Rapid7: High-Severity Flaws Exploited in Three Days as Ransomware Leads Q3 Threats
Summary
Rapid7 reports that high-severity flaws were exploited within three days on average in Q3 2026, while ransomware remained dominant. AI appeared in 8% of tracked incidents, with humans still directing targets and objectives.
Key points
- High-severity vulnerabilities were exploited an average of three days after disclosure; 71% were exploited within seven days.
- Rapid7 classified 79% of the high-severity vulnerabilities as remote flaws requiring neither credentials nor local user involvement.
- Ransomware activity most often targeted business services, manufacturing, and healthcare. The US accounted for 60% of attacks tracked.
- The Gentlemen and Qilin led reported ransomware incidents, with 342 and 339 claimed incidents, respectively.
- AI was cited as an operational component in 8% of tracked incidents. Humans chose targets and objectives in every documented case, though some tactical tasks were automated.
- Rapid7 described a previously undocumented DPRK-linked Linux toolkit used against South Korean organizations since early 2025, including a backdoor, SSH keylogger, and curl-based RAT.
- Forty-one of 63 underground posts advertised RDP or network access, which Rapid7 says can provide defenders with early warning of potential attacks.
Article Details
- Publisher
- Rapid7
- Report Period
- Q3 2026
- Scope
- Global threat activity, including vulnerability exploitation, ransomware, AI use, nation-state and cybercrime activity, and dark-web listings.
- Sample Size
- 15 nation-state and cybercrime groups tracked; the total number of incidents is not disclosed.
- Key Statistics
- High-severity vulnerabilities were exploited an average of three days after disclosure; 71% were exploited within seven days.
- Rapid7 classified 79% of the vulnerabilities discussed as “holy grail” flaws: remote and requiring neither credentials nor local user involvement.
- The US accounted for 60% of attacks, followed by Germany at 7%, Italy at 5%, and Canada at 5%.
- AI was cited as an operational component in 8% of tracked incidents; the report says humans chose what to attack and why in every documented case.
- 41 of 63 underground posts advertised RDP or network access; 14 involved the sale, sharing, or discussion of exploits and zero-days.
- Recommendations
- Monitor AI API usage patterns from unexpected hosts and processes as a source of telemetry, and look for unusual or unauthorized use of AI tools.
MITRE ATT&CK
People
Threat Actors
APT31Identified as a China-linked APT group.DeadlockReported among the most successful ransomware groups, with 98 claimed incidents.Energetic BearIdentified as a Russia-linked APT group.INC RansomReported as the third most successful ransomware group, with 99 claimed incidents.KrybitReported among the most successful ransomware groups, with 95 claimed incidents.LazarusIdentified as a North Korea-linked APT group.Operation C-MajorIdentified as a Pakistan-linked group; reported to use phishing and mobile spyware for espionage against Indian military and diplomatic staff.QilinReported among the most successful ransomware groups, with 339 claimed incidents.SandwormIdentified as a Russia-linked APT group.TA488Identified as a Russia-linked APT group.The GentlemenReported among the most successful ransomware groups, with 342 claimed incidents.
Malware
Vendors
Products
Countries
CanadaThe US was the most targeted nation (60% of attacks), followed by Germany (7%), Italy (5%) and Canada (5%).ChinaAPT31 is China linked, Lazarus is North Korea, and Operation C-Major is Pakistan.GermanyThe US was the most targeted nation (60% of attacks), followed by Germany (7%), Italy (5%) and Canada (5%).ItalyThe US was the most targeted nation (60% of attacks), followed by Germany (7%), Italy (5%) and Canada (5%).North KoreaAPT31 is China linked, Lazarus is North Korea, and Operation C-Major is Pakistan.PakistanAPT31 is China linked, Lazarus is North Korea, and Operation C-Major is Pakistan.RussiaNoteworthy examples include ENERGETIC BEAR, Void Blizzard, and Sandworm which are all Russia linked.
Industries
AerospaceOther sectors include defense, transportation, media, healthcare, aerospace, finance, energy, and technology.business servicesThe most targeted sectors in Q3 were business services, manufacturing, and healthcare.DefenseOther sectors include defense, transportation, media, healthcare, aerospace, finance, energy, and technology.EnergyOther sectors include defense, transportation, media, healthcare, aerospace, finance, energy, and technology.financeOther sectors include defense, transportation, media, healthcare, aerospace, finance, energy, and technology.GovernmentGovernment sector victims of ransomware are increasing (up 15% on the previous three months) and are also focused on the US (with its share growing from 33% in Q2 to 45% in Q3).HealthcareThe most targeted sectors in Q3 were business services, manufacturing, and healthcare.ManufacturingThe most targeted sectors in Q3 were business services, manufacturing, and healthcare.MediaOther sectors include defense, transportation, media, healthcare, aerospace, finance, energy, and technology.TechnologyOther sectors include defense, transportation, media, healthcare, aerospace, finance, energy, and technology.TransportationOther sectors include defense, transportation, media, healthcare, aerospace, finance, energy, and technology.