Infostealer Threat Report — September 2026
09/01/2026 – 09/30/2026
Threat summary
Key figures from the month's threat activity.
- Ransomware victims850organizations listed on leak sites27% decreasefrom the previous monthView details
- Most active ransomware groupThegentlemen105 organizations listedView details
- Exploited vulnerabilities43added to the CISA Known Exploited Vulnerabilities catalogView details
- Publicly disclosed breaches42.6Maccounts affected in 7 breachesView details
Country distribution
287,268
infected devices · in 217 countries
Report periodSep 1, 2026 - Sep 30, 2026
Top five share: 29%
Risk score
58+20vs previous month
- Infected devices
- 287,268
- Android devices
- 112,115
- Countries
- 217
- Domains
- 2,407,227
- Employee accounts
- 89,280
- Customer accounts
- 16,065,909
Top 10 malware families
infectionsTop 10 antivirus
infected devices- 1Windows Defender48,750
- 2Reason Cybersecurity1,908
- 3Kaspersky339
- 4Malwarebytes292
- 5Avast162
- 6ESET Security66
- 7Norton 360 for Gamers55
- 8Panda Dome43
- 9Tencent PC Manager43
- 10Norton Security Ultra41
Top 10 domains
- 1612,704
- 2418,931
- 3319,375
- 4278,770
- 5166,102
- 6160,304
- 7106,433
- 8103,522
- 997,307
- 1095,221
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education3.1Korganizations829.6Krecords33Ransomware victims13,538employee accounts
- 2Technology1.4Korganizations3.9Mrecords95Ransomware victims8,042employee accounts
- 3Government1.1Korganizations1.2Mrecords28Ransomware victims5,559employee accounts
- 4Telecommunications271organizations176.7Krecords–Ransomware victims2,917employee accounts
- 5Retail and e-commerce369organizations1.2Mrecords54Ransomware victims1,021employee accounts
- 6Manufacturing and industry342organizations112.3Krecords147Ransomware victims951employee accounts
- 7Gaming and betting165organizations800.9Krecords–Ransomware victims627employee accounts
- 8Nonprofit189organizations144.9Krecords–Ransomware victims615employee accounts
- 9Media139organizations736.6Krecords–Ransomware victims570employee accounts
- 10Finance191organizations673.4Krecords40Ransomware victims486employee accounts
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.