Early October showed attackers moving quickly against trusted infrastructure. Exploited flaws hit firewalls, email gateways, VPNs, backup servers, and enterprise applications, while espionage groups paired tailored phishing with stealthy RATs, AI-assisted tools, and memory-resident implants. Ransomware stayed fluid as n0n and NightSpire surged alongside established crews. The priority is clear: patch exposed systems fast, restrict administrative access, rotate credentials, and hunt for persistence after remediation.
Report Links
Download Threat Brief For October 1-15 2026
Byer-Nichols Threat Brief Podcast October 1-15 2026
Top Ransomware
| Ransomware | Percentage |
|---|---|
| Qilin | 10.81% |
| The Gentlemen | 9.27% |
| n0n | 8.49% |
| INC Ransom | 7.53% |
| NightSpire | 5.02% |
Qilin led the first half of October with 10.81%, narrowly ahead of The Gentlemen, while INC Ransom remained a familiar top-tier presence. Qilin also claimed engineering consultancy EPTISA, and INC listed German architecture firm Architekt von Danwitz, although both remain actor claims. The real story was volatility: newcomer n0n surged from sixth to third at 8.49%, while NightSpire leapt from 43rd to fifth after only recently reaching the top 25. Established brands are sharing the spotlight with fast-moving challengers.
Victim Sector
| Sector | Percentage |
|---|---|
| Manufacturing | 15.25% |
| Retail | 13.90% |
| Technology | 12.74% |
| Construction | 11.00% |
| Transportation | 9.27% |
Victim Location
| Location | Percentage |
|---|---|
| USA | 40.73% |
| Brazil | 3.67% |
| Canada | 3.47% |
| Germany | 3.28% |
| Spain | 2.70% |
Victim Organization Size
| Organization size | Percentage |
|---|---|
| Small Business (500 or less) | 70.53% |
| Mid-Market (501-5000) | 20.63% |
| Large Enterprise (5000+) | 8.84% |
Trending Adversaries
- Armory Castle
- CL-UNK-1211
- TA419
- UAC-0099
- UAT-6275
- UNC5820
Trending threat actors point to an espionage-heavy cycle built around trusted access. Armory Castle and UNC5820 exploited edge-management products, while TA419, UAC-0099, and UAT-6275 used tailored lures, credential theft, and custom remote-access tools. CL-UNK-1211 added AI-generated payloads, web shells, and Linux targeting. UNC5820 is especially concerning because one FortiManager breach exposed data for more than 500 firewalls and enabled a stealthy in-memory implant. Defenders should patch edge systems quickly, protect administrative credentials, monitor trusted processes, and hunt beyond disk-based indicators.
Trending & Actively Exploited Vulnerabilities
| CVE | Vendor | Product |
|---|---|---|
| CVE-2026-0322 | Palo Alto Networks | PAN-OS |
| CVE-2026-102489 | Zammad GmbH | Zammad |
| CVE-2026-102490 | Zammad GmbH | Zammad |
| CVE-2026-104286 | Fortinet | FortiMail |
| CVE-2026-104935 | Ivanti | Connect Secure |
| CVE-2026-105134 | Ahsay | AhsayCBS |
| CVE-2026-21589 | Atlassian | Multiple Products |
| CVE-2026-76519 | Cisco | Secure Email Gateway |
| CVE-2026-88779 | Citrix | NetScaler |
| CVE-2026-96951 | Microsoft | Windows |
October's exploited flaws span PAN-OS, Zammad, FortiMail, Ivanti Connect Secure, AhsayCBS, Atlassian products, Cisco Secure Email Gateway, Citrix NetScaler, and Windows. The main concern is internet-facing infrastructure: several bugs enable unauthenticated file access or writes, command execution, root compromise, session hijacking, or disruption. AhsayCBS attacks planted web shells and miners after earlier fixes were incomplete. Patch every listed CVE, limit management access, verify fixed builds, rotate exposed credentials, and hunt for persistence or prior compromise.
Trending Malware
| Malware | Details |
|---|---|
| ASHVEIN | Windows RAT and infostealer used for credential theft, surveillance, data collection, remote control, encrypted C2, and anti-analysis in targeted espionage operations. |
| ClingSTUN | Linux back-connect proxy backdoor that compromises unpatched Linux and IoT devices, establishes persistence, and uses public STUN services for covert connectivity. |
| Hirudo | Android banking trojan that replaces legitimate banking apps with patched copies and supports credential theft, SMS interception, screen capture, and remote control. |
| PEERSTITCH | Memory-resident FortiGate implant hidden inside legitimate daemons, enabling traffic interception and unauthorized VPN access without a persistent binary on disk. |
| PoeLLM | Botnet malware that exploits exposed AI and other services, mines cryptocurrency, and derives command infrastructure from words hidden in an online poem. |
| SysGoRAT | Cross-platform Go RAT supporting durable access, command execution, interactive shells, TCP proxying, and espionage-focused persistence on Windows and Linux. |
Top News
- DOJ charges 14 and raids more than 40 Texas laptop farms in a North Korean IT worker scheme.
- FBI arrests a third suspected ShinyHunters member after the FBIjobs.gov incident.
- GhostAction supply-chain wave hits about 1,900 GitHub accounts and 30,000 repositories.
- Hackers hijacked French supermarket refrigeration controllers, heating freezers to 50°C at hundreds of stores.
- Hackers stole Pentagon personnel records of more than 3 million people.
- Microsoft's X account was hacked in a crypto pump-and-dump scheme.
- Police dismantled the KillSec ransomware gang, allegedly led by a 16-year-old.
- Seven domains tied to Flax Typhoon scanning and phishing tools were seized.
Contributors
Written by Jeremy Nichols, Director, Security Programs & Strategy at SecureSky
Executive Summaries & Adversary Bios by Geoff Rehmet, Cybersecurity Architect
Produced & Distributed By Byer Co Cybersecurity Marketing Division (aka Phish Tank Digital)