Kaspersky Q3 2026: ransomware variants up 1.5x, Qilin leads leak-site victims, 311 million web attacks blocked
Kaspersky published its Q3 2026 statistics on desktop and IoT threats, based on detection verdicts from its products and on data from users who consented to share it. In the quarter Kaspersky counted 4,470 new ransomware variants (more than 1.5 times the Q2 count), 81,556 users hit by ransomware and 217,024 users attacked by miners. Qilin accounted for 15% of the victims published on leak sites, followed by The Gentlemen (7.89%) and the newcomer Deadlock (4.46%). Web Anti-Virus blocked more than 311 million attacks from online resources, and local Malware detections reached 10.88% of users' computers on average. The article gives no new IOCs and no vendor patch data, so its value for a defender is the list of KEV-listed flaws that ransomware groups exploited, which makes the operational urgency medium.
Entenda a falha
A vulnerabilidade
The story is a Kaspersky statistics report, so it gives only short descriptions of the flaws. CVE-2026-59310 (VMware vCenter) and CVE-2025-14733 (WatchGuard Firebox) allow unauthenticated remote code execution. CVE-2026-63077 (JetBrains TeamCity) is an authentication bypass through the agent polling protocol that runs OS commands with the TeamCity server's privileges. CVE-2026-0257 (Palo Alto Networks firewall software) bypasses authentication without valid accounts, and Qilin was reported exploiting it in July. CVE-2026-45659 (SharePoint Server) gives RCE to an authenticated low-privileged attacker. CVE-2025-60710 (Windows) is a local privilege escalation. CVE-2026-15409 and CVE-2026-15410 affect SonicWall SMA1000 gateways. CISA lists all of them in the KEV catalog as exploited by ransomware groups. The articles give no affected or fixed versions.
Como funciona
The articles describe the mechanism only for TeamCity: the flaw sits in the agent polling protocol, which the server uses to talk to build agents. An unauthenticated request over that protocol gets past authentication, and the attacker can then run OS commands with the server process's privileges. That level of access can expose configurations, credentials and CI/CD pipelines. For the other CVEs the articles say only what the attacker needs (no authentication for vCenter, Firebox and the Palo Alto flaw; a low-privileged account for SharePoint; local access for Windows) and what they get, not the internal steps.
Por que é vulnerável
The articles do not give root causes for any of these flaws. They only classify them: authentication bypass (TeamCity, Palo Alto), unauthenticated RCE (vCenter, Firebox), authenticated RCE (SharePoint) and local privilege escalation (Windows). They also say nothing about why the flaws went unnoticed or what the fixes change.
Como foi descoberta
The articles do not say who found the flaws or how. They show that CISA added CVE-2026-15409, CVE-2026-15410, CVE-2026-45659, CVE-2025-60710, CVE-2026-59310, CVE-2025-14733 and CVE-2026-63077 to its KEV catalog as actively exploited by ransomware groups. CISA does not name the groups for the SonicWall flaws, but researchers linked that activity to INC Ransom. In July, researchers published a report on Qilin exploiting CVE-2026-0257 in Palo Alto Networks firewall software.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 06:16.
Detalhes técnicos
- Ransomware KEV entries: the article lists CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 gateways, which researchers linked to INC Ransom although CISA does not name the groups; CVE-2026-45659 in Microsoft SharePoint Server, an RCE for an authenticated low-privileged attacker; CVE-2025-60710 in Microsoft Windows, a local privilege escalation; CVE-2026-59310 in VMware vCenter and CVE-2025-14733 in WatchGuard Firebox, both unauthenticated RCE; and CVE-2026-63077 in JetBrains TeamCity, an authentication bypass through the agent polling protocol that allows OS commands with server privileges.
- Palo Alto Networks: in July, researchers reported Qilin exploiting CVE-2026-0257 in the firewall software to bypass authentication without valid accounts.
- Enforcement: the creator of the Ransom Cartel RaaS was sentenced to 16 years, a Ryuk member to two years, and a Conti member to four years.
