The third quarter of 2026 saw a significant volume of cyber threats targeting non-mobile systems, characterized by a surge in ransomware activity and the continued exploitation of critical vulnerabilities in enterprise infrastructure. According to data collected by Kaspersky, security products blocked more than 311 million web-based attacks between July and September. During this period, the company’s Web Anti-Virus identified 47 million unique malicious links, while File Anti-Virus intercepted over 23 million malicious or unwanted objects.
Ransomware remains a primary concern for security researchers, with 4,470 new variants discovered in the third quarter alone—a 50% increase compared to the previous quarter. More than 81,000 unique users were protected from ransomware attacks during this timeframe. Among the most active threat groups, Qilin maintained its position as the most prolific, accounting for over 15% of all victims listed on data leak sites. Other notable actors included The Gentlemen, which returned to the list after a period of inactivity, and the relatively new group Deadlock.
Law enforcement efforts against ransomware operators saw several successes during the quarter. In August, the lead administrator of the Ransom Cartel operation was sentenced to 16 years in prison for his role in managing the affiliate program, recruiting members, and coordinating with victims. September also saw sentencing for members of the Ryuk and Conti groups, with individuals receiving two-year and four-year prison terms, respectively, for their involvement in large-scale network breaches and malware development.
The threat landscape was heavily influenced by the exploitation of known vulnerabilities in widely used enterprise software. Researchers identified the Qilin group utilizing CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks firewall software, to gain unauthorized network access. Additionally, the Cybersecurity and Infrastructure Security Agency (CISA) added several vulnerabilities to its Known Exploited Vulnerabilities catalog. These include CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 gateways, which have been linked to INC Ransom activity.
Other critical vulnerabilities exploited during the quarter include CVE-2026-45659 in Microsoft SharePoint Server, which allows low-privileged attackers to achieve remote code execution, and CVE-2026-59310 in VMware vCenter. Furthermore, CVE-2026-63077 in JetBrains TeamCity was noted for allowing attackers to execute OS commands by bypassing authentication through the agent polling protocol, potentially exposing sensitive CI/CD pipelines and credentials. Older vulnerabilities, such as CVE-2025-60710 in Windows and CVE-2025-14733 in WatchGuard Firebox, also remained points of concern for security teams.
Cryptocurrency mining malware also maintained a consistent presence in the threat landscape. Kaspersky reported the detection of 2,197 new miner variants during the quarter, with over 217,000 unique users experiencing attempted miner infections. While this represents a return to more typical activity levels following a spike in the second quarter, the geographic distribution of these attacks remains broad, with users in Turkmenistan, Tanzania, and Mali facing the highest relative risk.
The macOS ecosystem also faced specific threats, most notably the emergence of a new stealer identified by Jamf researchers at the start of the quarter. Named PamStealer, the malware is distinguished by its use of Pluggable Authentication Modules to verify administrator passwords entered by users. This development highlights the ongoing evolution of macOS-specific threats as attackers continue to refine their techniques for credential theft and system compromise.
