Week 40, 2026
Weekly threat digest: 28 Sept – 4 Oct 2026
Published 2026-10-10 07:44 UTC.
This week predates our full feed tracking (from 2026-10-07), so indicator counts include only feeds that publish their own dates and are lower than a full week. Ransomware figures are complete.
The week in brief
- 5,765 new indicators of compromise were listed, +2% on the previous week.
- PureRAT was the most reported malware family, with 45 new indicators.
- Jackskid grew the most, from 1 to 28 new indicators.
- Most newly listed malicious IPs were hosted in United States (77), followed by Germany (50) and Netherlands (39).
- 233 ransomware victims were posted by 47 groups (+15% on the previous week); thegentlemen posted the most (34).
- Manufacturing was the most targeted sector (47 victims), then Healthcare (35) and Technology (24).
- Organisations in United States were named most often (81 victims).
5,765New indicators+2% vs previous week
362New malicious IPshosted in 47 countries
233Ransomware victims+15% vs previous week
47Ransomware groups postingon their leak sites
New indicators by type
| Type | This week | Previous | Change |
|---|---|---|---|
| IP addresses | 362 | 336 | +8% |
| Domains | 620 | 704 | −12% |
| URLs | 4,783 | 4,604 | +4% |
By role
Most reported malware families
| Family | Role | New indicators | Previous | Change |
|---|---|---|---|---|
| PureRAT | C2 | 45 | 50 | −10% |
| IClickFix | Malware | 44 | 358 | −88% |
| ClearFake | Malware | 39 | 31 | +26% |
| Vidar | C2 | 38 | 23 | +65% |
| AsyncRAT | C2 | 30 | 32 | −6% |
| Jackskid | C2 | 28 | 1 | +2700% |
| Remcos | C2 | 26 | 18 | +44% |
| DanaBot | C2 | 25 | 10 | +150% |
| AdaptixC2 | C2 | 20 | 24 | −17% |
| Potassium | C2 | 19 | 4 | +375% |
| DCRat | C2 | 14 | 8 | +75% |
| Havoc | C2 | 13 | 8 | +63% |
| Cobalt Strike | C2 | 12 | 42 | −71% |
| Aisuru | C2 | 10 | 1 | +900% |
| Evilginx | C2 | 9 | 8 | +13% |
Rising this week
Largest increase on the previous week, among families with at least 5 new indicators.
Where new malicious IPs were hosted
- C2botnet command-and-control
- Attackerscanning & brute-force
Networks hosting the most
| Network | New IPs |
|---|---|
| AS14061 DigitalOcean, LLC | 30 |
| AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP | 17 |
| AS198364 BANATSYNC SRL | 13 |
| AS401362 HOST4NERD LLC | 11 |
| AS152698 Zorn Technologies | 10 |
| AS132203 Shenzhen Tencent Computer Systems Company Limited | 8 |
| AS197170 TechTies Inc. | 8 |
| AS8075 Microsoft Corporation | 8 |
| AS63949 Akamai Technologies, Inc. | 7 |
| AS209373 SWISSNET LLC | 6 |
Ransomware
233 victims posted by 47 groups. See the ransomware map for the live picture.
| Group | Victims | Previous | Change |
|---|---|---|---|
| thegentlemen | 34 | 21 | +62% |
| Storm | 15 | 6 | +150% |
| qilin | 14 | 17 | −18% |
| safepay | 12 | 0 | new |
| incransom | 10 | 8 | +25% |
| lamashtu | 10 | 0 | new |
| krybit | 9 | 3 | +200% |
| akira | 9 | 9 | ±0% |
| BrainCipher | 8 | 1 | +700% |
| play | 7 | 2 | +250% |
| emperador | 7 | 4 | +75% |
| Booba Project | 7 | 6 | +17% |
Sectors
- Manufacturing47
- Healthcare35
- Technology24
- Other22
- Professional Services20
- Retail & E-Commerce15
- Agriculture and Food Production9
- Transportation9
- Education8
- Financial Services7
Victim countries
Latest posts of the week
| Posted (UTC) | Victim | Group | Sector | Country |
|---|---|---|---|---|
| 2026-10-04 19:37 | Bold Spring Nursery | play | Agriculture and Food Production | 🇺🇸 United States |
| 2026-10-04 19:36 | Silicon Valley Glass | play | Manufacturing | 🇺🇸 United States |
| 2026-10-04 17:22 | OMUR HIRDAVAT LTD | emperador | Manufacturing | 🇹🇷 Turkey |
| 2026-10-04 15:20 | MorseLife Health System, Inc. | Booba Project | Healthcare | 🇺🇸 United States |
| 2026-10-04 15:06 | Nipigon District Memorial Hospital | Storm | Healthcare | 🇨🇦 Canada |
| 2026-10-04 15:04 | Unident Group | qilin | Other | 🇺🇸 United States |
| 2026-10-04 15:03 | Chadwick Switchboards | qilin | Manufacturing | 🇦🇺 Australia |
| 2026-10-04 15:03 | Emser | qilin | Manufacturing | 🇪🇸 Spain |
| 2026-10-04 15:02 | Cotesma | qilin | Manufacturing | 🇨🇱 Chile |
| 2026-10-04 14:30 | Softruck | direwolf | Technology | 🇧🇷 Brazil |
| 2026-10-04 14:10 | Mutsumi Group | qilin | Manufacturing | 🇯🇵 Japan |
| 2026-10-04 13:19 | M****C | payoutsking | — | 🇺🇸 United States |
| 2026-10-04 13:17 | Center State Engineering | thegentlemen | Manufacturing | 🇺🇸 United States |
| 2026-10-04 13:02 | euroditel.com | krybit | Technology | 🇫🇷 France |
| 2026-10-04 13:01 | superpack.com.co | krybit | Retail & E-Commerce | 🇨🇴 Colombia |
| 2026-10-04 13:00 | daralteb.com | krybit | Healthcare | 🇮🇷 Iran |
| 2026-10-03 14:05 | Genesis Credit Management | qilin | Financial Services | 🇺🇸 United States |
| 2026-10-03 14:04 | Precon Marine Inc | netrunner | Transportation | — |
| 2026-10-03 13:02 | Skaff Group | rhysida | Other | — |
| 2026-10-03 12:24 | St. Francis Healthcare Systems of Hawaii | Wallstreet | Healthcare | 🇺🇸 United States |
| 2026-10-03 11:54 | World Cup 2034 | Wallstreet | Other | 🇸🇦 Saudi Arabia |
| 2026-10-03 06:27 | States Industries | Storm | Manufacturing | 🇺🇸 United States |
| 2026-10-03 06:27 | Aware | thegentlemen | Technology | 🇺🇸 United States |
| 2026-10-03 06:27 | Allied Machine & Engineering | Storm | Manufacturing | 🇺🇸 United States |
| 2026-10-03 06:27 | WOOSHIN SAFETY SYSTEMS CO LTD | thegentlemen | Manufacturing | 🇰🇷 South Korea |