State of the threat
State of the threat, October 2026
What ransomware groups claimed this month, region by region, and what entered the catalogue of exploited vulnerabilities. Every figure is compared with the previous month.
Claims read on 2026-10-09 (ThreatCluster, CC BY 4.0) · KEV catalogue version 2026.10.08 ·
Month in progress, data as of day 09: the comparison with the previous month is partial
- Canada7-76 %29 the previous month
- Québec0-100 %3 the previous month
- United States89-68 %275 the previous month
- Europe46-77 %200 the previous month
- World248-72 %878 the previous month
Leading groups in Canada
- 01Storm2 claims-60 %
- 02Arcusmedia1 claim0 %
- 03Cry01 claim
- 04N0n1 claim0 %
- 05The Gentlemen1 claim-50 %
Leading groups worldwide
- 01Qilin24 claims · 10 %
- 02Nightspire24 claims · 10 %
- 03INC Ransom15 claims · 6 %
- 04Akira12 claims · 5 %
- 05SafePay10 claims · 4 %
Sectors hit in Canada
- Healthcare3 claims · Storm
- Manufacturing1 claim · The Gentlemen
- Finance1 claim · N0n
- Energy1 claim · Cry0
Newcomers in Canada
Groups whose first Canadian claim dates from this month.
- Nothing this month.
Exploited vulnerabilities
9-79 %
vulnerabilities added to the KEV catalogue this month, none tied to ransomware campaigns per CISA.
Most affected vendors
- Zammad GmbH2
- Strapi1
- ONLYOFFICE1
- Apache1
- ISC1
What it changes for you
The leading groups come in through the same doors every month: remote access without MFA, stolen credentials, unpatched edge devices. The regional board says who is active near you; the actor profiles say how they get in; the KEV catalogue says what to fix first.