Q3 2026 at twelve numbers. Each number drives at least one section of this report.

Two framing observations before we dive in. First: the ratio of distinct IOCs to raw observations is approximately 1 : 1.92 — meaning the deduplication layer is removing roughly half of ingested rows as duplicates across sources, which is a healthy sign of multi-source corroboration. Second: the quarter is heavily back-loaded. September alone contributed 7.19 million distinct IOCs — more than July and August combined. The chart below shows the monthly shape.

Q3 did not distribute evenly across its three months. The chart shows month-by-month distinct-IOC volume. The surge in September is almost entirely attributable to a single persistent command-and-control operator that produced approximately 45,000 fresh indicators per week across three consecutive weeks (31 August – 20 September).

The September surge is real — those indicators were observed, confirmed, deduplicated and attributed — but the operator shape is one dominant producer plus a materially narrower long tail than July or August showed. Named-adversary count actually fell in September (333 vs August’s 463) despite the IOC surge because the surge was concentrated in one operator while the broader adversary population consolidated.

Seven IOC types were observed in Q3. Domains dominate the corpus (74% of all distinct IOCs), reflecting both the reality that adversaries register domain infrastructure far more frequently than they rotate IP infrastructure, and our platform’s broad domain-coverage pipeline (NRD Watch + Domain Intelligence).

Eleven adversary types were observed in Q3. The table below shows each type with its distinct named-operator count and total distinct IOC volume. The “Named operators” column answers the question CISOs most often ask: “How many distinct ransomware groups are we tracking right now?”

Four observations from this table:

• The C2 tier dominates by IOC volume but is operator-light. 74 operators produced 7.1M IOCs — a 96,000:1 ratio. This is infrastructure-provisioning operations, not endpoint-compromise operations.
• The ransomware tier is operator-rich but IOC-light. 386 operators produced 3,434 IOCs — a 9:1 ratio. This is the affiliate-economy signature: many small operators each running tight, focused campaigns.
• The Threat Actor and Malware tiers sit in between. 239 named APT groups + 259 malware families + 158 campaigns represent the mid-density population — meaningfully diverse operators each producing meaningful volume.
• Scanner activity is attribution-free but massive in volume. 991,723 distinct scanner IOCs with zero named operators means almost all of this activity is attributed only at the behavioural level — the precursor-reconnaissance tier.

Five structural observations about the Q3 2026 landscape, each tied to specific control recommendations.

Section 06 Observation 03 opens the story on C2 industrialisation. This section goes deeper on what that means operationally — because the industrial-scale C2 pattern is the single most important structural shift of Q3 2026.

The scale: 74 named C2 operators produced 7,149,454 distinct network-address IOCs across 92 days — an average of 96,614 IOCs per operator per quarter, or roughly 1,050 IOCs per operator per day. One specific operator sustained ~45,000 fresh indicators per week across three consecutive weeks in September; that single operator alone deposited approximately 144,000 unique network addresses into the Q3 corpus.

Provisioning velocity: averaged across the C2 tier, the per-operator provisioning rate is roughly 44 fresh network addresses per hour sustained. The highest-velocity individual operator provisioned closer to 267 addresses per hour during peak weeks. These rates exceed the ingest and distribution speed of any enterprise individual-IP block-list architecture by two to three orders of magnitude.

What the market looks like: the 74 named C2 operators split into roughly four tiers. A small handful of industrial operators (fewer than 10) provision at tens of thousands of IOCs per week. A mid-tier group of 15-20 operators provision at single-digit thousands per week. A long tail of 40-50 smaller operators provision at hundreds per week. The industrial operators function as infrastructure suppliers to downstream campaign operators including many of the 386 ransomware affiliates.

Our platform maintains a continuous CIDR-cluster analytics layer (90-day rolling window) that groups activity by /24 network block. Each /24 is characterised by its unique IP count, unique adversary count, feed overlap and other signals. Across Q3’s rolling-90-day window we tracked 192,049 distinct /24 clusters, carrying 4,243,556 total observations and 1,266,134 distinct IPs.

