CT Signals · Threat intelligence
The threat landscape, measured.
Live indicators from trusted public threat-intelligence sources, analysed by CYBEROCO: the vulnerabilities attackers are exploiting right now, and where ransomware groups are striking.
Live· Refreshed every 6 hours
Data as of 19 October 2026
CISA KEV catalogue v2026.10.16
Ransomware leak-site posts, last 30 days
1,033
+11% vs previous 30 days
Countries affected, last 90 days
120
Active ransomware groups, last 30 days
85
New exploited vulnerabilities, last 30 days
32
Where ransomware is hitting
Organisations posted on ransomware leak sites in the last 90 days, by country. A post is a claim made by a criminal group, not a confirmed breach.
Most affected countries
285 posts did not name a country.
View all countries as a table
| Country | Posts |
|---|---|
| United States | 1,076 |
| Germany | 142 |
| United Kingdom | 113 |
| Brazil | 97 |
| Italy | 95 |
| Canada | 90 |
| India | 84 |
| France | 62 |
| Mexico | 52 |
| Australia | 49 |
| Spain | 46 |
| Argentina | 45 |
| Japan | 39 |
| Türkiye | 39 |
| Switzerland | 38 |
| South Korea | 38 |
| Taiwan | 34 |
| Sweden | 33 |
| Thailand | 28 |
| Netherlands | 25 |
| United Arab Emirates | 24 |
| Singapore | 23 |
| South Africa | 22 |
| Chile | 21 |
| Indonesia | 21 |
| Malaysia | 21 |
| China | 19 |
| Peru | 19 |
| Colombia | 18 |
| Hong Kong | 18 |
| Philippines | 16 |
| Austria | 15 |
| Belgium | 15 |
| Russia | 15 |
| Vietnam | 15 |
| Czechia | 13 |
| Poland | 13 |
| Portugal | 13 |
| Finland | 12 |
| Egypt | 10 |
| Israel | 10 |
| Saudi Arabia | 9 |
| Ireland | 8 |
| Denmark | 7 |
| Ecuador | 7 |
| Greece | 7 |
| Morocco | 6 |
| Myanmar | 6 |
| Nigeria | 6 |
| New Zealand | 6 |
| Romania | 6 |
| Bulgaria | 5 |
| Hungary | 5 |
| Croatia | 4 |
| Norway | 4 |
| Pakistan | 4 |
| Uruguay | 4 |
| Belize | 3 |
| Costa Rica | 3 |
| Cyprus | 3 |
| Iran | 3 |
| Kenya | 3 |
| Kazakhstan | 3 |
| Moldova | 3 |
| Oman | 3 |
| Panama | 3 |
| Qatar | 3 |
| Slovakia | 3 |
| Trinidad and Tobago | 3 |
| Venezuela | 3 |
| Georgia | 2 |
| Guatemala | 2 |
| Haiti | 2 |
| Jamaica | 2 |
| Laos | 2 |
| Lithuania | 2 |
| Luxembourg | 2 |
| Latvia | 2 |
| North Macedonia | 2 |
| Puerto Rico | 2 |
| Serbia | 2 |
| Tanzania | 2 |
| Ukraine | 2 |
| Andorra | 1 |
| Antigua and Barbuda | 1 |
| Anguilla | 1 |
| Albania | 1 |
| Angola | 1 |
| Azerbaijan | 1 |
| Bosnia and Herzegovina | 1 |
| Bangladesh | 1 |
| Bhutan | 1 |
| Cote d'Ivoire | 1 |
| Algeria | 1 |
| Estonia | 1 |
| Gabon | 1 |
| Ghana | 1 |
| Honduras | 1 |
| Iraq | 1 |
| Iceland | 1 |
| Jordan | 1 |
| Kuwait | 1 |
| Mali | 1 |
| Mongolia | 1 |
| Macao | 1 |
| Montserrat | 1 |
| Malta | 1 |
| Mauritius | 1 |
| Namibia | 1 |
| Paraguay | 1 |
| Reunion | 1 |
| Senegal | 1 |
| Somalia | 1 |
| El Salvador | 1 |
| Timor-Leste | 1 |
| Uganda | 1 |
| Uzbekistan | 1 |
| Vanuatu | 1 |
| Samoa | 1 |
| Yemen | 1 |
Leak-site posts per week
Rolling 7-day windows over the last 13 weeks.
View weekly figures as a table
| Week | Posts |
|---|---|
| 21 Jul – 27 Jul | 261 |
| 28 Jul – 3 Aug | 186 |
| 4 Aug – 10 Aug | 306 |
| 11 Aug – 17 Aug | 240 |
| 18 Aug – 24 Aug | 275 |
| 25 Aug – 31 Aug | 260 |
| 1 Sept – 7 Sept | 175 |
| 8 Sept – 14 Sept | 167 |
| 15 Sept – 21 Sept | 216 |
| 22 Sept – 28 Sept | 197 |
| 29 Sept – 5 Oct | 229 |
| 6 Oct – 12 Oct | 289 |
| 13 Oct – 19 Oct | 279 |
Most targeted sectors
Last 90 days
317 posts had no sector.
