Quarterly Threat Landscape Report

If you only keep one number from this report, make it 3. That's the average time between a new high-severity vulnerability going public and someone using it against somebody else. Not three weeks. Not "at the next change window." Three days. And 71% of all the exploitation we tracked landed inside the first seven. So if your patch cycle still has the word "monthly" in it, congratulations: It's perfectly calibrated for an adversary who stopped existing a while ago.

On the ransomware side, The Gentlemen and Qilin finished in a near photo finish, 342 versus 339 leak-site posts, before the field falls off a cliff to 99 for INC Ransom. The U.S. alone accounts for 1,112 listings, roughly eight times Germany, and in the government sector its share among the top ten countries jumped from 33% to 45%. Group names come and go like startups in a hype cycle. The tradecraft stays. Meanwhile on the underground forums, 41 of 63 posts were someone selling a way in, and the "exploits" on offer were mostly last week's advisories in a fresh jacket. No zero-day apocalypse, just a very well-run retail market for your RDP.

Despite talk of AI agents running wild, this quarter’s AI-related cases remain human-directed for both targets and objectives, with AI assisting in the tactical middle of the attack chain as opposed to acting autonomously.

Which brings us to what's different on our side this quarter. We announced the Rapid7 Intelligence Organization, built on a simple idea: The research, the incident response front line, and the underground monitoring shouldn't sit in separate rooms, nodding politely at each other in meetings. You'll see that in this report: The vulnerability data, the leak sites, the forums, and what our responders keep running into come together as one story instead of four. We've also given the website a new look and feel.

At some point "three days" stops being a statistic and becomes a design requirement. Welcome to day three. You're already late.