State of the threat
State of the threat, November 2025
What ransomware groups claimed this month, region by region, and what entered the catalogue of exploited vulnerabilities. Every figure is compared with the previous month.
Claims read on 2026-09-25 (ThreatCluster, CC BY 4.0) · KEV catalogue version 2026.09.25 ·
- Canada28-42 %48 the previous month
- Québec20 the previous month
- United States306-16 %366 the previous month
- Europe109-23 %142 the previous month
- World723-14 %840 the previous month
Leading groups in Canada
- 01Qilin10 claims-29 %
- 02INC Ransom3 claims-25 %
- 03Play3 claims+200 %
- 04Tridentlocker2 claims
- 05Rhysida2 claims0 %
Leading groups worldwide
- 01Qilin107 claims · 15 %
- 02Clop98 claims · 14 %
- 03Akira87 claims · 12 %
- 04INC Ransom53 claims · 7 %
- 05DragonForce27 claims · 4 %
Sectors hit in Canada
- Manufacturing7 claims · Play
- Technology3 claims · Tridentlocker
- Services and construction3 claims · Qilin
- Healthcare2 claims · Qilin
- Public sector2 claims · Qilin
- Education2 claims · Rhysida
Newcomers in Canada
Groups whose first Canadian claim dates from this month.
- The Gentlemensince 2025-11-2113 claims
Exploited vulnerabilities
11-65 %
vulnerabilities added to the KEV catalogue this month, none tied to ransomware campaigns per CISA.
Most affected vendors
- Fortinet2
- Gladinet2
- OpenPLC1
- Oracle1
- Google1
What it changes for you
The leading groups come in through the same doors every month: remote access without MFA, stolen credentials, unpatched edge devices. The regional board says who is active near you; the actor profiles say how they get in; the KEV catalogue says what to fix first.