In the third quarter of 2026, Rapid7’s analysis highlights the rapid exploitation of high-severity vulnerabilities, with ransomware continuing to dominate as a significant threat. The United States emerged as the most targeted nation, while artificial intelligence plays an increasing, albeit still limited, role in cyber attacks.
Swift Exploitation of Vulnerabilities
Rapid7’s report reveals that high-severity vulnerabilities were exploited within an average of three days post-disclosure, with 71% targeted in the first week. A notable 79% of these are ‘holy grail’ vulnerabilities, allowing remote access without the need for credentials or local user interaction.
Ransomware’s Ongoing Threat
Ransomware remains a pervasive threat globally, with the business services, manufacturing, and healthcare sectors being the most targeted during Q3. The United States bore the brunt of these attacks, accounting for 60% of incidents, followed by Germany, Italy, and Canada.
Among ransomware groups, The Gentlemen and Qilin led in attack numbers, with INC Ransom, DeadLock, and Krybit following closely. The government sector saw a 15% rise in attacks, primarily focused on the US.
The Role of AI in Cyber Attacks
While AI’s presence in cyber attacks is growing, it was involved in only 8% of incidents tracked by Rapid7, operating more as a tactical tool than a fully autonomous threat. The use of AI in identifying vulnerabilities is advancing, but its exploitation capabilities remain limited for now.
Attackers employ fragmented, multi-session strategies to circumvent AI provider safeguards, avoiding detection. Defenders are advised to monitor AI API usage for signs of unauthorized activity.
Nation-State and Cybercrime Activities
In Q3, 15 nation-state and cybercrime groups were tracked, with notable actors linked to Russia, China, North Korea, and Pakistan. Government entities remain prime targets, alongside sectors like defense, media, and technology.
The dark web continues to serve as a marketplace for illicit activities, offering a glimpse into potential future threats. Access broker listings were frequent, with discussions of exploits and zero-days prevalent.
Rapid7’s insights offer a vital snapshot of the current threat landscape, emphasizing the need for vigilance against rapidly evolving cyber threats and the impending rise of AI-driven attacks.