- macOS: Jamf researchers described PamStealer, which uses Pluggable Authentication Modules to verify the administrator password, and the Overlord backdoor distributed as fake Zoom installers with microphone, camera, screen capture and keylogging functions. The article also reports an updated MacSync with a changed payload delivery method, and a rising share of Ngrok and Amos detections.
- Supply chain: Socket researchers documented a malicious npm package, jscrambler, carrying a Rust infostealer that targets crypto wallets, service secrets, browsers and AI agent API keys; malicious Rust crates arrayref, internment and append-only-vec delivering a Rust backdoor; and malicious MemTensor npm and PyPI packages delivering a Go backdoor.
- IoT: the share of devices attacking Kaspersky SSH honeypots grew to 18.42%, Mirai's share of IoT threats declined, and Pakistan's share of Telnet attacks reached 47.73%.
Remediação
- Prioritize the KEV-listed flaws above, starting with the unauthenticated RCE entries in VMware vCenter and WatchGuard Firebox and the internet-facing SonicWall gateways.
- Review build and runtime dependencies pulled from npm, PyPI and Cargo for the packages named above.
- The article publishes no IOCs; rely on vendor detections and hunt for the described behaviours.
Linha do tempo
-
Kaspersky Q3 2026: ransomware variants up 1.5x, Qilin leads leak-site victims, 311 million web attacks blocked
ler a análise desta fonte ocultar
Kaspersky published its Q3 2026 statistics on desktop and IoT threats, based on detection verdicts from its products and on data from users who consented to share it. In the quarter Kaspersky counted 4,470 new ransomware variants (more than 1.5 times the Q2 count), 81,556 users hit by ransomware and 217,024 users attacked by miners. Qilin accounted for 15% of the victims published on leak sites, followed by The Gentlemen (7.89%) and the newcomer Deadlock (4.46%). Web Anti-Virus blocked more than 311 million attacks from online resources, and local Malware detections reached 10.88% of users' computers on average. The article gives no new IOCs and no vendor patch data, so its value for a defender is the list of KEV-listed flaws that ransomware groups exploited, which makes the operational urgency medium.
Technical Details
- Ransomware KEV entries: the article lists CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 gateways, which researchers linked to INC Ransom although CISA does not name the groups; CVE-2026-45659 in Microsoft SharePoint Server, an RCE for an authenticated low-privileged attacker; CVE-2025-60710 in Microsoft Windows, a local privilege escalation; CVE-2026-59310 in VMware vCenter and CVE-2025-14733 in WatchGuard Firebox, both unauthenticated RCE; and CVE-2026-63077 in JetBrains TeamCity, an authentication bypass through the agent polling protocol that allows OS commands with server privileges.
- Palo Alto Networks: in July, researchers reported Qilin exploiting CVE-2026-0257 in the firewall software to bypass authentication without valid accounts.
- Enforcement: the creator of the Ransom Cartel RaaS was sentenced to 16 years, a Ryuk member to two years, and a Conti member to four years.
- macOS: Jamf researchers described PamStealer, which uses Pluggable Authentication Modules to verify the administrator password, and the Overlord backdoor distributed as fake Zoom installers with microphone, camera, screen capture and keylogging functions. The article also reports an updated MacSync with a changed payload delivery method, and a rising share of Ngrok and Amos detections.
- Supply chain: Socket researchers documented a malicious npm package, jscrambler, carrying a Rust infostealer that targets crypto wallets, service secrets, browsers and AI agent API keys; malicious Rust crates arrayref, internment and append-only-vec delivering a Rust backdoor; and malicious MemTensor npm and PyPI packages delivering a Go backdoor.
- IoT: the share of devices attacking Kaspersky SSH honeypots grew to 18.42%, Mirai's share of IoT threats declined, and Pakistan's share of Telnet attacks reached 47.73%.
Remediation
- Prioritize the KEV-listed flaws above, starting with the unauthenticated RCE entries in VMware vCenter and WatchGuard Firebox and the internet-facing SonicWall gateways.
- Review build and runtime dependencies pulled from npm, PyPI and Cargo for the packages named above.
- The article publishes no IOCs; rely on vendor detections and hunt for the described behaviours.