September cooled off, but Q3 was the worst ransomware quarter on record
Monthly victim counts, active ransomware groups, and sector-level shifts, compiled from public incident trackers. August's record spike eased in September, yet the quarter as a whole set a new high.
Year to date through September: 6,854 victims. September's top groups shifted: Qilin's count halved (157→75) while Akira (27→39) and INC Ransom (36→40) grew.
Every tracked sector rose quarter over quarter. Comparitech hasn't published a September-only sector breakdown; finance and technology are sub-industries within "business."
The war opened on February 28, 2026, with U.S. and Israeli strikes on Iranian military and nuclear sites, and cyber operations ran alongside it from day one. A ceasefire took hold on April 8 and was extended in June, but Iranian cyber activity didn't stop. Rather than running their own ransomware crews, state-linked actors such as Fox Kitten re-launched Pay2Key as a ransomware-as-a-service platform. They break into VPNs and edge devices, hand the access to established ransomware gangs, and offer an elevated 80% profit share (vs. the usual 70%) for hits on U.S. and Israeli targets.
The clearest thread runs through utilities. Water-system intrusions blamed on Iran-nexus groups reached utilities in at least 12 U.S. states, including more than 30 Minnesota systems in a coordinated attack on July 26–27. By early September the campaign had reportedly widened to telecom and energy networks, and utilities attacks rose 32% in Q3. Officials still say attribution isn't confirmed, and no water contamination has been reported.
It isn't the whole story. September's Iran-linked reporting was mostly espionage: the CHOSEN BRICK spyware aimed at dissidents and journalists, and a new NodeRabbit RAT tied to Nimbus Manticore. Neither is ransomware. The quarter's fastest-growing sectors, finance (+72%) and technology (+70%), have no reported Iran connection. The war is a real driver behind the utilities and critical-infrastructure surge, on top of a ransomware ecosystem that is growing for its own reasons. GuidePoint counted 112 distinct groups in Q3, up 47% from 76.
| Sector | Q2 2026 | Q3 2026 | Change |
|---|---|---|---|
| Business | 1,753 | 2,234 | +27% |
| Healthcare | 135 | 188 | +39% |
| Government | 91 | 124 | +36% |
| Education | 50 | 75 | +50% |
| Total | 2,030 | 2,627 | +29% |
Totals include sectors not itemized here, so rows don't sum to the total. Of Q3's 2,627 attacks, 247 were confirmed by the victim; figures may shift as unconfirmed claims are reassigned.
| Industry | Victims |
|---|---|
| Healthcare | 89 |
| IT | 53 |
| Manufacturing | 53 |
| Finance | 36 |
| Consumer goods | 35 |
| Education | 35 |
| Group | Sep | Aug |
|---|---|---|
| TheGentlemen | 98 | 127 |
| Qilin | 75 | 157 |
| INC Ransom | 40 | 36 |
| Akira | 39 | 27 |
| KRYBIT | 35 | 35 |
| Storm | 33 | 37 |
The U.S. accounted for 321 of September's 789 victims (40.7%).
No public dataset tracks attacks by product or platform month by month, so this is the closest equivalent: how attackers gained access. Phishing passed 50% of engagements in Q2 2026, up from about a third in Q1, alongside heavy abuse of legitimate remote-management tools. Talos didn't publish Q2 percentages for the other vectors. Ransomware was just over 20% of Q2 engagements.
- CVE-2026-104935Ivanti Connect Secure VPN: authentication bypass, chained with two other flaws to get root on fully patched devices. Exploited since at least Oct 1 by an unknown actor (UTA0576); disclosed Oct 13. One flaw in the chain is still unpatched.
- CVE-2026-88771 / -88772Citrix NetScaler ADC & Gateway: unauthenticated command execution plus a DTLS memory overflow, both CVSS 9.5. Exploited as zero-days in September to drop web shells; mass scanning since the Sep 27 disclosure, with about 50,000 exposed instances.
- CVE-2026-96951Windows Shell: Mark-of-the-Web bypass, the one actively exploited zero-day in October's record Patch Tuesday (about 1,400 CVEs).
- 5 legacy CVEsApache Struts, ISC BIND, ProFTPD, ONLYOFFICE, Strapi: added to CISA's KEV catalog Oct 8. These bugs date from 2015 to 2023 and are still being exploited on unpatched systems.