Rapid7: high-severity flaws exploited within three days in Q3
Original title: High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
Rapid7's Q3 2026 threat analysis says high-severity vulnerabilities were exploited in an average of three days, with 71% hit in the first week. Ransomware remained the main threat, led by claimed activity from The Gentlemen and Qilin, and the United States was the most targeted country. AI appeared as an operational component in 8% of tracked incidents and was not fully autonomous. Researchers also described a previously undocumented Linux toolkit, ted, used by North Korea against South Korean organizations.
Unconfirmed: Ransomware incident counts are claims tracked by Rapid7, not independently confirmed victim totals.
- Seventy-nine percent of those flaws were remote and needed no credentials.
- Top sectors were business services, manufacturing and healthcare.
- Government ransomware victims rose 15%, and the US share grew from 33% to 45%.
- Germany, Italy and Canada followed the US at 7%, 5% and 5%.
- Ted was found in a trojanized HAProxy build, with an SSH keylogger and curl-based RAT.
Impact: Fast exploitation of remote flaws and widespread ransomware
- 1.Monitor AI API usage from unexpected hosts and processes
- Products
- HAProxy
- Threat actors
- The GentlemenQilinINC RansomSandwormLazarusAPT31
- Malware
- ted
- Organizations
- Rapid7
From the original article
3 min read at securityweek.com
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents. The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared first on SecurityWeek.
By Kevin Townsend · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.