Kaspersky Detects Surge in Ransomware and Miner Attacks in Q3 2026

In the third quarter of 2026, Kaspersky products blocked more than 311 million attacks originating from online resources. During the same period, Kaspersky detected 4470 new ransomware variants, impacting over 81,000 users globally.

In July 2026, the Qilin group exploited the CVE-2026-0257 vulnerability in Palo Alto Networks firewall software. This group was responsible for 15% of ransomware victims whose data was published on threat actors' data leak sites.

CISA has published information on several CVEs actively exploited by ransomware groups, including CVE-2026-15409 and CVE-2026-15410. Additionally, CVE-2026-59310 in VMware vCenter allowed unauthenticated remote code execution, and CVE-2026-63077 in JetBrains TeamCity permitted OS commands to run with server process privileges.

In the realm of cryptocurrency mining, Kaspersky detected 2197 new miner variants in Q3 2026. Kaspersky detected miner attacks on the computers of 217,024 unique users worldwide.