Kaspersky published its Q3 2026 desktop and IoT threat statistics on Securelist on 10 November 2026. The ransomware section combines telemetry from Kaspersky products with a count of victims posted on ransomware groups’ data leak sites (DLSs). All figures below come from that report (Securelist). We have not independently checked the underlying counts.
Headline numbers
| Metric (Q3 2026) | Kaspersky figure |
|---|---|
| New ransomware variants detected | 4,470 |
| New ransomware families | 3 |
| Unique users protected from ransomware | 81,556 |
| Qilin share of DLS-published victims | 15.39% |
Kaspersky says the variant count is more than 1.5 times the previous quarter’s. It reports that users met ransomware most often in September. The top countries by share of Kaspersky users attacked were China (0.83%), South Korea (0.65%) and Cameroon (0.51%). Those percentages measure Kaspersky’s own user base, so they describe where Kaspersky customers were hit, not where ransomware is most prevalent.
Which groups posted the most victims
Kaspersky ranks groups by the number of victims each added to its DLS, as a share of all victims across the DLSs it reviews. Leak-site listings are the groups’ own claims, so these shares measure claimed victims, not confirmed breaches.
- Qilin, 15.39%. First place, as in the previous quarter.
- The Gentlemen, 7.89%. Kaspersky says the group was especially active in Q1 but did not make the Q2 list.
- Deadlock, 4.46%. Kaspersky calls it a notable newcomer on the list and describes the family as first reported in July 2025.
Our assessment: a single group holding about 15% of listings shows how concentrated claimed activity is, but the share depends on which leak sites Kaspersky tracks. Compare it with other publishers’ counts, such as the Comparitech Q3 roundup we covered earlier, before drawing conclusions about absolute volume.
Vulnerabilities Kaspersky links to ransomware activity
Kaspersky lists CVEs in CISA’s Known Exploited Vulnerabilities (KEV) catalog that CISA flags as used by ransomware groups. These are not all Q3 additions: by KEV’s own dates, CVE-2025-14733 was added on 2025-12-19, CVE-2025-60710 on 2026-04-13 and CVE-2026-0257 on 2026-05-29.
- CVE-2026-15409 and CVE-2026-15410, SonicWall SMA1000 gateways. Kaspersky notes that CISA does not name the groups involved, but that researchers have linked the activity to INC Ransom (Resecurity reports INC has been observed leveraging this chain as an entry point; this rests on that one vendor).
- CVE-2026-45659, Microsoft SharePoint Server, a low-privileged authenticated attacker can achieve remote code execution.
- CVE-2025-60710, Microsoft Windows, local privilege escalation.
- CVE-2026-59310, VMware vCenter, unauthenticated remote code execution.
- CVE-2025-14733, WatchGuard Firebox, unauthenticated remote code execution.
- CVE-2026-63077, JetBrains TeamCity, described by Kaspersky as command execution through an authentication bypass in the agent polling protocol. KEV describes it as deserialization of untrusted data allowing unauthenticated remote code execution via that protocol; the JetBrains CNA record lists fixes in 2026.1.3 and 2025.11.7.
Kaspersky also notes that in July researchers reported Qilin exploiting CVE-2026-0257 in Palo Alto Networks firewall software to bypass authentication. We covered that chain in our PAN-OS alert.
Law-enforcement outcomes in the quarter
Kaspersky records three sentencings:
- August: the creator and lead administrator of the Ransom Cartel RaaS operation was sentenced to 16 years in prison. Kaspersky describes his role as running the affiliate program, recruiting affiliates, working with initial access brokers, communicating with victims and processing payments.
- September: a Ryuk RaaS member received two years in prison and three years of supervised release. Kaspersky, citing prosecutors, says the member and his co-conspirators are alleged to have received about 1,610 BTC from victims in attacks between 2019 and about June 2020 (BleepingComputer, quoting the DOJ; we did not open the DOJ page).
- September: a Conti RaaS member received four years in prison for conspiracy to commit wire fraud in connection with Conti, per the DOJ, for his role in Conti attacks and for developing part of the group’s malware toolkit.
What defenders can take from this
Our assessment, based on the vulnerability list above: most of the exploited products are network-reachable remote access, firewall, virtualization, collaboration or build components, plus one privilege-escalation flaw. Prioritise patching and exposure reduction there.
- Check every product in the CVE list above against your asset inventory and confirm patch status.
- Remove management interfaces for VPN, firewall and vCenter systems from direct internet exposure where possible.
- Monitor for unexpected command execution on TeamCity and SharePoint servers.
- Treat leak-site share figures as one input. Combine them with incident data from your own sector.
Limits of the data
Kaspersky’s telemetry covers users who agreed to share statistics, and the DLS share covers only the leak sites Kaspersky reviews. The text of the section does not break down victims by sector (we did not view the charts), so sector-level conclusions need other sources.
References
Access date for all links: 11 November 2026.