# Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate

> Rapid7's Q3 2026 Quarterly Threat Landscape Report finds attackers exploit new high-severity vulnerabilities an average of three days after disclosure, with 71% of tracked exploitation in the first seven days (90% within 30 days) and 79% of exploited flaws being remote, unauthenticated bugs. Ransomware dominated the quarter, led by The Gentlemen (342 claimed victims) and Qilin (339), followed by INC Ransom (99), DeadLock (98) and KryBit (95). Government-sector ransomware victims rose 15% quarter-over-quarter, and the U.S. share of them rose from 33% to 45%. AI appeared as an operational component in only 8% of tracked incidents.

- **Published:** 2026-10-21T15:19:42Z
- **Last reviewed:** 2026-10-21T15:19:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4043
- **ID:** TL-2026-4043
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-94127, CVE-2024-55591, CVE-2025-59718, CVE-2025-59719, CVE-2026-24858, CVE-2024-7344, CVE-2025-0994, CVE-2025-21042, CVE-2025-3248, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, CVE-2008-4128, CVE-2018-0171, CVE-2025-49113, CVE-2021-4034, CVE-2025-20333, CVE-2025-20362, CVE-2025-66376

## Description

Rapid7's Q3 2026 Quarterly Threat Landscape Report was published on 2026-10-21 and covered the same day by SecurityWeek, citing Rapid7 Director of Vulnerability Intelligence Douglas McKee. It combines Rapid7's vulnerability intelligence, incident response and underground monitoring, which Rapid7 now groups as the Rapid7 Intelligence Organization. The report covers July through September 2026.

VULNERABILITY EXPLOITATION: The average time from disclosure to in-the-wild exploitation of high-severity (CVSS 7-10) vulnerabilities was three days. 71% of tracked exploitation happened within the first seven days and 90% within 30 days. 79% of exploited flaws were remote and unauthenticated, which Rapid7 calls 'holy grail' bugs. Across the 2,930 tracked CVSS 7-10 CVEs, 46% were 'holy grail' class, 80% were remote, 64% were unauthenticated and 85% were zero-click. 43 vulnerabilities were newly exploited in Q3, down 7% QoQ and up 19% YoY. Only about 10% of public proofs-of-concept turned into exploitation within 30 days. Of 2,082 RCE CVEs, 18 were exploited (0.62%). Authentication bypass had the highest exploitation rate: 3 of 191 (1.57%). Rapid7 highlighted CVE-2026-94127, a heap-based buffer overflow in the F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated RCE (CVSS 9.8). The flaw requires an APM access policy plus an OAuth profile on the virtual server. F5 disclosed it on 2026-09-22 and confirmed in-the-wild exploitation, and CISA added it to KEV that day with a three-day remediation deadline. A dedicated underground forum thread discussing it appeared on 2026-09-25.

RANSOMWARE: The top Q3 leak-site listings were The Gentlemen (342), Qilin (339), INC Ransom (99), DeadLock (98), KryBit (95), DragonForce (88), Akira (68), SafePay (65), Storm (60) and Payouts King (59). The U.S. accounted for 1,112 incidents (60.4%), followed by Germany (7.3%), Italy (5.3%), Canada (5.3%) and the UK (4.7%). The most-hit sectors were business services (17%), manufacturing (16.1%), healthcare (14.9%), technology (10.8%) and construction (9.8%). Rapid7 tracked 55 government-centric incidents, up 15% QoQ, and the U.S. share rose from 33% to 45% (25 of 55).

The Gentlemen is a RaaS that surged in 2026. Kaspersky Securelist (2026-06-29) documents its tradecraft. Affiliates gain access by exploiting internet-exposed services and abusing stolen or weak VPN and firewall credentials, and probably also buy access from initial access brokers. Public reporting also cites FortiGate CVE-2024-55591 and brute-forced FortiGate VPN credentials. Discovery uses SharpADWS, NetScan, Advanced IP Scanner, and netsh/Wireshark packet capture. Affiliates disable EDR with Windows Kernel Explorer, OpenArk64 and bring-your-own-vulnerable-driver (BYOVD) drivers. They spread laterally via PsExec and the NETLOGON share. A deploy_gpo.ps1 script creates a fake system-update Group Policy that disables Windows Defender. For persistence, affiliates use a scheduled task named 'UpdateUser' and Run keys. A Go backdoor (sihost.exe) uses Yamux-multiplexed C2. They delete shadow copies with vssadmin/wmic and clear event logs with wevtutil. The Go locker uses Curve25519 with XChaCha20 and drops README-GENTLEMEN.txt. Qilin (Agenda) affiliates use compromised VPN credentials, phishing and Fortinet exploits (CVE-2025-59718, CVE-2025-59719, CVE-2026-24858). They side-load a malicious msimg32.dll and use vulnerable drivers (rwdrv.sys, hlpdrv.sys, TPwSav.sys) to kill EDR, and usually deploy ransomware about six days after initial compromise.

