Kaspersky: Qilin led Q3 2026 ransomware leak-site victims
Original title: IT threat evolution in Q3 2026. Non-mobile statistics
Opted-in detections blocked over 311 million online attacks, while 81,556 users encountered ransomware and 4,470 new variants appeared.
Kaspersky's Q3 2026 non-mobile report, drawn from consented product telemetry, says Web Anti-Virus handled 47 million unique links and File Anti-Virus blocked more than 23 million objects. Qilin accounted for 15.39% of victims posted on reviewed leak sites, ahead of The Gentlemen and Deadlock. The report also covers prison sentences tied to Ransom Cartel, Ryuk and Conti and lists vulnerabilities CISA placed in KEV as exploited by ransomware groups.
Unconfirmed: Leak-site percentages reflect victims published on sites Kaspersky reviewed, not independently confirmed breaches.
- China's ransomware share was 0.83% of local Kaspersky users, the highest listed.
- WannaCry accounted for 4.90% of users attacked by ransomware Trojans.
- Kaspersky detected 2,197 new miner variants and more than 217,000 targeted users.
- Researchers linked Qilin to CVE-2026-0257 in Palo Alto Networks firewall software.
- A Ryuk member allegedly received about 1,610 BTC, according to prosecutors.
Impact: Authentication bypass, remote code execution, or local privilege escalation
| Product | Affected |
|---|---|
| Palo Alto Networks firewall software | — |
| SonicWall SMA1000 | — |
| Microsoft SharePoint Server | — |
| Microsoft Windows | — |
| VMware vCenter | — |
| WatchGuard Firebox | — |
| JetBrains TeamCity | — |
- 1.Review the named CVEs that CISA listed as exploited by ransomware groups.
- CVEs
- CVE-2026-0257CVE-2026-15409CVE-2026-15410CVE-2026-45659CVE-2025-60710CVE-2026-59310CVE-2025-14733CVE-2026-63077
- Threat actors
- QilinThe GentlemenINC RansomRansom CartelConti
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-14733 | Unauthenticated Out-of-Bounds Write RCE in WatchGuard Fireware OS | 9.3 | 29% | KEVRansomware | KEV |
| CVE-2025-60710 | Link Following Privilege Escalation in Microsoft Windows Host Process for Tasks | 7.8 | 5% | KEVRansomware | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 96% | KEVRansomware | KEV |
CVE-2026-15409+1 related CVE | Unauthenticated SSRF in SonicWall SMA1000 Appliances | 10.0 group max | 7% | KEVRansomwarePoC | KEV |
| CVE-2026-45659 | Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited) | 8.8 | 80% | KEVRansomware | KEV |
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 62% | KEVRansomwarePoC ×2 | KEV |
| CVE-2026-63077 | Unauthenticated Deserialization RCE in JetBrains TeamCity On-Premises | 9.8 | 95% | KEVRansomwarePoC | KEV |
From the original article
10 min read at securelist.com
Key trends and statistics on malware targeting Windows and macOS computers and Internet of Things (IoT) devices in Q3 2026.
By AMR · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.