/
← Voltar ao feed
medium business services manufacturing healthcare government defense transportation media aerospace finance energy technology

Rapid7 Q3 2026: High-severity flaws exploited in 3 days on average, ransomware dominates, AI limited to 8% of incidents

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 11:45 · coletado há 12 horas

Rapid7's Q3 2026 threat landscape report finds that high-severity vulnerabilities were exploited an average of three days after disclosure, with 71% exploited within the first seven days. 79% of them are classed as 'holy grail' flaws, meaning remote and needing no credentials or user interaction. Ransomware remains the dominant threat. The most targeted sectors were business services, manufacturing and healthcare, and the US took 60% of attacks, followed by Germany (7%), Italy (5%) and Canada (5%). AI was an operational component in only 8% of tracked incidents, and humans still chose targets and objectives in every documented case.

Detalhes técnicos

  • Ransomware groups by claimed incidents: The Gentlemen (342), Qilin (339), INC Ransom (99), DeadLock (98) and Krybit (95).
  • Government victims: up 15% quarter over quarter, with the US share rising from 33% in Q2 to 45% in Q3.
  • AI use: automation is growing in the 'tactical middle' of the attack chain (technique selection, target triage, recovery from failed steps). Attackers use fragmented, multi-session prompting to evade AI provider safeguards. Rapid7 says AI finding flaws is real and accelerating, but an AI exploitation wave did not appear in its data.
  • Nation-state activity: 15 APT groups were tracked, including the Russia-linked ENERGETIC BEAR, Void Blizzard and Sandworm, the China-linked APT31, the North Korea-linked Lazarus, and Pakistan-linked Operation C-Major. Governments are the core target, followed by defense, transportation, media, healthcare, aerospace, finance, energy and technology.
  • Previously undocumented Linux toolkit 'ted': it includes a trojanized HAProxy build, an SSH keylogger and a curl-based RAT. The DPRK has used it against South Korean organizations since early 2025.
  • Operation C-Major: active since the mid-2010s, it uses phishing and mobile spyware to conduct espionage against Indian military and diplomatic staff.
  • Underground activity: access broker listings dominate. 41 of 63 posts advertised RDP or network access, and 14 involved exploits or zero-days. Listings also included bank logins bundled with 'full' identity data for at least three major US banks.

Remediação

  • Prioritize rapid patching of remotely exploitable, unauthenticated flaws, given the roughly three-day exploitation window.
  • Monitor AI API usage patterns from unexpected hosts and processes as a telemetry source.
  • Use dark web monitoring as an early-warning source for access sales and exploit trading.

Linha do tempo

  1. securityweek.com ↗ · pub. 21/10/2026 11:45 · coletado 21/10 12:00 primeiro registro

    Rapid7 Q3 2026: High-severity flaws exploited in 3 days on average, ransomware dominates, AI limited to 8% of incidents

    ler a análise desta fonte

    Rapid7's Q3 2026 threat landscape report finds that high-severity vulnerabilities were exploited an average of three days after disclosure, with 71% exploited within the first seven days. 79% of them are classed as 'holy grail' flaws, meaning remote and needing no credentials or user interaction. Ransomware remains the dominant threat. The most targeted sectors were business services, manufacturing and healthcare, and the US took 60% of attacks, followed by Germany (7%), Italy (5%) and Canada (5%). AI was an operational component in only 8% of tracked incidents, and humans still chose targets and objectives in every documented case.

    Technical Details

    • Ransomware groups by claimed incidents: The Gentlemen (342), Qilin (339), INC Ransom (99), DeadLock (98) and Krybit (95).
    • Government victims: up 15% quarter over quarter, with the US share rising from 33% in Q2 to 45% in Q3.
    • AI use: automation is growing in the 'tactical middle' of the attack chain (technique selection, target triage, recovery from failed steps). Attackers use fragmented, multi-session prompting to evade AI provider safeguards. Rapid7 says AI finding flaws is real and accelerating, but an AI exploitation wave did not appear in its data.
    • Nation-state activity: 15 APT groups were tracked, including the Russia-linked ENERGETIC BEAR, Void Blizzard and Sandworm, the China-linked APT31, the North Korea-linked Lazarus, and Pakistan-linked Operation C-Major. Governments are the core target, followed by defense, transportation, media, healthcare, aerospace, finance, energy and technology.
    • Previously undocumented Linux toolkit 'ted': it includes a trojanized HAProxy build, an SSH keylogger and a curl-based RAT. The DPRK has used it against South Korean organizations since early 2025.
    • Operation C-Major: active since the mid-2010s, it uses phishing and mobile spyware to conduct espionage against Indian military and diplomatic staff.
    • Underground activity: access broker listings dominate. 41 of 63 posts advertised RDP or network access, and 14 involved exploits or zero-days. Listings also included bank logins bundled with 'full' identity data for at least three major US banks.

    Remediation

    • Prioritize rapid patching of remotely exploitable, unauthenticated flaws, given the roughly three-day exploitation window.
    • Monitor AI API usage patterns from unexpected hosts and processes as a telemetry source.
    • Use dark web monitoring as an early-warning source for access sales and exploit trading.