Cyber Threat Report: W/C September 21, 2026
580
Threat Clusters
2575
Articles Analyzed
49.9
Avg Threat Score
150
Rising Entities
Top threats
Critical Zero-Day Exploits Target F5 and Check Point Products
83.3
Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution
82.3
Critical Zero-Day Vulnerabilities in Citrix NetScaler Under Active Exploitation
80.8
Massive Network of AI Proxy Servers Used for Malicious Activities Uncovered
80.7
Critical WordPress Vulnerability CVE-2026-87902 Exploited Within Hours of Disclosure
80.3
Critical Local File Inclusion Vulnerability in WordPress Core
79.2
Chinese Hackers Exploit Zyxel Switch Vulnerability CVE-2026-7273
78.9
Critical CVE-2026-93952 Vulnerability in VeloCloud Orchestrator Actively Exploited
78.8
North Korean Hackers Deploy Mac Backdoors via Fake Job Tests Targeting IT Firms
78.5
Critical LFI Vulnerability in Visual Composer Exposed
78.0
Critical Joomla Plugin Vulnerabilities Exploited
78.0
$352 Million Hack at Bitget Attributed to North Korean Lazarus Group
78.0
Ransomware leak sites this week
247 victim listings across 52 groups, from ThreatCluster's own collection of ransomware leak sites. Listings are claims by the groups, not confirmed breaches.Most-listed sectors: Manufacturing (43), Not Found (33), Professional Services (29), Technology (26), Other (23).
| Group | Listings |
|---|---|
| clop | 23 |
| qilin | 21 |
| thegentlemen | 21 |
| akira | 11 |
| incransom | 11 |
| metaencryptor | 9 |
| safepay | 9 |
| silentransomgroup | 9 |
| threeam | 8 |
| emperador | 7 |
Ransomware tracker · Dark web API
Rising entities
Apt Group
- Lazarus Group+140%
- Lazarus+33%
- Mustang Panda+50%
- Jade Sleet+100%
- APT29+100%
Attack Type
Campaign
- PolinRider+300%
- Storm-1679+100%
- ClickFix campaign+100%
- Project GhostwireNew
- Task#stompNew
Country
- Australia+888%
- North Korea+110%
- China+27%
- Canada+36%
- Sweden+250%
Cve
- CVE-2026-19490+400%
- CVE-2026-85150+700%
- CVE-2026-73515+500%
- CVE-2026-86555+100%
- CVE-2026-32882+100%
Cwe
Eth
Industry
- Healthcare+112%
- Government+32%
- Telecommunications+50%
- Real Estate+800%
- Transportation+71%
Malware
- TraderTraitor+600%
- Emotet+400%
- AMOS+300%
- Cobalt Strike+67%
- Anubis+200%
Mitre Attack
Platform
- Microsoft 365+375%
- PHP+156%
- XRP Ledger+1000%
- cPanel+133%
- Slack+67%
Ransomware Group
- Clop+271%
- Ryuk+400%
- Booba Project+500%
- SilentRansomGroup+400%
- Pear+400%
Tool
- Canvas+1100%
- Hugging Face+22%
- Docker+26%
- DeepSeek+133%
- VBScript+400%
Vulnerability
- Path Traversal+150%
- Citrix NetScaler+300%
- Click2Shell+50%
- Wp2shell+200%
- DirtyClone+200%
Entity type distribution
| Entity type | Count |
|---|---|
| Company | 584 |
| Cve | 571 |
| Platform | 427 |
| Tool | 313 |
| Malware | 151 |
| Country | 143 |
| Vulnerability | 125 |
| Campaign | 101 |
| Mitre Attack | 91 |
| Apt Group | 80 |
| Industry | 67 |
| Attack Type | 55 |
| Ransomware Group | 47 |
| Cwe | 45 |
| Eth | 24 |