# Kaspersky Q3 2026 Non-Mobile Threat Landscape: Qilin Ransomware via CVE-2026-0257, INC Ransom via SonicWall SMA1000 CVE-2026-15409/15410, macOS Stealers (PamStealer, MacSync, Overlord) and npm/PyPI/crates.io Supply-Chain Backdoors

> Kaspersky's Q3 2026 non-mobile statistics report records 4,470 new ransomware variants and 3 new families, with Qilin leading leak-site victims at 15.39%. The quarter also saw Qilin exploiting a PAN-OS GlobalProtect authentication bypass, INC Ransom-linked exploitation of SonicWall SMA1000, new macOS stealers and backdoors, and npm, PyPI and crates.io supply-chain compromises delivering Rust and Go implants.

- **Published:** 2026-11-10T08:25:59Z
- **Last reviewed:** 2026-11-10T08:25:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5627
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5627.png
- **ID:** TL-2026-5627
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 (1 shown free below) · **IOCs:** 42 (3 shown free below)
- **CVEs:** CVE-2026-0257, CVE-2026-15409, CVE-2026-15410, CVE-2026-45659, CVE-2025-60710, CVE-2026-59310, CVE-2025-14733, CVE-2026-63077

## Description

Securelist's Q3 2026 non-mobile report (published 2026-11-10) aggregates Kaspersky telemetry: 311,083,655 web attacks blocked, 46,936,926 unique malicious URLs, 23,733,652 malicious or unwanted objects detected by File Anti-Virus, 81,556 unique users attacked by ransomware and 217,024 by miners. Kaspersky counted 4,470 new ransomware variants and 3 new families. By share of leak-site victims Qilin led with 15.39%, followed by The Gentlemen (7.89%) and Deadlock (4.46%). The most-attacked-user families were Trojan-Ransom.Win32.Gen (32.48%), Crypren (6.31%) and WannaCry (4.90%). Law-enforcement outcomes included a 16-year sentence for the Ransom Cartel creator (August), a two-year sentence for a Ryuk member (about 1,610 BTC in ransom received) and a four-year sentence for a Conti member (September).

Edge-device exploitation was a key initial-access theme. Arctic Wolf documented Qilin intrusions in June 2026 that abused CVE-2026-0257, an authentication bypass in the PAN-OS GlobalProtect portal and gateway (CVSS 7.8 per Arctic Wolf) to establish VPN sessions from hosts named 'kali'. The operators then persisted with Run keys, a scheduled task (\MeshUserTask) and remote-access tools (AnyDesk, Ngrok, LogMeIn, MeshAgent), dumped LSASS via comsvcs.dll MiniDump and NTDS via ntdsutil IFM, moved laterally with PsExec and RDP, cleared event logs, exfiltrated with Rclone to MEGA, targeted Veeam, and ran the Qilin payload C:\PerfLogs\win.exe. Resecurity documented the SonicWall SMA1000 chain: CVE-2026-15409 (CVSS 10.0, pre-auth /wsproxy bypass reaching CouchDB/Erlang on localhost:1050 and ctrl-service on 8188) chained with CVE-2026-15410 (CVSS 7.2, path traversal in remove_hotfix via POST /rollbackConfirm.action) for root, followed by the ROOTRUN, KNUCKLEBALL, Suo5 and ORANGETAIL implants. Volexity tracks pre-disclosure exploitation (from 2026-06-22) as UTA0533; SonicWall patched on 2026-07-14 and CISA added both CVEs to KEV. Researchers link the activity to INC Ransom, but CISA does not name a group. The report also lists CVE-2026-45659 (SharePoint, authenticated RCE), CVE-2025-60710 (Windows LPE), CVE-2026-59310 (VMware vCenter, unauthenticated RCE), CVE-2025-14733 (WatchGuard Firebox, unauthenticated RCE) and CVE-2026-63077 (TeamCity auth bypass via the agent polling protocol); the report names no actors for these.

