Ransomware Dominated Q3 as Flaws Were Exploited in Three Days

Ransomware was the leading cyber threat in the third quarter of 2026, while attackers exploited high-severity vulnerabilities an average of three days after disclosure, according to Rapid7’s threat analysis.

Seventy-one percent of the high-severity vulnerabilities tracked by Rapid7 were exploited within seven days of disclosure. The company classified about 79% as “holy grail” flaws because they could be exploited remotely without credentials or user interaction.

Business services, manufacturing and healthcare were the most targeted sectors. The United States accounted for 60% of reported attacks, followed by Germany at 7%, Italy at 5% and Canada at 5%.

The Gentlemen and Qilin recorded the highest numbers of claimed ransomware incidents, with 342 and 339, respectively. INC Ransom claimed 99 incidents, followed by DeadLock with 98 and Krybit with 95.

Government ransomware victims increased 15% from the second quarter. The United States accounted for 45% of government-sector victims in Q3, up from 33% in Q2.

Artificial intelligence was an operational component in 8% of the incidents tracked by Rapid7. In every documented case, people selected the target and objective. AI-assisted automation was used for tasks such as choosing techniques, sorting potential targets and recovering after failed actions.

“The finding I’d put in front of anyone is that AI showed up as an operational component in only 8% of the incidents we tracked,” Douglas McKee, Rapid7’s director of vulnerability intelligence, said. “The AI exploitation wave everyone is bracing for didn’t show up in our data this quarter.”

Rapid7 distinguished between using AI to find vulnerabilities and using it to exploit them. AI-assisted vulnerability discovery is increasing, but the company found no evidence of widespread, fully autonomous exploitation during the quarter. Attackers also used fragmented, multi-session prompts to bypass safeguards that can block malicious requests made in a single session.

Rapid7 tracked 15 nation-state and cybercrime groups during the period. The groups included Russia-linked ENERGETIC BEAR, Void Blizzard and Sandworm; China-linked APT31; North Korea-linked Lazarus; and Pakistan-linked Operation C-Major. Government organizations were the main targets of advanced persistent threat groups. Other targeted sectors included defense, transportation, media, healthcare, aerospace, finance, energy and technology.

Researchers identified a previously undocumented Linux toolkit used by North Korean attackers against South Korean organizations since early 2025. The toolkit included a backdoor called “ted” in a modified HAProxy build, an SSH keylogger and a remote-access tool based on the curl command-line utility.

Operation C-Major, active since the mid-2010s, targeted Indian military and diplomatic personnel with phishing campaigns and mobile spyware, Rapid7 found.

Access-broker listings were the most common activity observed on underground forums during the quarter. Of 63 posts reviewed by researchers, 41 offered RDP or network access, ranging from compromised accounts to access to entire organizations. Fourteen posts involved the sale, sharing or discussion of exploits and zero-day vulnerabilities.