Q3 2026: 311 Million Web Attacks Blocked, Ransomware Variants Jump 50%

Kaspersky products blocked 311,083,655 attacks launched from online resources in Q3 2026. Web Anti-Virus fired on 46,936,926 unique URLs. File Anti-Virus stopped another 23,733,652 malicious and potentially unwanted objects. Those are the headline numbers in the vendor's quarterly non-mobile threat report, published November 10.

Every figure comes from Kaspersky detection verdicts on machines of users who consented to telemetry sharing. That caveat matters. The data describes Kaspersky's install base, not the internet at large.

What happened to ransomware?

Kaspersky counted 4,470 new ransomware variants across three new families. That is more than 1.5 times the previous quarter's count. Growth, not decline.

The products protected 81,556 unique users from ransomware attacks. September was the busiest month.

Qilin held first place among gangs by leak-site victims, at 15.39% — the same position as last quarter. The Gentlemen followed at 7.89%, a group that missed the Q2 list entirely after a loud Q1. Deadlock entered at 4.46%; researchers first reported this family in July 2025.

Law enforcement scored three convictions during the quarter:

• August: the creator and lead administrator of Ransom Cartel received 16 years in prison. He ran the affiliate program, recruited attackers, worked with initial access brokers and processed payments.
• September: a Ryuk member got two years plus three years of supervised release. Prosecutors say he took in roughly 1,610 BTC in ransoms during 2019–2020 attacks on hundreds of workstations and servers.
• September: a Conti member received four years for 2021–2022 attacks and for developing part of the group's malware toolkit.

Which vulnerabilities are ransomware crews exploiting?

CISA added several actively exploited CVEs to its Known Exploited Vulnerabilities Catalog. Enterprises should read this list as a patching priority queue:

• CVE-2026-15409/15410 — SonicWall SMA1000 gateways. CISA did not name the actors; researchers linked the activity to INC Ransom.
• CVE-2026-45659 — Microsoft SharePoint Server. An authenticated, low-privileged attacker gains remote code execution.
• CVE-2025-60710 — Microsoft Windows local privilege escalation.
• CVE-2026-59310 — VMware vCenter unauthenticated RCE.
• CVE-2025-14733 — WatchGuard Firebox unauthenticated RCE.
• CVE-2026-63077 — JetBrains TeamCity. An authentication bypass through the agent polling protocol runs OS commands with server privileges, exposing configurations, credentials and CI/CD pipelines.

Separately, July research documented Qilin exploiting CVE-2026-0257 in Palo Alto Networks firewall software. The flaw allowed authentication bypass and network compromise without valid accounts.

What hit macOS and developer supply chains?

Jamf researchers found PamStealer early in the quarter. It uses Pluggable Authentication Modules to verify the administrator password a user enters. Also in August, Jamf reported Overlord, a backdoor distributed as fake Zoom installers. It eavesdrops via microphone and camera, captures screens and logs keystrokes — unusually broad spyware for macOS.

Socket researchers documented several supply chain attacks on npm, PyPI and Rust Cargo packages:

• July 11: the npm package jscrambler shipped a Rust infostealer targeting crypto wallets, browser secrets, MCP server configurations and AI agent API keys.
• August: the Rust crates arrayref, internment and append-only-vec delivered a Rust backdoor.
• September: malicious MemTensor packages on npm and PyPI delivered a Go backdoor hunting secrets, configurations and API tokens.

Kaspersky itself found an updated MacSync crypto stealer with a significantly changed payload delivery method. On the macOS threat top-20, Ngrok — a tunneling tool with legitimate uses — climbed to first place. Amos detections grew, including a version with backdoor functionality.

What do the IoT and miner numbers show?

Miner attacks hit 217,024 unique users. Kaspersky detected 2,197 new miner variants, a return to last year's calmer pattern after a Q2 spike. Turkmenistan led miner exposure at 2.32% of users.

On Kaspersky's IoT honeypots, the share of devices attacking over SSH grew to 18.42%. The Netherlands accounted for 27.70% of SSH attack sources. Bulgaria's share grew fourfold to 20.05%. Pakistan's share of Telnet attacks reached 47.73%. Mirai's share of IoT threats declined while other botnets delivering malware grew.

Where is infection risk highest?

Globally, 4.34% of internet users' computers faced at least one web-based malware attack during the quarter. Bangladesh topped that ranking at 12.03%, followed by Taiwan at 8.06% and Venezuela at 7.92%.

Local infection figures — malware arriving via files, removable media or bundled installers — averaged 10.88% of computers worldwide. Turkmenistan led at 45.68%. Russia scored 9.37%. The ransomware family table still lists WannaCry at 4.90% of attacked users, proof that a 2017 relic keeps finding unpatched machines.

One warning for buyers of threat reports: country rankings exclude territories with fewer than 50,000 Kaspersky users (10,000 for web and local tables). Percentages shift with install base. Treat the rankings as directional, not definitive.