Monthly Cyber Threat Report #1: Where ransomware stands worldwide

Each month this series puts the fraud and malware numbers from Kaspersky’s public statistics site next to other sources such as CISA, Sophos and Chainalysis. The first issue covers September 14 to October 13, 2026. Our previous post, Weekly Security Bulletin #1, looked at software flaws. This one looks at malware and ransomware, and updates what happened to the flaws from that bulletin.

First, what carries over from last week

Two flaws from the weekly bulletin were added to CISA’s Known Exploited Vulnerabilities list (KEV) on October 13. Their remediation deadline is October 16. CISA’s October 14 list adds four more entries, due October 17. The Palo Alto flaw requires an authenticated attacker with network access, so I put old and new flaws in one table.

The Chrome advice from last week stands: the browser should be on version 155.0.8059.79 or newer. A newer release may be out by now, so check Chrome’s About page.

What do these numbers measure?

Kaspersky publishes country by country the threats its antivirus catches on its users’ devices. A percentage here means the share of Kaspersky users in that country where a threat was seen. It does not measure the whole country, and results also depend on who installs Kaspersky.

Ransomware worldwide

Turkmenistan is first (0.78%), followed by Uruguay (0.70%) and Afghanistan (0.66%). The top six, which also include Yemen, China and Iran, are all above 0.47%. Five countries from the top 10 of Securelist’s Q2 report also appear in this monthly list: Turkmenistan, China, Cameroon, Pakistan and South Korea. That may point to a lasting pattern, though a single month cannot prove it.

The top entry (Trojan-Ransom.Win32.Gen.p, 30.72%) is not a specific family. It is a generic detection that says “this looks like ransomware”. Two WannaCry variants also made the top 10. WannaCry shook the world in 2017 and still turns up on unpatched Windows machines.

What the detection names mean

Kaspersky’s detection names look cryptic at first. The parts usually say this: the first part is the type (Trojan, Backdoor, Hoax), the second the platform (Win32, AndroidOS, Script), and the last the name of the family or version.

How ransomware starts and what it costs

Sophos’s 2026 study asked 2,158 IT and security leaders in 17 countries whose organizations had been hit by ransomware. It covers businesses, so it does not map one to one onto home users, but it shows which door attackers use.

The top four causes are email, phishing, stolen passwords and unpatched flaws. Most attacks begin with one person’s click or one hijacked account. One more number stands out: Sophos says 97% of victims whose root cause was compromised credentials had some form of multi-factor authentication turned on. That does not show MFA is pointless. It means you should check that it is really on for every account and the most targeted places, such as VPNs and admin panels.

According to Chainalysis, the share of victims who paid fell to 28% in 2025, a record low. At least $820 million in payments were tracked on-chain in 2025. The median payment rose from $12,738 to $59,556. In Sophos’s survey, 48% of victims whose data was encrypted say they paid. The two figures use different methods and samples, so do not compare them directly.

What you can do

Most ransomware and other malware gets in through the same few doors. The steps below need no special knowledge and are effective enough for a home user.

Method and limits

In the next issue I will compare the status of the Ivanti and Windows flaws, new KEV entries and the next period on Kaspersky’s site with this post.