State of the threat
State of the threat, November 2026
What ransomware groups claimed this month, region by region, and what entered the catalogue of exploited vulnerabilities. Every figure is compared with the previous month.
Claims read on 2026-11-04 (ThreatCluster, CC BY 4.0) · KEV catalogue version 2026.11.04 ·
Month in progress, data as of day 04: the comparison with the previous month is partial
- Canada0-100 %28 the previous month
- Québec0-100 %1 the previous month
- United States41-90 %407 the previous month
- Europe20-92 %247 the previous month
- World102-91 %1190 the previous month
Leading groups in Canada
- Nothing this month.
Leading groups worldwide
- 01N0n20 claims · 20 %
- 02Qilin13 claims · 13 %
- 03Akira8 claims · 8 %
- 04Orova7 claims · 7 %
- 05INC Ransom6 claims · 6 %
Sectors hit in Canada
- Nothing this month.
Newcomers in Canada
Groups whose first Canadian claim dates from this month.
- Nothing this month.
Exploited vulnerabilities
2-94 %
vulnerabilities added to the KEV catalogue this month, none tied to ransomware campaigns per CISA.
What it changes for you
The leading groups come in through the same doors every month: remote access without MFA, stolen credentials, unpatched edge devices. The regional board says who is active near you; the actor profiles say how they get in; the KEV catalogue says what to fix first.