Threat reportRansomwareTL-2026-4043
Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate
Rapid7 Q3 2026 Threat Landscape (TL-2026-4043), also tracked as Rapid7 Q3 2026 Quarterly Threat Landscape Report, is a high-severity ransomware operation, first published 2026-10-21. It is attributed to The Gentlemen with medium confidence, affects F5 BIG-IP Access Policy Manager (APM), references 20 CVEs (CVE-2026-94127, CVE-2024-55591, CVE-2025-59718), maps to 20 MITRE ATT&CK techniques (T1021.002, T1027, T1036), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 20Referenced vulnerabilities
- Techniques
- 20MITRE ATT&CK
- Actors
- 2The Gentlemen
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-4043
- Threat ID
- TL-2026-4043
- Also known as
- Rapid7 Q3 2026 Quarterly Threat Landscape Report, Q3 2026 Threat Landscape
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- The Gentlemen, Qilin
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- business services, manufacturing, health, technology, construction, government administration, defense, transport, news - media, automotive, aerospace, finance
- Target regions
- united states of america, germany, italy, canada, united kingdom, south korea, ukraine, india, NATO member states
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Rapid7 Q3 2026 Threat Landscape
Malware and tooling: Agenda Ransomware, AgendaCrypt, curlRAT, inc ransom, safepay, PSEXEC, Rapid7, SharpADWS
How Rapid7 Q3 2026 Threat Landscape works
Rapid7's Q3 2026 Quarterly Threat Landscape Report finds attackers exploit new high-severity vulnerabilities an average of three days after disclosure, with 71% of tracked exploitation in the first seven days (90% within 30 days) and 79% of exploited flaws being remote, unauthenticated bugs. Ransomware dominated the quarter, led by The Gentlemen (342 claimed victims) and Qilin (339), followed by INC Ransom (99), DeadLock (98) and KryBit (95). Government-sector ransomware victims rose 15% quarter-over-quarter, and the U.S. share of them rose from 33% to 45%. AI appeared as an operational component in only 8% of tracked incidents.
Rapid7's Q3 2026 Quarterly Threat Landscape Report was published on 2026-10-21 and covered the same day by SecurityWeek, citing Rapid7 Director of Vulnerability Intelligence Douglas McKee. It combines Rapid7's vulnerability intelligence, incident response and underground monitoring, which Rapid7 now groups as the Rapid7 Intelligence Organization. The report covers July through September 2026.
VULNERABILITY EXPLOITATION: The average time from disclosure to in-the-wild exploitation of high-severity (CVSS 7-10) vulnerabilities was three days. 71% of tracked exploitation happened within the first seven days and 90% within 30 days. 79% of exploited flaws were remote and unauthenticated, which Rapid7 calls 'holy grail' bugs. Across the 2,930 tracked CVSS 7-10 CVEs, 46% were 'holy grail' class, 80% were remote, 64% were unauthenticated and 85% were zero-click. 43 vulnerabilities were newly exploited in Q3, down 7% QoQ and up 19% YoY. Only about 10% of public proofs-of-concept turned into exploitation within 30 days. Of 2,082 RCE CVEs, 18 were exploited (0.62%). Authentication bypass had the highest exploitation rate: 3 of 191 (1.57%). Rapid7 highlighted CVE-2026-94127, a heap-based buffer overflow in the F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated RCE (CVSS 9.8). The flaw requires an APM access policy plus an OAuth profile on the virtual server. F5 disclosed it on 2026-09-22 and confirmed in-the-wild exploitation, and CISA added it to KEV that day with a three-day remediation deadline. A dedicated underground forum thread discussing it appeared on 2026-09-25.
RANSOMWARE: The top Q3 leak-site listings were The Gentlemen (342), Qilin (339), INC Ransom (99), DeadLock (98), KryBit (95), DragonForce (88), Akira (68), SafePay (65), Storm (60) and Payouts King (59). The U.S. accounted for 1,112 incidents (60.4%), followed by Germany (7.3%), Italy (5.3%), Canada (5.3%) and the UK (4.7%). The most-hit sectors were business services (17%), manufacturing (16.1%), healthcare (14.9%), technology (10.8%) and construction (9.8%). Rapid7 tracked 55 government-centric incidents, up 15% QoQ, and the U.S. share rose from 33% to 45% (25 of 55).
