During the week of September 20 to September 27, 2026, Forsan's threat intelligence team tracked a total of 315 new claims across the global threat landscape. Among these recorded incidents, 87 were classified as high or critical severity, underscoring the persistent and aggressive posture maintained by malicious cyber actors against enterprise environments.

A breakdown of the activity by malicious motivation reveals a heavy concentration of traditional extortion and disruptive campaigns. Specifically, the data shows 199 ransomware claims compared to 2 hacktivist and DDoS-related claims, illustrating that financially motivated encryption and data theft continue to dominate the primary methods of compromise.

Activity at the threat actor level was led by killsec3, which accounted for 46 claims this week. Other notable actors contributing significantly to the volume include Unattributed groups with 28 claims, clop with 23 claims, qilin with 18 claims, and everest rounding out the top tier with 12 claims. The prominence of groups like Clop and Qilin highlights the ongoing threat posed by established ransomware-as-a-service ecosystems.

From a vertical perspective, targeting remained diverse with a heavy emphasis on operational and information-intensive industries. The top five targeted sectors for the week were Manufacturing with 26 claims, Professional Services with 21 claims, Technology with 17 claims, Healthcare with 16 claims, and Financial Services with 9 claims. This distribution suggests adversaries continue to exploit supply chains and intellectual property within manufacturing and professional services.

Regionally, our monitors recorded 6 Middle East-tagged claims during this reporting period. While representing a smaller fraction of the global total, regional organizations must remain vigilant against targeted campaigns and ensure their perimeter defenses are continuously audited.

In addition to extortion and actor tracking, organizations must maintain strict vulnerability management protocols. The most severe vulnerability highlighted this week is CVE-2026-100706, carrying a critical CVSS score of 9.9. Forsan advises all security teams to review their infrastructure for exposure to this flaw and prioritize immediate patching to mitigate potential exploitation risks.