839
Threat Clusters
23611
Articles Analyzed
40.9
Avg Threat Score
162
Rising Entities
Top threats
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group
86.0
CVE-2015-3306 Exploited in ProFTPD FTP Servers
86.0
Citrix NetScaler Critical Vulnerabilities Exploited: Urgent Patching Required
85.8
North Korean Hackers Steal $6.3 Billion from Binance in Record Crypto Heist
85.3
Binance Hack: $6.3 Billion Stolen in Largest Crypto Heist
83.8
NetScaler Zero-Days Actively Exploited: Immediate Action Required
81.8
Chinese Actor Compromises US Government Networks via PHP2Shell Exploit
81.0
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems
81.0
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon
81.0
KeyDrift Malware Exploits Cisco SD-WAN Flaw CVE-2026-20127
80.7
China-Linked Hackers Exploit PHP2Shell to Root 25 Servers
80.7
Silent Lynx Targets CIS Governments via WinRAR Exploit
80.7
Ransomware leak sites this month
1,206 victim listings across 82 groups, from ThreatCluster's own collection of ransomware leak sites. Listings are claims by the groups, not confirmed breaches.Most-listed sectors: Not Found (176), Manufacturing (168), Professional Services (139), Healthcare (125), Technology (125).
| Group | Listings |
|---|---|
| qilin | 164 |
| n0n | 151 |
| thegentlemen | 143 |
| akira | 35 |
| nightspire | 34 |
| booba project | 30 |
| silentransomgroup | 30 |
| incransom | 28 |
| majinahanashi | 28 |
| emperador | 27 |
Ransomware tracker · Dark web API
Rising entities
Apt Group
- Lazarus Group+193%
- ShinyHunters+98%
- Flax Typhoon+800%
- Scattered Spider+460%
- Uac-0099+2000%
Attack Type
- Data Breach+36%
- Phishing+19%
- Zero-day Exploit+15%
- Malware+16%
- Remote Code Execution+160%
Btc
Campaign
- Operation Economic Outcast+286%
- Operation Epic Fury+850%
- Patch The Planet+1300%
- FortiBleed+120%
- Storm-1516+275%
Company
- Binance+10567%
- Snowflake+969%
- Google+180%
- Intermarché+4300%
- X+193%
Country
- Russia+225%
- United States+164%
- Ukraine+276%
- China+181%
- Iran+193%
Cve
- CVE-2026-46300+500%
- CVE-2024-4577+2000%
- CVE-2026-20127+1500%
- CVE-2026-16812+1400%
- CVE-2026-61500+1000%
Cwe
Eth
Industry
- Government+90%
- Financial+93%
- Energy+146%
- Healthcare+50%
- Retail+154%
Malware
- TraderTraitor+1175%
- Pegasus+103%
- Mirai+164%
- XMRig+440%
- Shai-hulud+211%
Mitre Attack
Ransomware Group
- The Gentlemen+81%
- Warlock+1700%
- Hive+1600%
- Nefilim+750%
- Safepay+82%
Tool
- Nginx+331%
- Docker+104%
- Google Cloud+196%
- Python+128%
- Yandex+4100%
Vulnerability
- Heartbleed+3100%
- Log4Shell+900%
- Fragnesia+433%
- Log4j+300%
- PolyShell+800%
Entity type distribution
| Entity type | Count |
|---|---|
| Company | 4588 |
| Cve | 4186 |
| Platform | 3056 |
| Tool | 1547 |
| Campaign | 648 |
| Malware | 587 |
| Vulnerability | 408 |
| Industry | 369 |
| Apt Group | 334 |
| Country | 274 |
| Mitre Attack | 181 |
| Attack Type | 166 |
| Ransomware Group | 158 |
| Cwe | 84 |
| Eth | 25 |
| Btc | 20 |
| Xmr | 2 |