NATION-STATE: Rapid7 tracked 15 APT groups in Q3, mainly targeting government organizations, then defense, transportation, media, healthcare, aerospace, finance, energy and technology. Rapid7 maps the following CVEs to actors:
- APT31: CVE-2024-7344, CVE-2025-0994, CVE-2025-21042, CVE-2025-3248, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771
- ENERGETIC BEAR: CVE-2008-4128, CVE-2018-0171
- Lazarus: CVE-2025-49113
- Operation C-Major (Pakistan-linked): CVE-2021-4034. The group has used phishing and mobile spyware against Indian military and diplomatic staff since the mid-2010s.
- Sandworm: CVE-2025-20333, CVE-2025-20362
- Void Blizzard: CVE-2025-66376, a Zimbra webmail XSS used against Ukrainian government and U.S. defense-industrial-base targets.

The report also covers a DPRK-linked Linux toolkit that Rapid7 detailed on 2026-09-04 and attributes with medium confidence. Two South Korean automotive and media organizations were hit via a compromised edge groupware/HAProxy server. The toolkit has these parts:
- 'ted': a backdoor compiled into a trojanized HAProxy 2.8.12 build via the native filter API. It intercepts HTTP traffic, injects scripts and hides its C2 requests.
- An SSH keylogger that captures administrator passwords.
- curlRAT: a libcurl RAT that beacons every 12 hours, or every 30 seconds in fast-poll mode. It refuses to run unless /usr/lib/libvirtlog.so.0 is present.
- Trojanized crond/cronie, sshd, agetty, atd and polkitd binaries.
The operators timestomp the files and scrub 'tmp', 'wget', 'cron' and 'crond' from bash history and system logs.

UNDERGROUND AND AI: 41 of 63 tracked underground posts advertised RDP or network access, for example 'Enterprise access with tailscale + RDP' and bank-login bundles with full identity data. 14 posts concerned exploit or zero-day sales. 8% of tracked reporting cited AI as an operational component. In every documented case humans still chose targets, with AI automating the 'tactical middle' of the attack chain. Fragmented, multi-session prompting is emerging as the main way to evade AI-provider safeguards. Rapid7 notes that the predicted AI exploitation wave did not appear in its Q3 data.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1650 Acquire Access
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1554 Compromise Host Software Binary
- T1484.001 Group Policy Modification
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1685.005 Clear Windows Event Logs
- T1685.006 Clear Linux or Mac System Logs
- T1497.001 System Checks
- T1056.001 Keylogging
- T1087.002 Domain Account
- T1046 Network Service Discovery
- T1021.002 SMB/Windows Admin Shares
- T1071.001 Web Protocols
- T1490 Inhibit System Recovery

## Sources

- [High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 (SecurityWeek)](https://www.securityweek.com/high-severity-flaws-exploited-in-three-days-as-ransomware-dominates-q3-rapid7/)
- [Rapid7 Quarterly Threat Landscape Report (Q3 2026)](https://www.rapid7.com/research/report/quarterly-threat-landscape-report/)
- [Rapid7: DPRK APTs deploy ted backdoor and curlRAT against South Korean media and automotive sectors](https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors/)
- [The Hacker News: New ted backdoor hides inside victims' HAProxy](https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html)
- [Kaspersky Securelist: The Gentlemen RaaS](https://securelist.com/the-gentlemen-raas/120447/)
- [Rapid7 ETR: CVE-2026-94127 Critical Unauthenticated RCE in F5 BIG-IP APM](https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm/)
- [Canadian Centre for Cyber Security AL26-022: Vulnerability impacting F5 BIG-IP APM (CVE-2026-94127)](https://cyber.gc.ca/en/alerts-advisories/al26-022-vulnerability-impacting-f5-big-ip-access-policy-manager-apm-cve-2026-94127)
- [eSecurityPlanet: F5 BIG-IP Zero-Day Under Active Attack as Sept. 25 CISA Deadline Looms](https://www.esecurityplanet.com/news/f5-big-ip-zero-day/)
- [S-RM: Ransomware in focus - Meet The Gentlemen](https://www.s-rminform.com/latest-thinking/ransomware-in-focus-meet-the-gentleman)
- [Sophos: Ungentlemanly behavior - insights into a ransomware operation](https://www.sophos.com/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation)
- [Blackpoint Cyber: The Gentlemen Ransomware threat profile](https://blackpointcyber.com/threat-profile/gentlemen-ransomware/)
- [Blackpoint Cyber: Qilin Ransomware and the Hidden Dangers of BYOVD](https://blackpointcyber.com/blog/qilin-ransomware-and-the-hidden-dangers-of-byovd/)
- [CybelAngel: Qilin Ransomware - Attack Methods and 2026 Status](https://cybelangel.com/blog/qilin-ransomware-tactics-attack/)
- [Security Affairs: North Korea-linked Hackers Hide a Backdoor Inside HAProxy](https://securityaffairs.com/198656/apt/north-korea-linked-hackers-hide-a-backdoor-inside-haproxy.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4043