Late October brought rising risk across endpoints, infrastructure, and the software supply chain. Ransomware leaders intensified activity, while espionage groups used AI, trusted applications, developer tools, and edge flaws to scale attacks and stay hidden. New malware targeted AI credentials, network keys, and government systems. With exploited bugs spanning VPNs, PHP, GitLab, Linux, and commerce platforms, defenders should patch fast, rotate exposed credentials, and hunt for compromise.
Report Links
Download Threat Brief For October 16-31 2026
Byer-Nichols Threat Brief Podcast October 16-31 2026
Top Ransomware
| Ransomware | Percentage |
|---|---|
| The Gentlemen | 16.49% |
| Qilin | 11.29% |
| n0n | 7.17% |
| Booba Project | 3.94% |
| INC Ransom | 3.94% |
The Gentlemen set the pace at 16.49%, continuing its strong run, with Qilin still applying pressure at 11.29% despite dropping to second. n0n's rapid ascent remained the period's standout story: 38 shipping and logistics claims appeared within 23 minutes, reportedly linked to one supplier compromise rather than dozens of separate attacks. Booba Project also surged from 23rd to fourth, while INC Ransom slipped one position. Together, the top three shaped October's spike, with U.S. organizations and manufacturers taking the brunt of activity.
Victim Sector
| Sector | Percentage |
|---|---|
| Technology | 17.56% |
| Financial Services | 13.26% |
| Manufacturing | 11.65% |
| Construction | 10.75% |
| Retail | 9.14% |
Victim Location
| Location | Percentage |
|---|---|
| USA | 46.24% |
| Germany | 6.81% |
| Canada | 3.94% |
| Spain | 3.05% |
| Italy | 2.33% |
Victim Organization Size
| Organization size | Percentage |
|---|---|
| Small Business (500 or less) | 73.29% |
| Mid-Market (501-5000) | 18.95% |
| Large Enterprise (5000+) | 7.76% |
Trending Adversaries
- APT41
- Bronze Sandcastle
- CL-UNK-1211
- GlassWorm
- Storm-0940
- Warp Panda
These adversaries show the same shift: abusing trusted software, cloud services, developer tools, and AI to move fast and stay hidden. Their campaigns mix DLL sideloading, poisoned extensions, Linux web shells, edge exploits, token theft, and hypervisor evasion. Storm-0940 is the biggest concern because ARTEX helped it target hundreds and gain privileged cloud access in under three hours. Defenders should secure supply chains, patch exposed systems quickly, monitor signed binaries and service accounts, and hunt beyond endpoint logs.
Trending & Actively Exploited Vulnerabilities
| CVE | Vendor | Product |
|---|---|---|
| CVE-2025-61624 | Fortinet | Multiple Products |
| CVE-2026-102764 | BeyondTrust | Remote Support |
| CVE-2026-109618 | PHP Group | PHP |
| CVE-2026-109619 | PHP Group | PHP |
| CVE-2026-111357 | Ivanti | Connect Secure |
| CVE-2026-111497 | Brotli | |
| CVE-2026-118527 | Ivanti | Connect Secure |
| CVE-2026-46300 | Linux | Kernel |
| CVE-2026-48356 | Adobe | Commerce and Magento |
| CVE-2026-97229 | GitLab | Community Edition and Enterprise Edition |
This wave hits the full stack: Fortinet and BeyondTrust at the edge, Ivanti VPN chains reaching root, PHP2Shell and GitLab enabling unauthenticated code execution, Brotli exposing embedded runtimes, Linux providing privilege escalation, and Adobe Commerce/Magento opening a path through malicious uploads. Defenders should patch these CVEs now, prioritizing internet-facing and identity-bearing systems; rebuild affected containers, restrict management access, rotate exposed credentials, and hunt for compromise rather than treating an upgrade as proof the environment is clean.
Trending Malware
| Malware | Details |
|---|---|
| Aokigahara | Information stealer targeting AI-assistant credentials, browser data, cryptocurrency wallets, password managers, Git and SSH files, and cloud credentials, creating software supply-chain risk through stolen developer identities. |
| BlackX | Persistent UEFI bootkit that bypasses incompletely remediated Secure Boot protections to conceal espionage activity below Windows. |
| Candiru | Mercenary Windows spyware capable of zero-click delivery through targeted advertisements, with theft of files, messages, credentials, and authenticated sessions. |
| KeyDrift | Cisco SD-WAN controller malware that maintains covert access, executes commands, and extracts sensitive traffic-encryption key material. |
| MythicRatatoskr | Go-based backdoor that hides command-and-control traffic in the Yggdrasil mesh network and enables broad post-compromise control. |
| SysGoRAT | Cross-platform Go RAT providing persistent access, command execution, screenshots, file transfer, proxying, and espionage-focused persistence on Linux and Windows. |
Top News
- AI coding agents were hijacked via AGENTS.md, alongside a trojanized Claude Code extension for Cursor.
- A BAE Systems cyberattack disrupted U.S. federal court operations.
- GitLab warned of a new maximum-severity code-execution vulnerability.
- Hackers breached Microsoft 365 tenants via a ConnectWise supply-chain attack.
- An OVHcloud GitHub compromise was tied to GlassWorm threat actors.
- PHP shipped emergency patches for critical PHP2Shell flaws.
- Tech giants blocked eMudhra certificates tied to eight compromised keys.
- VAPOR PANDA used AI-driven ARTEX to scale a global espionage campaign.
Contributors
Written by Jeremy Nichols, Director, Security Programs & Strategy at SecureSky
Executive Summaries & Adversary Bios by Geoff Rehmet, Cybersecurity Architect
Produced & Distributed By Byer Co Cybersecurity Marketing Division (aka Phish Tank Digital)