The signal that matters for defenders is the distinct-adversary count per /24. A /24 with one adversary is probably one operator’s rental pool. A /24 with multiple adversaries is almost certainly a shared-infrastructure block.

1,036 /24 blocks hosted multiple distinct adversaries during Q3. 10 of those blocks hosted 5 or more adversaries. One single /24 block hosted eight different named adversaries — the strongest shared-infrastructure signal in the Q3 dataset. These multi-actor /24s are the correct CIDR-density enforcement targets: blocking any one of them removes multiple operators simultaneously.

Our Cloud Battleground attribution layer correlates every IP-tier IOC in the corpus against a catalog of hyperscaler, CDN, VPN, SaaS and bulletproof-hosting provider CIDRs. The resulting fact table pre-joins IOC × provider so provider-level analytics are millisecond-fast.

Q3 picture: 711,000+ attributed indicators correlated to legitimate public-cloud ranges, spanning twenty top providers with meaningful attributed-adversary activity. The chart and table below show each provider’s Q3 activity, anonymised with class + rank labels. The real-identity key is preserved in the HuntIntel operator console.

Anonymisation key: Hyperscaler-A through Hyperscaler-M are the thirteen largest cloud providers by Q3 attributed-indicator volume. CDN-A and CDN-B are the two primary content-delivery networks. Anonymiser-A is a Tor-exit-node class provider. SaaS-A and SaaS-B are developer-platform and anonymised-browsing SaaS respectively. AI-Bot-A is an AI-crawler bot network. Search-A is a major search / portal provider’s attributable IP range.

Four observations from the Cloud Battleground data:

• Thirteen hyperscalers carry attributed activity. This is not a “one bad cloud” picture — adversary operations distribute across every major public-cloud provider.
• Hyperscaler-A, B and C carry the most attributed activity (106K, 98K, 77K rows). Together they host ~40% of all cloud-attributed Q3 indicators.
• Anonymiser-A has the lowest IP diversity — 1,914 distinct IPs carrying 61,858 attributed observations means a small number of exit nodes see very high repeat-attribution activity.
• Hyperscaler-B has the highest named-actor diversity: 48 distinct operators. This provider hosts the broadest cross-section of the Q3 adversary population — a strong candidate for provider-aware trust-scoring.

Where adversaries directed their operations in Q3. The chart and table show targeting events (not successful breaches — observed-targeting indicators extracted from feed-source attribution). The “Adv Types” column shows how many distinct adversary types (out of 11) targeted each sector.

Three observations about this landscape:

• Technology (21,443) and Government (20,779) lead by raw volume — both at 8 distinct adversary types, meaning the broadest attack-surface diversity. These sectors face every major adversary class.
• Healthcare, Financial Services and Manufacturing cluster closely (18.5K / 15.8K / 16.0K events). Attack-type diversity is 7 — one notch below Technology/Government but still substantially broader than the long tail.
• Critical Infrastructure and Military have lower raw volumes but narrower diversity (2,306 and 1,728 events, 4 and 3 adversary types). Consistent with these sectors being primarily targeted by APT and C2-class operators.

Geographic attribution of adversary targeting across Q3. “Targeting events” are instances where an indicator carried a geographic-targeting label.

The seven most-targeted countries all exceed 8,000 events: United States (13,032), Germany (11,601), United Kingdom (11,261), Canada (11,015), France (11,012), Australia (10,542) and India (8,789). These are the long-tail-stable top-targeted nations — large economies with digital-first critical infrastructure. The 6-7 adversary-type diversity confirms enterprise defenders in these jurisdictions face every major adversary class.

India at 8,789 events / 6 adversary types is a meaningful standout for an Asian-Pacific nation ranking directly behind the Five Eyes economies — reflecting both India’s rising digital-economy profile and the specific targeting of its banking sector observed in the brand-lookalike data.

Our platform resolves adversary-reported technique annotations against the MITRE ATT&CK framework. The heatmap and table show the top 15 techniques by observation count. The cell intensity in the heatmap scales with event count.

