Report Date: 2026-10-20
New KEVs: 0 ▼ -5 vs last weekRansomware Victims: 260 ▲ +26 vs last week
No new vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog during this reporting window. Threat intelligence sources this period reference Qilin. Ransomware activity is moderate with 260 new victims posted to leak sites over the last 7 days, with N0N posting the most victims.
On this page
Top KEVs
No qualifying KEVs were identified in the current reporting window.
Security News
Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.
Threat Actors Mentioned
Qilin
- CISA ICS AdvisoryAdvisory · 5 days ago – CISA Malcolm
View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334) Malcolm <=v26.08.0 (CVE-2026-107333, C… - CISA ICS AdvisoryAdvisory · 5 days ago – Guangzhou Juan IoT Technology EseeCloud
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeClo… - CISA ICS AdvisoryAdvisory · 5 days ago – Eclipse Foundation Eclipse Milo
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to al… - SANS ISCResearch · 4 days ago – Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th)
I believe the cybersecurity industry may be approaching AI security the wrong way.
 - SANS ISCResearch · 7 days ago – October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today&… - Unit 42Research · yesterday – Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated O… - Unit 42Incident · 4 days ago – Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 20… - Sophos X-OpsIncident · yesterday – Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion
No novelty required to be effective Categories: Threat Research, X-ops, Sophos SecOps Tags: incident response - Sophos X-OpsResearch · yesterday – ConnectWise Cloud Backup application abused in cross-tenant token sweep
<p>Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants</p> Categories: Threat Research Tags: connectwise - The RecordIncident · yesterday – ConnectWise suspends Cloud Backup service after supply chain attack
ConnectWise initially said on Friday that it was investigating âattempts of unauthorized access associated with the ConnectWise Cloud Backup environment,â and confirmed such access on Saturday. - The RecordNews · yesterday – Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands
Ahold Delhaize, the Dutch multinational grocery retailer, said Monday that a cyberattack forced it to take systems offline across most of its U.S. and European brands, impacting shoppers on both sides of the Atlantic. - Security Affairs (APT)Incident · 5 days ago – Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future published a detailed paper on a… - Security Affairs (APT)Incident · 12 days ago – U.S. Offers $10 Million Reward for Alleged HAFNIUM Hacker Zhang Yu
The U.S. offers $10M for Zhang Yu, accused of helping run HAFNIUM attacks that compromised thousands of organizations worldwide. The U.S. State Department is offering a $10 million reward for information leading to the a… - Security Affairs (Cybercrime)Incident · yesterday – Attackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365
Attackers stole ConnectWise application credentials to access Microsoft 365 tenants, prompting the company to suspend cloud services. ConnectWise suspended its Cloud Backup service and took both SaaS Security and Cloud M… - Security Affairs (Cybercrime)Incident · 2 days ago – Rust-Based CikaBika Bot Turns Discord into a Command Center
CikaBika Bot uses fake documents to infect Windows systems, then abuses Discord and Ngrok to execute commands, spy on victims, and steal files. Darktrace researchers have documented a new campaign distributing a remote a…
Ransomware Activity
Victim counts posted to ransomware group leak sites — use this to gauge which groups are most active and which sectors and regions are being targeted.
24 new victims posted today
7-day total: 260 via Ransomware.live
Most Active Groups
Group Intelligence
- Thegentlemen — The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
- Qilin — Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
- Lockbit5 — LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.
Most Targeted Sectors
Top Countries
US (95), BR (13), GB (11), SE (10), DE (7)
Notable Incidents
- Interseguro (Financial Services · PE) — claimed by Direwolf. Insurance Press coverage →
- saintpierredescorps.fr (Other · FR) — claimed by Lockbit5. Une administration publique française. Voici les informations professionnelles et juridiques disp… Press coverage →
- japantimes.co.jp (Other · JP) — claimed by Eclipse. [AI generated] The Japan Times is Japan's oldest and largest English-language newspaper, founded in 1897. It operates in the media and publishing industry, providing news, analysis, and commentary on Japanese politics, b… Press coverage →
- Commune Du Tampon (Government & Defense · RE) — claimed by Qilin. N/A Press coverage →
Vendor-Specific Risks
No vendors with confirmed KEV exploitation were identified this reporting window — a quiet week for the KEV catalog.
Stay Ahead
Found this useful? Get the daily report in your reader.
Free. No account. No email. Follow in Feedly, Inoreader, or any RSS reader.