High-severity vulnerabilities reached active exploitation an average of three days after disclosure during Q3 2026, according to Rapid7 findings reported by SecurityWeek. Seventy-one percent were exploited within the first seven days.
Rapid7 classified 79% of the exploited vulnerabilities as “holy grail” flaws: weaknesses that can be attacked remotely without credentials or local user interaction. That combination gives defenders little time to assess exposure, test updates and deploy protections before adversaries begin operating against vulnerable systems.
The figures point to a practical priority for security teams: remediation workflows should distinguish remotely exploitable, unauthenticated vulnerabilities from flaws requiring an existing foothold or user action. Systems exposed to untrusted networks warrant the fastest review when a newly disclosed vulnerability meets those conditions.
Ransomware claims concentrate on services, manufacturing and healthcare
Rapid7 described ransomware as a leading global threat during the quarter. Business services, manufacturing and healthcare were the most frequently targeted sectors in its data.
The United States accounted for 60% of attacks, followed by Germany at 7%, Italy at 5% and Canada at 5%. Government-sector ransomware victims increased 15% compared with the previous three months, while the US share of victims in that sector rose from 33% in Q2 2026 to 45% in Q3 2026.
By claimed incident volume, the most active ransomware groups were:
| Group | Claimed incidents |
|---|---|
| The Gentlemen | 342 |
| Qilin | 339 |
| INC Ransom | 99 |
| DeadLock | 98 |
| Krybit | 95 |
These figures represent incidents claimed by ransomware operators. They do not by themselves establish the number of confirmed victims or prove that data was stolen in every case.
Rapid7 also observed an underground market geared toward supplying initial access. Of 63 monitored posts, 41 advertised RDP or network access, while 14 concerned the sale, exchange or discussion of exploits and zero-days. Offers ranged from individual compromised accounts—including bank credentials packaged with “full” identity data for at least three major US banks—to access inside enterprise networks.
AI supports attack execution but does not yet replace operators
Artificial intelligence appeared as an operational component in 8% of the incidents tracked by Rapid7 during Q3 2026. That percentage applies to Rapid7’s tracked incident set.
The company’s observations do not support a broad shift to autonomous attackers. Douglas McKee, Rapid7’s director of vulnerability intelligence, said AI-assisted vulnerability discovery is accelerating, but the quarter’s data did not show a corresponding wave of AI-driven exploitation.
In every case documented by Rapid7, people still selected the target and determined the objective. Automation was instead expanding through what the company described as the tactical middle of an intrusion: choosing techniques, triaging targets and recovering after a failed step.
Rapid7 also reported attempts to bypass AI-provider safeguards by dividing a malicious objective across several sessions. A direct request in one session may be blocked, while a sequence of prompts distributed over multiple sessions can make the overall purpose harder to identify.
For defenders, Rapid7 recommends monitoring AI API activity originating from unexpected hosts or processes. Such telemetry can reveal unauthorized tool use or automation running from systems that would not normally communicate with AI services.
The company considers fully automated, AI-assisted attacks likely within the next few years, but presents that as a forecast rather than activity observed during Q3 2026.
Nation-state operations add new Linux tooling
Rapid7 tracked 15 distinct nation-state groups during the quarter. The named clusters included Russia-linked ENERGETIC BEAR, Void Blizzard and Sandworm; China-linked APT31; North Korea’s Lazarus; and Pakistan’s Operation C-Major.
Government organizations remained the principal targets. Defense, transportation, media, healthcare, aerospace, finance, energy and technology organizations were also targeted.
Rapid7 documented a Linux toolkit called ted, comprising three separate components:
- a trojanized HAProxy build;
- an SSH keylogger;
- a curl-based remote access trojan.
Rapid7 attributed ted to DPRK actors and said it had been used against South Korean organizations since early 2025. The toolkit is the malware and capability set; the DPRK-linked operators are the attributed actors.
Operation C-Major, meanwhile, has been active since the mid-2010s, according to Rapid7. Its operators use phishing and mobile spyware in espionage operations targeting Indian military and diplomatic personnel.
Across these findings, the immediate defensive pressure comes from speed: vulnerabilities that permit remote, unauthenticated access can move from disclosure to exploitation within days, while access brokers offer compromised footholds to other operators. Rapid patch triage and monitoring for unexpected AI API use address different stages of that threat chain—initial entry and automated execution inside the environment.
