State of the threat
State of the threat, February 2026
What ransomware groups claimed this month, region by region, and what entered the catalogue of exploited vulnerabilities. Every figure is compared with the previous month.
Claims read on 2026-09-25 (ThreatCluster, CC BY 4.0) · KEV catalogue version 2026.09.25 ·
- Canada32+60 %20 the previous month
- Québec0-100 %1 the previous month
- United States351+83 %192 the previous month
- Europe164+71 %96 the previous month
- World868+60 %544 the previous month
Leading groups in Canada
- 01Clop8 claims+33 %
- 02Akira5 claims+400 %
- 03INC Ransom3 claims+200 %
- 04Nightspire2 claims
- 05Play2 claims+100 %
Leading groups worldwide
- 01Qilin112 claims · 13 %
- 020apt99 claims · 11 %
- 03The Gentlemen85 claims · 10 %
- 04Clop79 claims · 9 %
- 05Akira46 claims · 5 %
Sectors hit in Canada
- Services and construction7 claims · Clop
- Manufacturing4 claims · Play
- Retail and hospitality4 claims · Akira
- Technology3 claims · Clop
- Healthcare2 claims · INC Ransom
- Public sector2 claims · Lynx
Newcomers in Canada
Groups whose first Canadian claim dates from this month.
- Nothing this month.
Exploited vulnerabilities
28+65 %
vulnerabilities added to the KEV catalogue this month, 2 of them tied to ransomware campaigns per CISA.
Most affected vendors
- Microsoft8
- Cisco2
- Roundcube2
- GitLab2
- SolarWinds2
What it changes for you
The leading groups come in through the same doors every month: remote access without MFA, stolen credentials, unpatched edge devices. The regional board says who is active near you; the actor profiles say how they get in; the KEV catalogue says what to fix first.