IT threat evolution in Q3 2026. Non-mobile statistics

Kaspersky's latest quarterly threat report shows that in Q3 2026 its products stopped over 311 million web-based attacks and more than 23 million malicious or unwanted files, while 4470 new ransomware variants emerged—about 1.5 times more than the previous quarter—hitting over 81,000 users. Qilin remained the most active ransomware gang by leak-site victim share (15%), partly fueled by exploitation of CVE-2026-0257 in Palo Alto Networks firewalls, which let attackers bypass authentication entirely. CISA also flagged several actively exploited flaws tied to ransomware campaigns, including CVE-2026-15409/CVE-2026-15410 in SonicWall SMA1000 gateways, CVE-2026-45659 in Microsoft SharePoint Server, CVE-2025-60710 in Windows, CVE-2026-59310 in VMware vCenter, CVE-2025-14733 in WatchGuard Firebox, and CVE-2026-63077 in JetBrains TeamCity. The report also notes growing macOS threats like PamStealer and the Overlord backdoor, plus 217,000 users targeted by cryptominers, underscoring a broadening attack surface across platforms.