State of the threat
State of the threat, September 2026
What ransomware groups claimed this month, region by region, and what entered the catalogue of exploited vulnerabilities. Every figure is compared with the previous month.
Claims read on 2026-10-08 (ThreatCluster, CC BY 4.0) · KEV catalogue version 2026.10.08 ·
- Canada29-3 %30 the previous month
- Québec30 the previous month
- United States275-34 %415 the previous month
- Europe200-34 %301 the previous month
- World878-28 %1214 the previous month
Leading groups in Canada
- 01Qilin5 claims-17 %
- 02Storm5 claims+67 %
- 03Play3 claims+200 %
- 04The Gentlemen2 claims0 %
- 05Clop2 claims+100 %
Leading groups worldwide
- 01The Gentlemen105 claims · 12 %
- 02Qilin74 claims · 8 %
- 03Storm37 claims · 4 %
- 04Akira36 claims · 4 %
- 05Krybit34 claims · 4 %
Sectors hit in Canada
- Manufacturing8 claims · Play
- Retail and hospitality4 claims · Clop
- Technology3 claims · Qilin
- Services and construction3 claims · M3rx
- Public sector2 claims · Qilin
- Energy2 claims · Medusalocker
Newcomers in Canada
Groups whose first Canadian claim dates from this month.
- N0nsince 2026-09-302 claims
Exploited vulnerabilities
43+39 %
vulnerabilities added to the KEV catalogue this month, none tied to ransomware campaigns per CISA.
Most affected vendors
- Cisco4
- Citrix3
- MikroTik3
- Microsoft3
- Linux3
What it changes for you
The leading groups come in through the same doors every month: remote access without MFA, stolen credentials, unpatched edge devices. The regional board says who is active near you; the actor profiles say how they get in; the KEV catalogue says what to fix first.