Exclusive insights into the latest Threat Intelligence. Keeping constant watch over the cyber and geopolitical landscapes so you don’t have to.
Monthly Threat Intelligence Report
Cyber Threat Intelligence Report: Review of Q3 2026
Ransomware activity increased throughout Q3 2026, while cybercriminal operations became increasingly specialised and focused on high-value access and operational control. The quarter highlighted the evolving nature of cyber threats, from the continued exploitation of internet-facing systems and the expansion of Initial Access Broker activity to emerging risks associated with autonomous AI agents. Organisations faced a threat landscape shaped by both established attack methods and rapidly developing technologies.
Q3 2026 key insights:
- Global ransomware activity increased by 23% quarter-on-quarter, rising from 2,325 victims in Q2 to 2,865 in Q3, with Industrials remaining the most targeted sector.
- North America remained the most targeted region, representing nearly half of all recorded attacks, with Europe the second most targeted region.
- Qilin remained the leading ransomware group, while emerging operators such as Deadlock and Storm gained momentum.
- The exploitation of internet-facing systems remained a key route to compromise across multiple threat groups.
- Initial Access Brokers (IABs) continued to expand access offerings across cloud, development and operational technology environments.
- Developments involving autonomous AI agents highlighted emerging security and governance challenges.
Q3's findings demonstrate the persistence and adaptability of today's cyber threat landscape. As threat actors continue to refine established tactics and exploit new opportunities, organisations must balance protection against immediate risks with preparation for emerging challenges. Together, the trends observed this quarter reinforce the importance of cyber resilience, combining strong security fundamentals with effective governance, visibility and recovery capabilities.
Monthly webinar
Our team of Threat Intel experts keep a constant watch over the cyber and geopolitical landscape, so you don’t have to.
Introducing our monthly highlights webinar, giving you further insight and exclusive access to what's going on now. Join our Global Head of Threat Intelligence, Matt Hull, each month for:
• A deeper understanding of the latest report findings
• A look at emerging trends by region and sector
• Insight into new threat actors
• Spotlight on the most impactful active cyber threats
Our next webinar will take place on November 24th 2026, 4pm GMT.
Matt Hull
VP, Cyber Intelligence and Response
Subscribe to our monthly reports and webinars for the latest on recent and emerging advances in the threat landscape and a deep understanding of the latest Tactics, Techniques and Procedures (TTPs) of threat actors.
Cyber Threat Intelligence report archive
On demand videos
Missed a webinar? Find every past recording in our showcase:
View now
Never miss any intelligence.
Hit the button below to get our monthly reports and highlight webinars straight to your inbox.