Kaspersky products blocked more than 311 million attacks launched from online resources in Q3 2026, and the company’s telemetry recorded 4,470 new ransomware variants in a single quarter — a spike of more than 1.5 times the previous quarter’s count.
Ransom Cartel, Ryuk and Conti: legal disruption meets rising variant counts
Q3 saw prominent legal outcomes tied to ransomware operations and an accelerating churn of ransomware code. In August, the creator and lead administrator of the Ransom Cartel RaaS operation was sentenced to 16 years in prison; prosecutors said he built the ransomware Trojan and ran the affiliate program. In September, a member of the Ryuk RaaS group received two years in prison and three years of supervised release for attacks in 2019–2020; the prosecution said the attacker received about 1,610 BTC in ransom payments. Also in September, a member of the Conti RaaS group was sentenced to four years in prison for attacks in 2021 and 2022 and for developing part of the group’s malware toolkit.
Despite these disruptions, Kaspersky detected three new ransomware families and 4,470 new variants in Q3, and its products protected 81,556 unique users from ransomware attacks. According to Kaspersky’s review of data leak sites (DLSs), Qilin accounted for roughly 15.39% of victims added to DLSs during the reporting period; elsewhere the report states that 15% of all ransomware victims whose data was published on threat actors’ DLSs were victims of Qilin. Other notable groups in the sample were The Gentlemen (7.89%) and the newcomer Deadlock (4.46%).
Qilin and exploited CVEs: gate-cracking vulnerabilities in the wild
Researchers reported active exploitation tied to several specific vulnerabilities during the quarter. In July, Qilin was reported exploiting CVE-2026-0257 in Palo Alto Networks firewall software, a flaw that allowed attackers to bypass authentication and compromise networks without valid accounts. CISA added multiple CVEs to its Known Exploited Vulnerabilities Catalog and linked exploitation activity by ransomware actors to those entries; among the vulnerabilities flagged in public guidance were CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 gateways, CVE-2026-45659 in Microsoft SharePoint Server, CVE-2025-60710 in Microsoft Windows (local privilege escalation), CVE-2026-59310 in VMware vCenter, CVE-2025-14733 in WatchGuard Firebox, and CVE-2026-63077 in JetBrains TeamCity (an authentication-bypass to execute OS commands as the TeamCity server process).
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragemacOS and supply-chain: PAM stealers, fake installers and poisoned packages
The quarter showed growing macOS targeting through both direct malware and poisoned open‑source packages. Jamf researchers discovered PamStealer, notable for using Pluggable Authentication Modules (PAM) to verify administrator passwords entered by victims. Socket researchers reported supply‑chain compromises across npm, PyPI and Cargo packages that delivered payloads targeting macOS among other platforms. Examples include an infected npm package, jscrambler, published on July 11 whose malicious module was an infostealer written in Rust targeting crypto wallets, secrets and API keys; Rust crates (arrayref, internment, append-only-vec) that delivered a Rust backdoor; and malicious MemTensor npm and PyPI packages published in September that delivered a Go backdoor aimed at secrets and API tokens.
Jamf also reported Overlord, a backdoor distributed as fake Zoom installers with broad spyware functionality — microphone eavesdropping, webcam access, screen capture and keystroke logging. Kaspersky noted an updated MacSync crypto stealer and backdoor with a substantially changed payload delivery method. On macOS detections, the network tunneling tool Ngrok rose to the top of Kaspersky’s list (reflecting both legitimate and malicious uses), and Amos detections — both stealer and backdoor variants — increased. Country shares for macOS detections rose in China (to 1.04%) and Hong Kong (to 0.92%), with Brazil remaining highest at 1.13%.
Miners, IoT and web attacks: scale, geography and shifting botnet activity
Coin‑mining malware remained widespread but calmer than Q2’s spike: Kaspersky detected 2,197 new miner variants in Q3 and recorded miner attacks on 217,024 unique users worldwide. Miner activity’s country concentration varied; Turkmenistan (2.32%), Tanzania (1.43%) and Mali (1.21%) were the top three by share of Kaspersky users attacked by miners.
IoT honeypots showed notable shifts. The share of devices attacking Kaspersky honeypots over SSH rose to 18.42%. In SSH-origin geography, the Netherlands (27.70%), Bulgaria (20.05%) and the United States (10.17%) were the largest sources; Kaspersky flagged Bulgaria’s share as having grown fourfold. Telnet-origin attacks concentrated heavily in Pakistan, whose share reached 47.73%, followed by China at 33.83%. Mirai’s share of delivered IoT threats declined while other botnet threats grew.
Web Anti‑Virus blocked 311,083,655 attacks launched from online resources in Q3; it was triggered by 46,936,926 unique URLs. Kaspersky’s country risk ranking for web‑based Malware showed Bangladesh highest (12.03% of local Kaspersky users targeted by web Malware), followed by Taiwan (8.06%) and Venezuela (7.92%). On average across the quarter, 4.34% of internet users’ computers worldwide were targeted by at least one web‑based Malware attack.
What this means for security teams, open‑source maintainers, and end users
- Security teams and technologists: track the specific CVEs cited (including CVE-2026-0257, CVE-2026-15409/15410, CVE-2026-45659 and CVE-2026-63077) and monitor DLS activity, especially Qilin’s large share of published victims (about 15%).
- Open‑source maintainers and package registries: heed the documented supply‑chain compromises (jscrambler, arrayref/internment/append-only-vec, and MemTensor) that delivered Rust, Rust-backdoor and Go payloads, and strengthen vetting and incident response for published packages.
- End users and administrators: be aware of the scale of web‑launched attacks (311 million blocked) and local‑infection detections (23,733,652 objects recorded by File Anti‑Virus), and note regions with elevated exposure as reflected in Kaspersky’s country rankings.
Q3 2026 delivers a mixed picture: judicial action against ransomware operators on one hand, and an expanding, fast‑moving threat landscape on the other — 4,470 new ransomware variants, hundreds of thousands of miner victims, poisoned supply‑chain packages and millions of web‑borne attacks. The concrete metrics to watch next quarter are whether new‑variant counts remain elevated, whether Qilin’s share of DLS victims changes, and whether the KEV‑listed CVEs continue to appear in exploitation telemetry.
Source: Kaspersky — IT threat evolution in Q3 2026. Non-mobile statistics