Four observations about Q3’s technique landscape:

• The top three techniques are classics. T1105 Ingress Tool Transfer, T1027 Obfuscation, T1189 Drive-by Compromise. These dominate every modern threat landscape and are the techniques most detection content should prioritise.
• T1041 at 8,764 events reflects the C2-dominated nature of the corpus. With 7.1M C2-tier IOCs, exfiltration-over-C2 is the volumetric baseline of adversary data-theft operations.
• T1190 Exploit Public-Facing Application at 3,475 events reflects the initial-access-via-exploitation surface — paired with the CVE table in Section 13.
• T1486 Data Encrypted for Impact at 3,149 events confirms the ransomware operator-diversity story. 386 operators each contributing to this technique produces a mid-tier volume that any precursor-cascade rule will catch at scale.

Vulnerabilities actively exploited by named adversaries during Q3, ranked by observation count.

The composition tells three stories:

• Edge-device vulnerabilities dominate the top of the list. TP-Link, D-Link, SolarView, Huawei, Realtek SDK. This is the botnet-recruitment attack surface — low-security consumer and small-business routers compromised at scale to form distributed infrastructure.
• Enterprise identity-and-messaging vulnerabilities form the second cluster. ProxyShell (CVE-2021-31207, CVE-2021-34523) and ProxyLogon (CVE-2021-26855) remain actively exploited at 400+ events each despite being 2021 vulnerabilities with widely-available patches.
• Modern enterprise tooling vulnerabilities round out the list. ScreenConnect (CVE-2024-1709, 1708), Veeam (CVE-2023-27532), Spring4Shell (CVE-2022-22965), Cisco ASA (CVE-2020-3259). These enable lateral movement, backup-destruction, and widespread enterprise compromise.

Our NRD Watch pipeline monitors the global stream of newly-registered domains, applying a six-feature DGA detection model to every candidate. Q3’s output:

Why NRDs matter: newly-registered domains are the single highest-leverage early-warning signal in the modern threat environment. Adversaries buy new domains for every phishing campaign, every DGA-generated C2 infrastructure, every brand-impersonation attack. The gap between registration and first weaponisation is typically 24-72 hours — the window during which proactive NRD scoring can block the domain before any endpoint ever queries it.

The DGA scoring model: each domain’s name (TLD stripped) is scored 0-100 as a weighted sum of six features, each normalised to 0-1 before weighting. Character diversity (weight 30): rewards random-looking names that use most of the alphabet. Consonant-run length (20): penalises unpronounceable consonant streaks. Vowel scarcity (15): one-sided penalty for low vowel ratio. Length band (15): full points for 8-16 characters (common DGA family range). Digit density (10): penalises heavy digit mixing. Dictionary-word absence (10): penalises domains that contain any common English or brand substring.

Thresholds: ≥70 HIGH (hard-block recommended), 55-69 LIKELY (daily review), 45-54 POSSIBLE (watchlist).

Not all top-level domains carry equal threat weight. Our NRD Watch rollup tracks which TLDs produce the highest newly-registered-domain volumes across Q3.

The TLD distribution tells a three-tier story:

• Legacy generics (.com, .net, .org) still dominate. .com alone produced 1.80 million NRDs in Q3 — the largest TLD by registration volume and the TLD most adversaries default to for lookalike domains.
• Cheap generics are the real abuse surface. .xyz (506K), .top (219K), .shop (144K), .online (107K), .site (71K), .vip (56K), .store (56K), .click (41K). These TLDs offer registration prices sometimes under one US dollar — the economic choice for mass-DGA and phishing infrastructure.
• Country-code TLDs with permissive registration carry notable volume. .cn (159K), .ru (67K), .uk (48K), .br (38K).

Our Domain Intelligence engine maintains a persistent brand-lookalike watchlist, continuously matching new domain registrations against high-value brand names (banks, major tech companies, cryptocurrency exchanges, consumer services). Q3’s top-15 brand-lookalike targets:

Axis at 2,012 lookalike domains in Q3 alone is the single-largest brand-lookalike event in the dataset — reflecting concentrated attacker focus on India’s banking sector. At that volume, the brand faces approximately 22 new lookalike domains registered against it every day on average — a continuous intake rate no manual review process can keep up with.