On macOS, Jamf reported PamStealer (2026-07-02), a two-stage AppleScript/JXA dropper plus Rust Mach-O stealer masquerading as the Maccy clipboard manager that validates stolen admin passwords through PAM, and Overlord (2026-08-06), a configured build of the open-source Overlord RAT delivered by a .NET 10 fake Zoom installer with C2 at hub.zoom.com.kg:5173. Kaspersky's own MacSync analysis (2026-09-24) describes a MaaS crypto stealer plus backdoor with a six-stage chain, iCloud-calendar payload staging, Curve25519/AES-GCM key exchange, LaunchAgent, .zshrc and Git-hook persistence, and PAM password verification. Amos detections rose, and Ngrok topped the macOS detection list.

Socket documented three supply-chain compromises: the jscrambler npm package (malicious 8.14.0 published 2026-07-11, plus 8.16.0, 8.17.0, 8.18.0 and 8.20.0) delivering a Rust infostealer targeting wallets, cloud credentials and AI-agent/MCP configuration files; the arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 crates (2026-08-20) which pulled the malicious proc-macro1 dependency whose build.rs fetched a backdoor from 23.254.165.112; and MemTensor's @memtensor/memos-cloud-openclaw-plugin and PyPI MemoryOS 2.0.34 (2026-09-23) delivering a Go credential-stealing 'sckit' binary with C2 under skyleen.fr. No CVSS applies to the aggregate report.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1133 External Remote Services
- T1204.002 User Execution: Malicious File
- T1059.002 Command and Scripting Interpreter: AppleScript
- T1569.002 System Services: Service Execution
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1543.001 Create or Modify System Process: Launch Agent
- T1505.003 Server Software Component: Web Shell
- T1685.005 Clear Windows Event Logs
- T1685 Disable or Modify Tools
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.003 OS Credential Dumping: NTDS
- T1056.001 Input Capture: Keylogging
- T1018 Remote System Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1113 Screen Capture
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1568.002 Dynamic Resolution: Domain Generation Algorithms
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Qilin CVE-2026-0257 PAN-OS GlobalProtect Access From Kali-Named Host or Known Source IP** (`TL-2026-5627-SPL-001`)

Behaviour-first search for GlobalProtect portal/gateway sessions where the client machine name starts with 'kali' or the public IP matches Arctic Wolf-reported infrastructure used while exploiting CVE-2026-0257 (PAN-OS authentication bypass) for Qilin ransomware initial access (TL-2026-5627).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1133
- **Data sources:** pan_globalprotect, pan:globalprotect, palo_alto_vpn_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=pan_logs sourcetype="pan:globalprotect" earliest=-24h
| eval gp_host=coalesce(machine_name, machinename, host_name, src_host), gp_src=coalesce(public_ip, src_ip), gp_user=coalesce(user, srcuser, src_user)
| where match(lower(coalesce(gp_host,"")), "^kali") OR in(gp_src, "108.61.229.217","108.61.75.232","2.188.33.52","199.247.22.193","70.34.205.43")
| stats count min(_time) as first_seen max(_time) as last_seen values(gp_user) as users values(gp_host) as gp_hosts values(dest) as gateways by gp_src
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let gp_ioc_ips = dynamic(["108.61.229.217","108.61.75.232","2.188.33.52","199.247.22.193","70.34.205.43"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ "Palo Alto Networks"
| where DeviceEventClassID has "globalprotect" or Activity has "globalprotect" or DeviceProduct has "GlobalProtect"
| extend MachineName = extract(@"(?i)(?:machinename|srchostname|hostname)=([^;\s]+)", 1, AdditionalExtensions)
| where MachineName startswith "kali" or SourceIP in (gp_ioc_ips)
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Users=make_set(SourceUserName, 20), Hosts=make_set(MachineName, 20) by SourceIP, DeviceName
```

### Sigma

