High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7

High-severity flaws are exploited faster; ransomware remains the dominant threat; the US is the world’s most targeted country, and attacks increasingly involve the use of AI (but largely manually rather than autonomously).

Rapid7’s threat analysis for Q3, 2026 adds color to these basic details of the current threat landscape.

During Q3, high-severity vulnerabilities were exploited within an average of three days from disclosure, with 71% exploited during the first seven days. Seventy-nine percent of these vulnerabilities are classed by Rapid7 as ‘holy grail’ flaws (that is, remote and requiring neither credentials nor local user involvement).

Ransomware remains a primary threat throughout the world. The most targeted sectors in Q3 were business services, manufacturing, and healthcare. The US was the most targeted nation (60% of attacks), followed by Germany (7%), Italy (5%) and Canada (5%).

The most successful ransomware groups were The Gentlemen (342 claimed incidents) and Qilin (339). INC Ransom was third with 99, followed by DeadLock (98), and Krybit (95).

Government sector victims of ransomware are increasing (up 15% on the previous three months) and are also focused on the US (with its share growing from 33% in Q2 to 45% in Q3).

The expected use of AI in attacks is beginning to show, but perhaps more slowly than forecasted or feared. “The finding I’d put in front of anyone is that AI showed up as an operational component in only 8% of the incidents we tracked. That’s interesting because the board-deck version of this year has been wall-to-wall AI attackers, and the data doesn’t support that story,” Douglas McKee, director of vulnerability intelligence at Rapid7 told SecurityWeek.

According to the report from Rapid7, only 8% of tracked incidents cited AI as an operational component, and this is not yet fully autonomous. “Humans still chose what to attack and why in every documented case,” says the report. What is growing, however, is automation of the ‘tactical middle’ of the attack chain: technique selection, target triage, and recovering from a failed step can all now run without a human being present.

“The piece people keep mashing together is AI finding flaws versus AI exploiting them. Finding is real, and it’s accelerating. The AI exploitation wave everyone is bracing for didn’t show up in our data this quarter.”

Defenders, suggests Rapid7, should monitor AI API usage patterns from unexpected hosts and processes as a telemetry source; that is, actively look for unusual or unauthorized use of AI tools within the environment.

For their part, attackers attempt to avoid detection by using fragmented, multi-session prompting to bypass AI provider safeguards. While single-session malicious requests are often blocked, splitting objectives across multiple sessions can evade detection.

During Q3, the researchers tracked 15 separate nation-state (APT) and cybercrime groups. Noteworthy examples include ENERGETIC BEAR, Void Blizzard, and Sandworm which are all Russia linked. APT31 is China linked, Lazarus is North Korea, and Operation C-Major is Pakistan.

Government organizations are the core target for APT groups. Other sectors include defense, transportation, media, healthcare, aerospace, finance, energy, and technology. Among the attackers, the research discloses a previously undocumented Linux toolkit (a backdoor named ‘ted’ compiled into a trojanized HAProxy build, an SSH keylogger, and a curl-based RAT) used by the DPRK against South Korean organizations since early 2025. The Operation C-Major group has been active since the mid-2010s and focuses on using phishing and mobile spyware for espionage against Indian military and diplomatic staff.

On the dark web during this period, access broker listings dominate activity. Listings ranged from individual compromised accounts (bank logins bundled with ‘full’ identity data for at least three major U.S. banks) to full enterprise footholds. Forty-one out of 63 underground posts advertised RDP or network access. Fourteen involved the sale, sharing, or discussion of exploits and zero-days.

While the dark web is an active marketplace for attackers, it is also a useful defenders’ early-warning sign for potential future attacks.

Rapid7’s threat landscape report is a snapshot of attacker activity and current threats. Most of this is increasing, especially in the speed of delivery. It also provides an early warning for increased AI-driven attacks. What currently occurs is largely human controlled, but the potential for fully automated AI-assisted attacks remains and is likely to arrive in the next few years.