Information-Sector Attacks Rose 48% in Q3 2026
Summary
ReliaQuest says information-sector attacks rose 48% in Q3 2026, with more ransomware leak-site listings and exploited CVEs. It recommends defenses against phishing, account abuse, and web shells; its customers’ mean containment time fell to 21 minutes.
Key points
- ReliaQuest reports attacks against information-sector customers rose 48% from Q2 to Q3 2026; organizations listed on ransomware data-leak sites increased 61%.
- Qilin and The Gentlemen were recurring operators; Cyberleek appeared in the latest period, while DragonForce and ShinyHunters did not.
- Observed exploited CVEs increased from 62 to 109, and same-day exploitation increased from 17 to 32, despite average time to exploitation rising from nine to 11 days.
- Web shells led observed techniques at 13%; the article recommends monitoring web roots, hunting internet-facing servers for web shells, and reviewing web-server processes.
- Other recommended defenses include phishing-resistant MFA for VPN and remote administration, rapid patching of edge devices, application control, and EDR detections for credential theft and mass file staging.
- Information-sector customers’ mean time to contain fell from 1 hour 17 minutes to 21 minutes; customers using Automated Response Playbooks averaged five minutes.
Article Details
- Publisher
- Reliaquest
- Report Period
- Q3 2026, with comparisons to Q2 2026
- Scope
- Cybersecurity activity, observed techniques, ransomware leak-site listings, and containment results for information-sector organizations.
- Key Statistics
- Attacks against information-sector customers rose 48% in Q3 2026.
- Information-sector organizations named on ransomware data-leak sites increased 61% from Q2 to Q3.
- Average time to exploitation increased from 9 to 11 days; CVEs observed being exploited increased from 62 to 109.
- CVEs exploited on the day of disclosure increased from 17 to 32.
- Information-sector customers reduced mean time to contain from 1 hour 17 minutes to 21 minutes during Q3; customers using Automated Response Playbooks averaged 5 minutes.
- Recommendations
- Prioritize phishing-resistant MFA for VPN and remote administration.
- Patch edge devices quickly.
- Use application control to block unapproved tools and tune EDR detections for credential theft and mass file staging.
- Monitor web roots for new or modified files and hunt for web shells on internet-facing servers.
- Review web-server processes for unexpected child processes or outbound connections.
MITRE ATT&CK
T1027.009 · Embedded PayloadsEmbedded Payloads' share of observed techniques declined from 7% to 2% compared with the prior period.T1078 · Valid AccountsValid Accounts accounted for 4% of observed techniques.T1078.002 · Domain AccountsDomain Accounts gained share compared with the prior period.T1190 · Exploit Public-Facing ApplicationExploit Public-Facing Application's share of observed techniques fell from 11% to 4% compared with the prior period.T1496.001 · Compute HijackingCompute Hijacking gained share compared with the prior period.T1505.003 · Web ShellWeb Shell was the most observed technique in the information sector at 13%.T1546.008 · Accessibility FeaturesAccessibility Features accounted for 4% of observed techniques and gained share compared with the prior period.T1566 · PhishingPhishing accounted for 5% of observed techniques.T1566.002 · Spearphishing LinkSpearphishing Link accounted for 7% of observed techniques.
Threat Actors
CyberLeekReported as appearing in the latest period and showing disproportionate information-sector activity.DragonForceReported as appearing in the prior period but not the latest period among ransomware and extortion operators.QilinDescribed in the report as a recurring ransomware operator in the information sector.ShinyHuntersReported as appearing in the prior period but not the latest period among ransomware and extortion operators.The GentlemenDescribed in the report as a recurring ransomware operator in the information sector.
Products
Agentic TeammatesGreyMatter’s Agentic Teammates bring that evidence into a connected investigation, assembling context across tools rather than leaving analysts to reconstruct each incident manually. Automated Response Playbooks executeAutomated Response Playbookscontext across tools rather than leaving analysts to reconstruct each incident manually. Automated Response Playbooks execute predefined actions—such as revoking compromised sessions or isolating affectedGreyMatterGreyMatter’s Universal Translator normalizes telemetry from connected endpoint, identity, cloud, and network tools into a common schema. Information-sector teams can connect suspicious account activity with server andTransitDetection at source runs detection logic at integrated technologies, while Transit applies multi-event detection to streaming data before it is indexed or stored. Security teams can identify related behaviors withoutUniversal TranslatorGreyMatter’s Universal Translator normalizes telemetry from connected endpoint, identity, cloud, and network tools into a common schema. Information-sector teams can connect suspicious account activity with server and