CTI Weekly Brief — 2026-09-19 16:48 UTC

Snapshot

The last 7 days saw 202 victims, with 45 groups identified. The hottest group is thegentlemen, with 30 victims in the last 7 days. The sector mix is Technology (5), Manufacturing (5), Healthcare (3), Other (3), and Not Found (3). The country mix is US (4), IT (2), IN (2), BG (2), and BR (2).

Trends

_Jev 6-month trend snapshot · 2026-09-19 22:10 UTC_

• Regime (6mo): volatile
• Wave type (30d): duopoly
• Daily vs trend: quieter than trend
• Leader stability (6mo): short term challenger
• Trend severity (6mo): 1.9
• Escalation needed: elevated (0.79)
• Geo US-heavy: elevated (0.90)
• KEV pressure today: moderate (0.63)

• Victims: 24h 8 · 7d 202 · 30d 939 · 180d 6,047
• MoM change: -57.5%
• Hottest: 7d `thegentlemen` · 30d `qilin` · 180d `qilin`

Hottest groups

The hottest group in the last 7 days is thegentlemen, with 30 victims. The top 5 groups are:

• thegentlemen: 30 victims
• qilin: 29 victims
• AuditTeam: 13 victims
• akira: 10 victims
• N0n: 10 victims

ATT&CK notes

• qilin: T1027.013, T1082, T1134, T1480.002, T1547.004, T1529, T1071.002, T1087.001, T1489, T1566.002, T1047, T1106
• akira: T1083, T1082, T1059.001, T1047, T1059.003, T1135, T1106, T1490, T1057, T1486, T1567.002, T1213.002
• lockbit5: T1140, T1573.001, T1548.002, T1484.001, T1059.001, T1112, T1480.002, T1027.013, T1027.002, T1680, T1543.003, T1569.002
• incransom: T1120, T1570, T1566, T1106, T1652, T1490, T1047, T1680, T1135, T1486, T1140, T1083
• play: T1486, T1490, T1083, T1030, T1016, T1048, T1070.004, T1059.003, T1059.001, T1560.001, T1018, T1057
• chaos: T1573.001, T1059.004, T1110, T1205, T1104

KEV/CVE

• CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability
• CVE-2026-48027: Nx Console Embedded Malicious Code Vulnerability
• CVE-2026-45321: TanStack Unspecified Vulnerability
• CVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
• CVE-2024-1708: ConnectWise ScreenConnect Path Traversal Vulnerability
• CVE-2024-57728: SimpleHelp Path Traversal Vulnerability
• CVE-2024-57726: SimpleHelp Missing Authorization Vulnerability
• CVE-2023-27351: PaperCut NG/MF Improper Authentication Vulnerability