Kaspersky’s Q3 2026 Threat Report Tracks Ransomware, macOS and IoT Activity
Summary
Kaspersky's Q3 2026 telemetry report records 311 million web attacks, 81,556 users targeted by ransomware and 217,024 targeted by miners, alongside findings on macOS, IoT and regional threat trends.
Key points
- Kaspersky products blocked 311,083,655 attacks from online resources and recorded 23,733,652 malicious or potentially unwanted objects; the report says its statistics generally rely on product detections and data shared by consenting users.
- Products detected 4,470 new ransomware variants, more than 1.5 times the previous quarter’s count, and recorded ransomware attacks affecting 81,556 unique users.
- Qilin accounted for 15.39% of victims listed on the ransomware leak sites reviewed during the quarter; this is leak-site monitoring data, not independent confirmation of each claimed incident.
- The report describes Qilin exploiting CVE-2026-0257 in Palo Alto Networks firewall software and lists several other vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog.
- macOS findings include PamStealer’s use of Pluggable Authentication Modules, the Overlord backdoor distributed as fake Zoom installers, and malicious npm, PyPI and Rust packages delivering stealers or backdoors.
- On Kaspersky IoT honeypots, SSH accounted for 18.42% of attacking devices; Pakistan accounted for 47.73% of Telnet attacks, while Mirai’s share of the overall IoT threat distribution declined.
Article Details
- Publisher
- Securelist (Kaspersky)
- Report Period
- Q3 2026
- Scope
- Global desktop and IoT threat statistics, including ransomware, macOS, web-based, and local threats, based primarily on Kaspersky product detections and IoT honeypots.
- Sample Size
- Kaspersky users who consented to sharing statistical data; exact count not disclosed.
- Key Statistics
- Kaspersky products blocked 311,083,655 attacks launched from online resources during Q3 2026.
- Web Anti-Virus responded to 46,936,926 unique URLs during Q3 2026.
- Kaspersky products detected 4,470 new ransomware variants during Q3 2026, more than 1.5 times the previous quarter's count.
- Kaspersky products protected 81,556 unique users from ransomware attacks during Q3 2026.
- Kaspersky detected miner attacks on 217,024 unique users worldwide during Q3 2026.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationResearchers reported that Qilin exploited CVE-2026-0257 in Palo Alto Networks firewall software to bypass authentication and compromise victim networks.T1486 · Data Encrypted for ImpactThe article reports that Ryuk members encrypted data on breached organizations' networks.
CVE
CVE-2025-14733WatchGuard · Fireware OSCVE-2025-14733 in WatchGuard Firebox also enabled unauthenticated remote code execution.CVE-2025-60710Microsoft · Windows 11 Version 24H2; Microsoft · Windows 11 Version 25H2; +2 moreCVE-2025-60710 in Microsoft Windows allowed attackers to escalate privileges locally.CVE-2026-0257Palo Alto Networks · PAN-OS; Palo Alto Networks · Prisma Access; +1 moreIn July, researchers published a report on the Qilin group exploiting the CVE-2026-0257 vulnerability in Palo Alto Networks firewall software.CVE-2026-15409SonicWall · SMA1000CVE-2026-15409/CVE-2026-15410 in SonicWall SMA1000 remote access gateways.CVE-2026-15410SonicWall · SMA1000CVE-2026-15409/CVE-2026-15410 in SonicWall SMA1000 remote access gateways.CVE-2026-45659Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 moreCVE-2026-45659 in Microsoft SharePoint Server allowed an authenticated, low-privileged attacker to achieve remote code execution.CVE-2026-59310VMware · Cloud Foundation; VMware · Telco Cloud Infrastructure; +3 moreCVE-2026-59310 in VMware vCenter enabled unauthenticated remote code execution.CVE-2026-63077JetBrains · TeamCityCVE-2026-63077 in JetBrains TeamCity allowed OS commands to run with the privileges of the TeamCity server process by way of an authentication bypass through the agent polling protocol.
Threat Actors
ContiA member of the Conti RaaS group was sentenced for attacks on companies in 2021 and 2022 and for developing part of the group's malware toolkit.DeadlockListed among the most prolific ransomware groups, accounting for 4.46% of victims published on the data leak sites under review; the article describes it as a relatively young ransomware family.INC RansomResearchers linked activity involving exploitation of CVE-2026-15409 and CVE-2026-15410 to INC Ransom; CISA did not specify which groups exploited these vulnerabilities.QilinResearchers reported that Qilin exploited CVE-2026-0257 to bypass authentication and compromise victims' networks. Qilin was also among the most prolific ransomware groups by victims listed on data leak sites during the reporting period.Ransom CartelThe article reports that the operation's creator and lead administrator was sentenced to 16 years in prison; he had played a central role in running the RaaS operation and supporting its attacks.RyukA member of the Ryuk RaaS group and accomplices were reported to have breached organizations' networks and encrypted data in 2019 and 2020.The GentlemenListed as a ransomware group whose data leak site victim count represented 7.89% of the victims published across the sites under review during the reporting period.
Malware
Atomic macOS Stealer (AMOS)We’re also seeing more detections of the well-known Amos malware, both the traditional stealer and a version with backdoor functionality.DeadLockA notable newcomer on the list is Deadlock (4.46%), a relatively young ransomware family first reported in July 2025.MacSyncIn the third quarter, we discovered an updated version of the MacSync crypto stealer and backdoor with a significantly changed payload delivery method.MiraiMirai’s share of the overall IoT threat distribution declined, while other botnet threats that deliver malware grew.OverlordIn August, Jamf researchers also reported discovering a new backdoor, Overlord.Pam StealerAt the beginning of the third quarter, Jamf researchers discovered a new stealer, PamStealer.RyukIn September, a member of the Ryuk RaaS group was sentenced to two years in prison and three years of supervised release.
Vendors
JetBrainsCVE-2026-63077 in JetBrains TeamCity allowed OS commands to run with the privileges of the TeamCity server process by way of an authentication bypass through the agent polling protocol.KasperskyThe statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated.MicrosoftCVE-2026-45659 in Microsoft SharePoint Server allowed an authenticated, low-privileged attacker to achieve remote code execution.Palo Alto NetworksIn July, researchers published a report on the Qilin group exploiting the CVE-2026-0257 vulnerability in Palo Alto Networks firewall software.SonicWallCVE-2026-15409/CVE-2026-15410 in SonicWall SMA1000 remote access gateways.VMwareCVE-2026-59310 in VMware vCenter enabled unauthenticated remote code execution.WatchGuardCVE-2025-14733 in WatchGuard Firebox also enabled unauthenticated remote code execution.
Products
FireboxCVE-2025-14733 in WatchGuard Firebox also enabled unauthenticated remote code execution.JetBrains TeamCityCVE-2026-63077 in JetBrains TeamCity allowed OS commands to run with the privileges of the TeamCity server process by way of an authentication bypass through the agent polling protocol.Microsoft WindowsCVE-2025-60710 in Microsoft Windows allowed attackers to escalate privileges locally.SharePoint ServerCVE-2026-45659 in Microsoft SharePoint Server allowed an authenticated, low-privileged attacker to achieve remote code execution.SMA1000CVE-2026-15409/CVE-2026-15410 in SonicWall SMA1000 remote access gateways.VMware vCenter ServerCVE-2026-59310 in VMware vCenter enabled unauthenticated remote code execution.