State of the threat
State of the threat, June 2026
What ransomware groups claimed this month, region by region, and what entered the catalogue of exploited vulnerabilities. Every figure is compared with the previous month.
Claims read on 2026-09-25 (ThreatCluster, CC BY 4.0) · KEV catalogue version 2026.09.25 ·
- Canada21+40 %15 the previous month
- Québec10 %1 the previous month
- United States199+24 %161 the previous month
- Europe161+34 %120 the previous month
- World726+62 %447 the previous month
Leading groups in Canada
- 01Qilin3 claims-25 %
- 02Brain Cipher2 claims
- 03Icarus2 claims
- 04The Gentlemen2 claims
- 05M3rx2 claims
Leading groups worldwide
- 01Qilin79 claims · 11 %
- 02The Gentlemen76 claims · 10 %
- 03LockBit 5.059 claims · 8 %
- 04Akira32 claims · 4 %
- 05INC Ransom31 claims · 4 %
Sectors hit in Canada
- Retail and hospitality5 claims · Settra
- Manufacturing3 claims · Chaos
- Services and construction3 claims · Aurora
- Healthcare2 claims · Interlock
- Technology2 claims · Icarus
- Finance1 claim · Qilin
Newcomers in Canada
Groups whose first Canadian claim dates from this month.
- Settrasince 2026-06-284 claims
- Chaossince 2026-06-224 claims
Exploited vulnerabilities
23+10 %
vulnerabilities added to the KEV catalogue this month, 3 of them tied to ransomware campaigns per CISA.
Most affected vendors
- Cisco3
- Ubiquiti3
- Oracle2
- SimpleHelp1
- PTC1
What it changes for you
The leading groups come in through the same doors every month: remote access without MFA, stolen credentials, unpatched edge devices. The regional board says who is active near you; the actor profiles say how they get in; the KEV catalogue says what to fix first.