During the tracking period from October 18 to October 25, 2026, Forsan's threat intelligence analysts recorded a total of 432 new claims across the global landscape. Out of this total volume, 109 claims were classified as high or critical severity, demanding immediate situational awareness from defensive teams and security leadership.

A breakdown of the activity by threat groups highlights prominent actors driving the volume. Qilin led all groups with 67 claims, followed closely by N0n with 43 claims and n0n with 37 claims. Unattributed groups accounted for 24 claims, while Akira rounded out the top actors with 14 claims recorded during the week.

The sector distribution indicates that organizations in traditional operational and digital service verticals remain primary targets. Manufacturing absorbed the highest volume with 29 claims, followed by Professional Services with 24 claims, Technology with 20 claims, Healthcare with 16 claims, and Retail & E-Commerce with 15 claims.

An analysis of attack vectors and claim methodologies reveals a heavily skewed split between extortion-driven operations and disruption campaigns. Specifically, the data shows 227 ransomware claims compared to only 2 hacktivist or DDoS-related claims, underscoring the ongoing dominance of financial extortion frameworks.

On the vulnerability management front, analysts identified CVE-2026-113744 as the most severe vulnerability of the week, carrying a critical CVSS score of 10.0. The presence of a maximum-severity flaw emphasizes the continuous need for rapid patching cadences and comprehensive vulnerability assessment across enterprise networks.

Regionally, the dataset captured 7 Middle East-tagged claims during this reporting window. Forsan advises organizations across the region and globally to utilize these aggregated indicators to benchmark their risk postures, prioritize vulnerability remediation, and enhance perimeter defenses against active threat actors.