Ransomware activity remained high during Q3 2026, with attackers exploiting vulnerabilities in widely used remote access appliances. A Kaspersky report published on 10 November 2026 highlights attacks involving Palo Alto Networks GlobalProtect and SonicWall SMA1000 products.
The findings are based on detection verdicts from Kaspersky products and statistical data shared by consenting users. They show how ransomware operators continued to exploit internet-facing systems to obtain initial access, sometimes progressing from a vulnerable gateway to network-wide encryption and data theft.
Q3 2026 ransomware activity in numbers
Kaspersky products blocked more than 311 million attacks launched from online resources during Q3 2026. Web Anti-Virus responded to 47 million unique links, while File Anti-Virus blocked more than 23 million malicious and potentially unwanted objects.
Ransomware activity also produced several notable figures:
- Researchers identified 4,470 new ransomware variants.
- More than 81,000 users experienced ransomware attacks.
- Qilin accounted for 15 per cent of ransomware victims published on data leak sites.
- More than 217,000 users were targeted by cryptocurrency miners.
Data leak site statistics do not represent every ransomware victim because some incidents are never published. However, Qilin’s 15 per cent share supports separate evidence that its affiliates were conducting active intrusion campaigns during the quarter.
Ransomware activity exploited PAN-OS GlobalProtect
Kaspersky highlighted CVE-2026-0257, an authentication bypass vulnerability affecting the GlobalProtect portal and gateway in Palo Alto Networks PAN-OS. Palo Alto Networks published its advisory on 13 May 2026, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 29 May 2026.
Under specific configurations, CVE-2026-0257 can allow an attacker to establish an unauthorised VPN session without valid account credentials. Exploitation has been associated with deployments using authentication override cookies and a particular certificate configuration. Panorama and Cloud NGFW are not affected.
The authoritative Palo Alto Networks advisory assigns the vulnerability a CVSS score of 7.8. Organisations should consult that advisory to identify affected PAN-OS release trains and the appropriate fixed release because exposure depends on both software version and configuration.
Qilin attacks observed in June 2026
Arctic Wolf observed multiple intrusions exploiting CVE-2026-0257 in June 2026. Those incidents culminated in Qilin ransomware deployment, establishing a direct connection between the authentication bypass and real ransomware activity rather than theoretical risk alone.
Observed post-exploitation behaviour varied. Some intrusions moved quickly towards encryption, while others involved data theft and double extortion before systems were encrypted. This variation was consistent with activity involving multiple Qilin affiliates using the same initial access method.
Public research and proof-of-concept material appeared in late May 2026, increasing the likelihood of broader attacker interest. On 21 July 2026, further reporting described Qilin actively exploiting the flaw. Unit 42 reiterated on 20 October 2026 that exploitation had been observed and continued to be tracked.
SonicWall SMA1000 flaws linked to INC Ransom
The report also identifies CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 remote access gateways. SonicWall disclosed both vulnerabilities and confirmed active exploitation on 14 July 2026. CISA added both flaws to its Known Exploited Vulnerabilities catalogue on the same date.
CVE-2026-15409 is an unauthenticated server-side request forgery vulnerability in the Work Place interface. It can make an affected appliance issue attacker-directed outbound requests. SonicWall rated this vulnerability CVSS 10.0.
CVE-2026-15410 is a post-authentication code injection vulnerability in the Appliance Management Console. It can allow an authenticated administrator to execute operating system commands. Researchers described an exploit chain in which attackers used the server-side request forgery flaw to reach internal components and ultimately execute code as root on the appliance.
The affected SonicWall SMA1000 builds listed by the vendor are:
- 12.4.3-03245, 12.4.3-03387 and 12.4.3-03434.
- 12.5.0-02283, 12.5.0-02624 and 12.5.0-02800.
SonicWall fixed the vulnerabilities in builds 12.4.3-03453 and 12.5.0-02835, with later versions also containing the fixes. Public exploit frameworks appeared soon after disclosure, reducing the time available for defenders to update exposed appliances.
Exploit chain connected to ransomware operations
On 1 August 2026, Resecurity detailed exploitation of the SMA1000 vulnerabilities and linked the activity to an INC Ransom affiliate. Further reporting on 10 August 2026 described ransomware actors abusing the flaws.
This means the SonicWall vulnerabilities, like CVE-2026-0257, were associated with operational ransomware activity. The findings show attackers targeting the remote access layer itself, potentially bypassing the need to steal an employee’s VPN password before entering the wider environment.
Exploitation timeline and current status
The key events occurred over several months before Kaspersky consolidated them into its quarterly analysis:
- 13 May 2026: Palo Alto Networks published its CVE-2026-0257 advisory.
- 29 May 2026: CISA added CVE-2026-0257 to its exploited vulnerabilities catalogue.
- June 2026: Investigators observed intrusions ending in Qilin ransomware.
- 14 July 2026: SonicWall disclosed both SMA1000 flaws and confirmed exploitation.
- 1 August 2026: Researchers linked the SonicWall exploit chain to INC Ransom activity.
- 20 October 2026: Unit 42 reiterated that CVE-2026-0257 exploitation had been observed.
- 10 November 2026: Kaspersky published its Q3 2026 non-mobile report.
All three vulnerabilities have confirmed in-the-wild exploitation. Their inclusion in CISA’s catalogue, vendor acknowledgements and links to Qilin or INC Ransom mean organisations should treat affected appliances as potential entry points, not merely systems awaiting routine maintenance.
What organisations should do now
Organisations using Palo Alto Networks GlobalProtect should check the vendor advisory for vulnerable PAN-OS versions and the configuration conditions required for CVE-2026-0257. They should install the applicable fixed release and review VPN activity for unauthorised sessions or unusual post-authentication behaviour.
SonicWall SMA1000 operators should upgrade to 12.4.3-03453, 12.5.0-02835 or a later supported build. SonicWall’s product notice also identifies var/lib/unit/conf.json as an incident response artefact. If relevant indicators are present, the vendor recommends forensic review rather than assuming that patching alone has removed an existing compromise.
This Q3 2026 ransomware activity demonstrates that perimeter updates must be paired with investigation. Where an appliance was exposed before remediation, defenders should review its logs, associated identity activity and connections into internal systems for evidence of access preceding the upgrade.
Originally reported by securelist.com.
