Kaspersky Report: Q3 2026 Sees Over 311 Million Online Attacks Blocked, Qilin Group Exploits Palo Alto Networks Firewall
Kaspersky's latest report reveals a surge in online threats during Q3 2026, with over 311 million attacks blocked and the Qilin ransomware group actively exploiting a Palo Alto Networks firewall vulnerability.
Kaspersky's "IT threat evolution in Q3 2026" report paints a grim picture of the cybersecurity landscape, detailing a significant volume of online attacks and the emergence of new threats. During the third quarter of 2026, Kaspersky products successfully blocked more than 311 million attacks originating from online resources. The Web Anti-Virus component alone responded to 47 million unique malicious links, while the File Anti-Virus detected and neutralized over 23 million malicious and potentially unwanted objects. This period also saw the discovery of 4470 new ransomware variants, indicating a continuous and evolving threat from ransomware operations.
The report highlights the persistent threat of ransomware, with over 81,000 unique users falling victim to attacks. Notably, the Qilin ransomware group emerged as a significant player, responsible for 15% of all ransomware victims whose data was published on threat actors' data leak sites (DLSs). This places Qilin at the forefront of ransomware operations, a position it held in the previous quarter as well. The report also noted a substantial number of users, over 217,000, targeted by cryptocurrency miners, underscoring the ongoing financial motivations behind many cyberattacks.
In terms of specific vulnerabilities, the Qilin group was observed exploiting CVE-2026-0257, a critical flaw in Palo Alto Networks firewall software. This vulnerability allowed attackers to bypass authentication mechanisms, enabling them to compromise victim networks without the need for valid credentials. This exploitation highlights the ongoing risks associated with unpatched or misconfigured network security devices and the sophisticated methods threat actors employ to gain initial access.
Beyond specific exploits, the report touches upon significant law enforcement actions against ransomware operators. In August, the creator of the Ransom Cartel RaaS operation was sentenced to 16 years in prison for his role in developing the ransomware and managing the affiliate program. September saw further convictions, with a member of the Ryuk RaaS group receiving a two-year sentence for network breaches and data encryption, and a Conti RaaS group member sentenced to four years for his involvement in attacks and malware development.
CISA's Known Exploited Vulnerabilities (KEV) Catalog was updated with several actively exploited CVEs, many of which are associated with ransomware campaigns. These include vulnerabilities in SonicWall SMA1000 gateways (CVE-2026-15409/CVE-2026-15410), linked to the INC Ransom group, and critical flaws in Microsoft SharePoint Server (CVE-2026-45659) and Windows (CVE-2025-60710) that allowed for remote code execution and privilege escalation, respectively. Additionally, vulnerabilities in VMware vCenter (CVE-2026-59310) and WatchGuard Firebox (CVE-2025-14733) enabled unauthenticated remote code execution, while a flaw in JetBrains TeamCity (CVE-2026-63077) permitted OS command execution through an authentication bypass.
The report also identifies the most prolific ransomware gangs based on victim numbers published on DLSs. Qilin led the pack, followed by The Gentlemen and a notable newcomer, Deadlock, a ransomware family first reported in July 2025. The sheer number of new ransomware variants detected—4470 in Q3 alone—more than 1.5 times the previous quarter's count, indicates a dynamic and rapidly evolving threat landscape. This constant churn of new variants and families poses a significant challenge for defenders.
Geographically, China, South Korea, and Cameroon were among the top ten countries most targeted by ransomware Trojans, based on unique Kaspersky users attacked. The prevalence of generic verdicts like Trojan-Ransom.Win32.Gen among the top ten most common ransomware families suggests a broad and often unsophisticated attack surface being exploited, alongside more targeted campaigns.
In summary, Kaspersky's Q3 2026 report underscores the escalating volume and sophistication of cyber threats. The active exploitation of critical vulnerabilities like CVE-2026-0257, the persistent threat of ransomware groups like Qilin, and the continuous influx of new malware variants necessitate robust security measures and rapid patching by organizations worldwide.