• Banking brands dominate. Axis, Chase, Wells, Binance, Coinbase, PayPal — six of the top-15 are financial-services. The motivation is obvious: successful phishing against banking brands converts directly to monetised fraud.
• Consumer-tech brands follow. Apple, Amazon, Google, WhatsApp, Netflix, Microsoft, Facebook, Instagram. Targeted both for credential-harvesting and ecosystem-abuse.
• Cryptocurrency exchanges are a growing surface. Comparatively small by lookalike-count but very high by per-lookalike monetisation potential.

Our Domain Intelligence engine runs two complementary DGA detectors over the full attributed-domain corpus. The entropy-based detector catches classical character-random DGAs. A separate dictionary-based detector catches DGAs that concatenate real English words (Suppobox, Matsnu, Rovnix family) and evade the entropy detector by producing pronounceable strings.

Why dictionary-DGA detection matters: the classical entropy-based DGA detector catches malware families like Necurs or Mirai whose generated domains look obviously-random (xkqwqpsjlk[.]com). But a newer generation of DGA families — Suppobox, Matsnu, Rovnix — generate domains by concatenating real English words (brightmoment[.]com, sweeterwater[.]com). Our dictionary-DGA detector flags pure-alpha, hyphen-free, pronounceable domains that contain ≥2 distinct common dictionary words.

The 200 named adversary domain-fleet entries represent operators whose domain-registration infrastructure has been fingerprinted sufficiently to be tracked as a fleet: a persistent domain-generation pipeline tied to a specific operator identity, with domain count, TLD distribution, severity mix and attack-type profile.

Structural clustering of DGA families: beyond scoring individual domains, our engine clusters DGA candidates into structural families based on their generation algorithm’s statistical fingerprint. Two domains generated by the same DGA function will have highly similar feature profiles — length, character set, vowel ratio, digit density — even if they share no visible textual similarity. The analytical leverage is one-to-many: identify one representative sample, block the whole family.

Our Domain Intelligence engine’s homoglyph detector catches two distinct attack patterns: IDN punycode domains (xn---prefixed internationalised domains that render as near-indistinguishable Unicode variants of real brand names) and leet-substitution brand lookalikes (g00gle, paypa1, microsо​ft).

IDN punycode attacks are among the most insidious phishing techniques in the modern landscape. A domain like xn--pple-43d[.]com renders in most browsers as a visual variant of apple.com using a Unicode character substitution visually indistinguishable to most users. Browsers have added mitigations (Punycode display for mixed-script domains, Latin-only policy for enforcing TLDs) but the attack surface remains meaningful.

Leet-substitution brand lookalikes are the volumetric majority (1,719 vs 281). These are the g00gle.com, paypa1.com, micr0soft.com, amaz0n.com pattern — simple character substitutions (zero for O, one for L, three for E) that human readers often miss at a glance.

Q3 2026 is the quarter the threat landscape stopped being covered by assumptions and started being covered — or not — by architecture. The 8.3 million IOCs, the 1,160 named adversaries, the 386 ransomware operators, the industrial C2 tier, the cloud-colocated adversary infrastructure, the half-million suspicious new domains: these are not alarm bells. They are the shape of the environment your controls operate against today, documented at scale.

What good looks like in Q4: a CISO who can walk a board through the four risk-register entries in Section 19 and point to specific control changes shipped during Q4 against each. A SOC director who can show a coverage matrix against the top-10 MITRE techniques with production-tier Sigma rules for each. A detection-engineering team that has deployed DGA scoring at the DNS-resolver layer, cloud-aware trust scoring at the perimeter, and CIDR-density enforcement at the egress firewall.

What getting it wrong looks like: entering 2027 with 2024-era architecture, 2024-era detection content, and 2024-era assumptions about where the adversary lives. The programs that ship the architecture pivot in Q4 will enter 2027 with meaningfully reduced incident probability. The programs that don’t will spend 2027 explaining incidents to boards that could have been foreseen from this document, published in October 2026.

Cite this document as: HackForLab CTI Research. “Q3 2026 Threat Landscape Report: 8.3 Million IOCs, 1,160 Adversaries, and the Industrialisation of Attack Infrastructure.” October 2026. hackforlab.com/q3-2026-threat-landscape-report/.