View sectors as a table
| Sector | Posts |
|---|---|
| Manufacturing | 494 |
| Technology | 374 |
| Professional Services | 343 |
| Healthcare | 315 |
| Other | 281 |
| Retail & E-Commerce | 173 |
| Financial Services | 161 |
| Transportation | 151 |
| Education | 110 |
| Energy & Utilities | 95 |
Most active ransomware groups
Last 30 days
View groups as a table
| Group | Posts |
|---|---|
| The Gentlemen | 135 |
| N0n | 115 |
| Qilin | 94 |
| INC Ransom | 37 |
| Nightspire | 36 |
| Akira | 32 |
| Storm | 28 |
| Wallstreet | 26 |
| SafePay | 25 |
| Settra | 24 |
Egypt and the Arab world
Leak-site posts naming organisations in Arab League member states over the last 90 days.
View the Arab world figures as a table
| Country | Posts |
|---|---|
| United Arab Emirates | 24 |
| Egypt | 10 |
| Saudi Arabia | 9 |
| Morocco | 6 |
| Oman | 3 |
| Qatar | 3 |
| Algeria | 1 |
| Iraq | 1 |
| Jordan | 1 |
| Kuwait | 1 |
| Somalia | 1 |
| Yemen | 1 |
What attackers are exploiting
CISA's Known Exploited Vulnerabilities (KEV) catalogue lists flaws with confirmed exploitation in the wild. If you run any of these products, these are the patches to prioritise.
New entries per month
Last 24 complete months
- Other exploitation
- Used in ransomware
View monthly figures as a table
| Month | Total | Used in ransomware |
|---|---|---|
| October 2024 | 17 | 4 |
| November 2024 | 22 | 5 |
| December 2024 | 16 | 4 |
| January 2025 | 14 | 6 |
| February 2025 | 27 | 3 |
| March 2025 | 32 | 4 |
| April 2025 | 15 | 4 |
| May 2025 | 24 | 2 |
| June 2025 | 20 | 1 |
| July 2025 | 20 | 4 |
| August 2025 | 15 | 1 |
| September 2025 | 16 | 1 |
| October 2025 | 31 | 3 |
| November 2025 | 11 | 0 |
| December 2025 | 20 | 2 |
| January 2026 | 17 | 2 |
| February 2026 | 28 | 2 |
| March 2026 | 26 | 2 |
| April 2026 | 31 | 9 |
| May 2026 | 21 | 3 |
| June 2026 | 23 | 3 |
| July 2026 | 26 | 4 |
| August 2026 | 31 | 2 |
| September 2026 | 43 | 0 |
Most affected vendors
Last 12 months
View vendors as a table
| Vendor | Entries |
|---|---|
| Microsoft | 44 |
| Cisco | 20 |
| Fortinet | 12 |
| Apple | 11 |
| 10 | |
| Linux | 8 |
| Adobe | 7 |
| Citrix | 6 |
| Ivanti | 6 |
| Oracle | 6 |
Latest additions
| CVE | Vendor & product | Vulnerability | Added | Ransomware use |
|---|---|---|---|---|
| CVE-2026-102764 | BeyondTrust Remote Support | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | 16 Oct | Not known |
| CVE-2025-61624 | Fortinet Multiple Products | Fortinet Multiple Products Path Traversal Vulnerability | 16 Oct | Not known |
| CVE-2026-21589 | Atlassian Multiple Products | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 15 Oct | Not known |
| CVE-2026-76519 | Cisco Secure Email Gateway | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | 14 Oct | Not known |
| CVE-2026-105134 | Ahsay AhsayCBS | Ahsay AhsayCBS Command Injection Vulnerability | 14 Oct | Not known |
| CVE-2026-105133 | Ahsay AhsayCBS | Ahsay AhsayCBS Improper Authentication Vulnerability | 14 Oct | Not known |
| CVE-2026-0322 | Palo Alto Networks PAN-OS | Palo Alto Networks PAN-OS Code Injection Vulnerability | 14 Oct | Not known |
| CVE-2026-96951 | Microsoft Windows | Microsoft Windows Command Injection Vulnerability | 13 Oct | Not known |
Ransomware Trends Targeting Mid-Market Financial Services
As mid-market banks and payment processors modernise faster than their security programmes can keep up, they've become a disproportionately targeted segment for ransomware and extortion groups.
This report examines the access patterns, extortion tactics, and regulatory blind spots driving that shift.
- Mid-market financial institutions are now targeted at a similar rate to large enterprises, with far less mature detection and response capability.
- Third-party vendor access remains the most consistent initial access vector across the incidents we reviewed.
- Double-extortion tactics are increasingly paired with regulatory-disclosure threats, adding pressure beyond the ransom itself.
Every volume, one domain
Ransomware Trends Targeting Mid-Market Financial Services
Volume 01 — access patterns, extortion tactics and regulatory blind spots.
Learn moreAI-Assisted Phishing: How Automation Is Reshaping Social Engineering
Volume 02 — register interest and we'll send it on release.
Learn moreSecuring the SaaS Supply Chain: Third-Party Risk in 2027
Volume 03 — register interest and we'll send it on release.
Learn moreHow to read this data
- Exploited vulnerabilities come from the CISA Known Exploited Vulnerabilities catalogue, a US Government public-domain dataset of flaws with confirmed exploitation.
- Ransomware activity counts posts on ransomware groups' leak sites as tracked by Ransomware.live, grouped by the date they were first observed. Posts are criminals' claims and are not independently verified.
- We never show victim names. Only totals by country, sector and group are published.
- Figures refresh automatically every six hours.
- Recent weeks can rise as late leak-site posts are discovered.
Sources: CISA KEV · Source: Ransomware.live · Natural Earth