Week 41, 2026
Weekly threat digest: 5 Oct – 11 Oct 2026
Published 2026-10-12 01:01 UTC.
This week predates our full feed tracking (from 2026-10-07), so indicator counts include only feeds that publish their own dates and are lower than a full week. Ransomware figures are complete.
The week in brief
- 166,711 new indicators of compromise were listed, +2779% on the previous week.
- Mirai was the most reported malware family, with 2,486 new indicators.
- Mirai grew the most, from 3 to 2,486 new indicators.
- Most newly listed malicious IPs were hosted in United States (13,000), followed by China (7,292) and United Kingdom (3,704).
- 210 ransomware victims were posted by 44 groups (−10% on the previous week); thegentlemen posted the most (36).
- Manufacturing was the most targeted sector (29 victims), then Professional Services (27) and Other (25).
- Organisations in United States were named most often (73 victims).
166,711New indicators+2779% vs previous week
57,288New malicious IPshosted in 187 countries
210Ransomware victims−10% vs previous week
44Ransomware groups postingon their leak sites
New indicators by type
| Type | This week | Previous | Change |
|---|---|---|---|
| IP addresses | 80,971 | 374 | +21550% |
| Domains | 9,781 | 623 | +1470% |
| URLs | 26,939 | 4,784 | +463% |
| File hashes | 49,020 | 10 | +490100% |
By role
Most reported malware families
| Family | Role | New indicators | Previous | Change |
|---|---|---|---|---|
| Mirai | Malware | 2,486 | 3 | +82767% |
| ClearFake | Malware | 1,227 | 40 | +2968% |
| Dcrat | Malware | 569 | 14 | +3964% |
| Vidar | C2 | 517 | 38 | +1261% |
| Padodor | Malware | 473 | 0 | new |
| IClickFix | Malware | 459 | 46 | +898% |
| php.shin_webshell | Malware | 288 | 0 | new |
| Loki | Malware | 252 | 0 | new |
| Cerber | Malware | 246 | 0 | new |
| Dacic | Malware | 238 | 0 | new |
| Gandcrab | Malware | 232 | 0 | new |
| Jalapeno | Malware | 221 | 0 | new |
| Neshta | Malware | 203 | 0 | new |
| Barys | Malware | 203 | 0 | new |
| VShell | Malware | 196 | 0 | new |
Rising this week
Largest increase on the previous week, among families with at least 5 new indicators.
Where new malicious IPs were hosted
- C2botnet command-and-control
- Malwaremalware delivery & hosting
- Attackerscanning & brute-force
Networks hosting the most
| Network | New IPs |
|---|---|
| AS14061 DigitalOcean, LLC | 4,209 |
| AS396982 Google LLC | 3,975 |
| AS4134 Chinanet | 2,275 |
| AS16276 OVH SAS | 2,130 |
| AS4837 CHINA UNICOM China169 Backbone | 1,936 |
| AS25369 Hydra Communications Ltd | 1,672 |
| AS45102 Alibaba (US) Technology Co., Ltd. | 1,665 |
| AS8075 Microsoft Corporation | 1,370 |
| AS213412 ONYPHE SAS | 702 |
| AS4766 Korea Telecom | 693 |
Ransomware
210 victims posted by 44 groups. See the ransomware map for the live picture.
| Group | Victims | Previous | Change |
|---|---|---|---|
| thegentlemen | 36 | 34 | +6% |
| qilin | 22 | 14 | +57% |
| N0n | 18 | 4 | +350% |
| safepay | 12 | 12 | ±0% |
| UmBra | 10 | 0 | new |
| SilentRansomGroup | 8 | 1 | +700% |
| BYOD | 8 | 0 | new |
| VYPR | 7 | 0 | new |
| Eclipse | 6 | 1 | +500% |
| rhysida | 5 | 5 | ±0% |
| Panzer | 5 | 2 | +150% |
| akira | 5 | 9 | −44% |
Sectors
- Manufacturing29
- Professional Services27
- Other25
- Technology23
- Healthcare23
- Education19
- Transportation7
- Retail & E-Commerce6
- Financial Services6
- Energy & Utilities5
Victim countries
Latest posts of the week
| Posted (UTC) | Victim | Group | Sector | Country |
|---|---|---|---|---|
| 2026-10-11 20:53 | Company #24 | N0n | — | — |
| 2026-10-11 20:21 | huntcompanies.com | BrainCipher | — | 🇺🇸 United States |
| 2026-10-11 18:56 | Company #23 | N0n | — | — |
| 2026-10-11 18:55 | Company #22 | N0n | — | — |
| 2026-10-11 18:55 | Company #21 | N0n | — | — |
| 2026-10-11 18:54 | Company #20 | N0n | — | — |
| 2026-10-11 18:53 | Company #19 | N0n | — | — |
| 2026-10-11 18:53 | Company #14 | N0n | — | 🇨🇦 Canada |
| 2026-10-11 15:28 | Reed & Giordano PA | rhysida | Professional Services | 🇺🇸 United States |
| 2026-10-11 14:24 | Company #29 | N0n | Technology | 🇺🇸 United States |
| 2026-10-11 14:24 | Company #28 | N0n | Professional Services | 🇺🇸 United States |
| 2026-10-11 14:23 | Company #27 | N0n | Healthcare | 🇦🇺 Australia |
| 2026-10-11 14:23 | Company #26 | N0n | Healthcare | 🇺🇸 United States |
| 2026-10-11 14:22 | Company #25 | N0n | Healthcare | 🇺🇸 United States |
| 2026-10-11 12:03 | CNESTEN | qilin | Government & Defense | 🇲🇦 Morocco |
| 2026-10-11 12:03 | Friendship Christian School | qilin | Education | 🇺🇸 United States |
| 2026-10-11 08:23 | Company #5 | N0n | — | — |
| 2026-10-11 07:23 | Company #4 | N0n | — | — |
| 2026-10-11 06:31 | Charles E. Tabor AAL LLC | rhysida | Other | 🇺🇸 United States |
| 2026-10-11 05:00 | TQC S.A. | dragonforce | Manufacturing | 🇵🇪 Peru |
| 2026-10-11 02:58 | Confipetrol | qilin | Energy & Utilities | 🇨🇴 Colombia |
| 2026-10-10 20:31 | TEXMA International Co., Ltd | dragonforce | Manufacturing | 🇹🇼 Taiwan |
| 2026-10-10 20:30 | Royal Thai Air Force | thegentlemen | Government & Defense | 🇹🇭 Thailand |
| 2026-10-10 16:54 | Helwan University (HITU) | UmBra | Education | 🇪🇬 Egypt |
| 2026-10-10 16:53 | DexCom | Redact | Healthcare | 🇺🇸 United States |