```yaml
title: PAN-OS GlobalProtect VPN Session From Kali-Named Host or Qilin CVE-2026-0257 Source IP
id: 3f1a9c52-7b0e-4d1a-9a63-562700000001
status: experimental
description: Detects GlobalProtect VPN sessions established from a host named kali* or from public IPs reported by Arctic Wolf during CVE-2026-0257 authentication-bypass exploitation preceding Qilin ransomware deployment.
references:
    - https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/
    - https://securelist.com/malware-report-q3-2026-pc-iot-statistics/121843/
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1133
    - cve.2026-0257
    - detection.emerging-threats
logsource:
    product: paloalto
    service: globalprotect
detection:
    selection_host:
        machinename|startswith: 'kali'
    selection_ioc:
        public_ip:
            - '108.61.229.217'
            - '108.61.75.232'
            - '2.188.33.52'
            - '199.247.22.193'
            - '70.34.205.43'
    condition: 1 of selection_*
falsepositives:
    - Authorised red team or penetration tester connecting from a Kali-named host
    - Security staff lab VPN access
level: high

```

**Known false positives:**

- Authorised penetration testers or red team operators using a Kali VM over VPN
- Employees with personal Linux VMs that report a Kali hostname

**Tuning notes:** Confirm field names (machine_name/public_ip) against your Palo Alto TA version. Add approved red-team source IPs to an allowlist lookup. Extend the IP list from research IOCs as new Arctic Wolf data lands. Correlate hits with subsequent internal RDP/PsExec activity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SonicWall SMA1000 CVE-2026-15409/15410 Exploitation Chain (wsproxy to rollbackConfirm) (locked: unlock with TL Creds)
- Qilin Windows Persistence, Defense Evasion and Impact (MeshUserTask, Run keys, log clearing, PerfLogs payload) (locked: unlock with TL Creds)
- Qilin Lateral Movement, Exfiltration and Remote-Access Tooling (PsExec, Rclone MEGA, Ngrok, MeshAgent, AnyDesk) (locked: unlock with TL Creds)
- Supply-Chain Malicious Package Execution ([indicator], [indicator], MemTensor/[indicator]) (locked: unlock with TL Creds)
- macOS Stealer Persistence via Apple-Lookalike LaunchAgent and Fake Finder Bundle (locked: unlock with TL Creds)
- SonicWall SMA1000 Implants: ROOTRUN xzfind, KNUCKLEBALL, Suo5 Tunnel and ORANGETAIL Web Shell (locked: unlock with TL Creds)
- Qilin Post-Exploitation Credential Dumping (LSASS comsvcs MiniDump, NTDS ntdsutil IFM) (locked: unlock with TL Creds)
- C2 Domain Resolution: Overlord, PamStealer, MacSync, sckit ([indicator]) and INC Ransom Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 42)

Defanged, TLP:CLEAR.

- IP address: `108.61.229[.]217`
- Domain: `helprans[.]com`
- File hash: `81a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f2`

Full set of 42 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [IT threat evolution in Q3 2026. Non-mobile statistics](https://securelist.com/malware-report-q3-2026-pc-iot-statistics/121843/)
- [Exploitation of CVE-2026-0257 leads to Qilin ransomware (Arctic Wolf)](https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/)
- [From WSProxy to ROOT: INC ransomware and SonicWall SMA exploit chain (Resecurity)](https://resecurity.com/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain)
- [PamStealer macOS infostealer: AppleScript and Rust (Jamf Threat Labs)](https://jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/)
- [Fake Zoom installer delivers Overlord RAT on macOS (Jamf Threat Labs)](https://jamf.com/blog/fake-zoom-installer-delivers-overlord-rat-macos/)
- [MacSync new version (Securelist)](https://securelist.com/macsync-new-version/121383/)
- [Jscrambler supply-chain attack (Socket)](https://socket.dev/blog/jscrambler-supply-chain-attack)
- [Popular Rust crates compromised (Socket)](https://socket.dev/blog/popular-rust-crates-compromised)
- [MemTensor compromise (Socket)](https://socket.dev/blog/memtensor-compromise)
- [Ransom Cartel ransomware creator sentenced to 16 years in prison (BleepingComputer)](https://www.bleepingcomputer.com/news/security/ransom-cartel-ransomware-creator-sentenced-to-16-years-in-prison/)
- [Ryuk ransomware member sentenced to 24 months in prison (BleepingComputer)](https://www.bleepingcomputer.com/news/security/ryuk-ransomware-member-sentenced-to-24-months-in-prison/)
- [Conti ransomware gang member sentenced to four years in prison (BleepingComputer)](https://www.bleepingcomputer.com/news/security/conti-ransomware-gang-member-sentenced-to-four-years-in-prison/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5627