The Gentlemen is a RaaS that surged in 2026. Kaspersky Securelist (2026-06-29) documents its tradecraft. Affiliates gain access by exploiting internet-exposed services and abusing stolen or weak VPN and firewall credentials, and probably also buy access from initial access brokers. Public reporting also cites FortiGate CVE-2024-55591 and brute-forced FortiGate VPN credentials. Discovery uses SharpADWS, NetScan, Advanced IP Scanner, and netsh/Wireshark packet capture. Affiliates disable EDR with Windows Kernel Explorer, OpenArk64 and bring-your-own-vulnerable-driver (BYOVD) drivers. They spread laterally via PsExec and the NETLOGON share. A deploy_gpo.ps1 script creates a fake system-update Group Policy that disables Windows Defender. For persistence, affiliates use a scheduled task named 'UpdateUser' and Run keys. A Go backdoor (sihost.exe) uses Yamux-multiplexed C2. They delete shadow copies with vssadmin/wmic and clear event logs with wevtutil. The Go locker uses Curve25519 with XChaCha20 and drops README-GENTLEMEN.txt. Qilin (Agenda) affiliates use compromised VPN credentials, phishing and Fortinet exploits (CVE-2025-59718, CVE-2025-59719, CVE-2026-24858). They side-load a malicious msimg32.dll and use vulnerable drivers (rwdrv.sys, hlpdrv.sys, TPwSav.sys) to kill EDR, and usually deploy ransomware about six days after initial compromise.
NATION-STATE: Rapid7 tracked 15 APT groups in Q3, mainly targeting government organizations, then defense, transportation, media, healthcare, aerospace, finance, energy and technology. Rapid7 maps the following CVEs to actors: - APT31: CVE-2024-7344, CVE-2025-0994, CVE-2025-21042, CVE-2025-3248, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771 - ENERGETIC BEAR: CVE-2008-4128, CVE-2018-0171 - Lazarus: CVE-2025-49113 - Operation C-Major (Pakistan-linked): CVE-2021-4034. The group has used phishing and mobile spyware against Indian military and diplomatic staff since the mid-2010s. - Sandworm: CVE-2025-20333, CVE-2025-20362 - Void Blizzard: CVE-2025-66376, a Zimbra webmail XSS used against Ukrainian government and U.S. defense-industrial-base targets.
The report also covers a DPRK-linked Linux toolkit that Rapid7 detailed on 2026-09-04 and attributes with medium confidence. Two South Korean automotive and media organizations were hit via a compromised edge groupware/HAProxy server. The toolkit has these parts: - 'ted': a backdoor compiled into a trojanized HAProxy 2.8.12 build via the native filter API. It intercepts HTTP traffic, injects scripts and hides its C2 requests. - An SSH keylogger that captures administrator passwords. - curlRAT: a libcurl RAT that beacons every 12 hours, or every 30 seconds in fast-poll mode. It refuses to run unless /usr/lib/libvirtlog.so.0 is present. - Trojanized crond/cronie, sshd, agetty, atd and polkitd binaries. The operators timestomp the files and scrub 'tmp', 'wget', 'cron' and 'crond' from bash history and system logs.
UNDERGROUND AND AI: 41 of 63 tracked underground posts advertised RDP or network access, for example 'Enterprise access with tailscale + RDP' and bank-login bundles with full identity data. 14 posts concerned exploit or zero-day sales. 8% of tracked reporting cited AI as an operational component. In every documented case humans still chose targets, with AI automating the 'tactical middle' of the attack chain. Fragmented, multi-session prompting is emerging as the main way to evade AI-provider safeguards. Rapid7 notes that the predicted AI exploitation wave did not appear in its Q3 data.
MITRE ATT&CK techniques used in TL-2026-4043
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1497.001 System Checks
Discovery
T1046 Network Service Discovery; T1087.002 Domain Account
Credential Access
Execution
T1059 Command and Scripting Interpreter; T1059.001 PowerShell
Command and Control
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
defense-impairment
T1484.001 Group Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1685.006 Clear Linux or Mac System Logs
Impact
Persistence
T1554 Compromise Host Software Binary
Resource Development
Affected products and versions in Rapid7 Q3 2026 Threat Landscape
- F5 — BIG-IP Access Policy Manager (APM)
Vulnerable versions: 21.1.0 prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG; 17.5.0 prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG; 17.1.0 prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
Fixed in: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG; Hotfix-BIGIP-17.5.1.9.0.160.12-ENG; Hotfix-BIGIP-17.1.3.5.0.41.14-ENG - Fortinet — FortiGate / FortiOS (VPN and management interfaces targeted by The Gentlemen and Qilin)
Vulnerable versions: Versions affected by CVE-2024-55591, CVE-2025-59718, CVE-2025-59719, CVE-2026-24858
Fixed in: Per Fortinet PSIRT advisories - HAProxy — HAProxy 2.8.12 (trojanized build carrying ted backdoor on compromised edge groupware hosts)
Vulnerable versions: 2.8.12 (trojanized)
Fixed in: Reinstall from trusted vendor packages - Synacor — Zimbra Collaboration Suite webmail
Vulnerable versions: Versions affected by CVE-2025-66376
Fixed in: Per Zimbra security advisory - Cisco — Secure Firewall ASA / FTD
Vulnerable versions: Versions affected by CVE-2025-20333, CVE-2025-20362
Fixed in: Per Cisco advisory
Remediation for Rapid7 Q3 2026 Threat Landscape
Patches
- F5 BIG-IP 21.1.0: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG or later (CVE-2026-94127)
- F5 BIG-IP 17.5.0: Hotfix-BIGIP-17.5.1.9.0.160.12-ENG or later (CVE-2026-94127)
- F5 BIG-IP 17.1.0: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG or later (CVE-2026-94127)
- Fortinet FortiOS/FortiProxy fixes for CVE-2024-55591, CVE-2025-59718, CVE-2025-59719, CVE-2026-24858
- Cisco ASA/FTD fixes for CVE-2025-20333 and CVE-2025-20362; Zimbra fix for CVE-2025-66376; SharePoint fixes for CVE-2025-53770/53771
Immediate actions
- Patch internet-facing high-severity, remote/unauthenticated flaws within 72 hours of disclosure; exploitation averages 3 days and 71% occurs within 7 days
- Apply F5 hotfixes for CVE-2026-94127 on BIG-IP APM virtual servers with an APM access policy plus OAuth profile, and hunt for compromise on exposed systems
- Enforce MFA on and rotate credentials for VPN, firewall and RDP access abused by The Gentlemen and Qilin affiliates; audit for brute-force activity against FortiGate/SSL-VPN
- Block and hunt for the listed ted/curlRAT C2 domains and The Gentlemen backdoor C2 81.177.215.15:9443
- Alert on new GPOs that disable Windows Defender, vssadmin/wmic shadow-copy deletion, and wevtutil log clearing
Workarounds
- Where BIG-IP cannot be patched immediately, restrict access to APM virtual servers that use OAuth profiles
- Restrict RDP and remote-access tools such as Tailscale to managed, MFA-protected paths
Longer-term hardening
- Turn on the Microsoft vulnerable driver blocklist / HVCI to defeat BYOVD EDR-killers (Qilin, The Gentlemen)
- Inventory and reduce edge attack surface (VPN, firewall, groupware, load balancers) and remove exposed management interfaces
- Run file-integrity monitoring on Linux edge hosts for trojanized haproxy, sshd, crond, agetty, atd and polkitd binaries
- Monitor underground markets for access-for-sale listings naming your organization (RDP, Tailscale, webmail)
- Keep offline, immutable backups and rehearse ransomware recovery
CVEs associated with Rapid7 Q3 2026 Threat Landscape
Weaknesses (CWE) in Rapid7 Q3 2026 Threat Landscape
Timeline of Rapid7 Q3 2026 Threat Landscape
- S-RM publishes 'Ransomware in focus: Meet The Gentlemen', profiling the RaaS as it ramps up activity in 2026.
- Kaspersky Securelist details The Gentlemen RaaS tradecraft: GPO-based deployment (deploy_gpo.ps1), BYOVD EDR-killers, Go backdoor with Yamux C2 at 81.177.215.15:9443, and Curve25519/XChaCha20 Go locker.
- Q3 2026 reporting period begins; The Gentlemen and Qilin go on to post 342 and 339 leak-site victims respectively.
- Rapid7 discloses a DPRK-linked Linux toolkit (ted backdoor in trojanized HAProxy 2.8.12, SSH keylogger, curlRAT) used against South Korean automotive and media organizations since early 2025.
- F5 discloses CVE-2026-94127, an unauthenticated heap-overflow RCE in BIG-IP APM (CVSS 9.8) exploited in the wild; CISA adds it to KEV with a three-day remediation deadline.
- A dedicated underground forum thread discussing CVE-2026-94127 appears three days after disclosure, matching the quarter's 3-day average time-to-exploit. The CISA KEV remediation deadline falls the same day.
- Q3 2026 closes. 43 vulnerabilities were newly exploited (down 7% QoQ, up 19% YoY), and 55 government-centric ransomware incidents were tracked (up 15% QoQ, 45% U.S.).
- Rapid7 publishes its Q3 2026 Quarterly Threat Landscape Report; SecurityWeek reports that high-severity flaws are exploited in three days on average as ransomware dominates.
Sources cited for Rapid7 Q3 2026 Threat Landscape
- High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 (SecurityWeek)
- Rapid7 Quarterly Threat Landscape Report (Q3 2026)
- Rapid7: DPRK APTs deploy ted backdoor and curlRAT against South Korean media and automotive sectors
- The Hacker News: New ted backdoor hides inside victims' HAProxy
- Kaspersky Securelist: The Gentlemen RaaS
- Rapid7 ETR: CVE-2026-94127 Critical Unauthenticated RCE in F5 BIG-IP APM
- Canadian Centre for Cyber Security AL26-022: Vulnerability impacting F5 BIG-IP APM (CVE-2026-94127)
- eSecurityPlanet: F5 BIG-IP Zero-Day Under Active Attack as Sept. 25 CISA Deadline Looms
- S-RM: Ransomware in focus - Meet The Gentlemen
- Sophos: Ungentlemanly behavior - insights into a ransomware operation
- Blackpoint Cyber: The Gentlemen Ransomware threat profile
- Blackpoint Cyber: Qilin Ransomware and the Hidden Dangers of BYOVD
- CybelAngel: Qilin Ransomware - Attack Methods and 2026 Status
- Security Affairs: North Korea-linked Hackers Hide a Backdoor Inside HAProxy
Detection coverage for TL-2026-4043
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4043 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.