An analysis of the most active threat actors, highest-impact CVEs, and emerging attack trends across Q1 2026 — compiled from open-source intelligence, vendor disclosures, and VAPTIC research.
The most active and dangerous threat groups observed this quarter — based on confirmed incident attributions, OSINT, and vendor intelligence reports.
Despite the February 2024 law enforcement disruption (Operation Cronos), LockBit affiliates have regrouped under new infrastructure. Q1 2026 saw 34 confirmed new victims across manufacturing, healthcare, and critical infrastructure.
The group responsible for the 2023 MGM and Caesars attacks continues to target large enterprises using sophisticated vishing and MFA fatigue techniques. Q1 2026 saw three new hospitality sector breaches attributed to affiliates.
China's Volt Typhoon APT continues pre-positioning campaigns in US and European energy, water, and communications infrastructure. Notable for "living off the land" techniques that evade traditional AV and EDR solutions.
Following the FBI disruption and $22M Change Healthcare ransom, ALPHV operators have re-emerged under new branding. Healthcare sector continues to be a primary target with attacks aimed at payment processing and patient record systems.
Vulnerabilities actively exploited in the wild during Q1 2026, ranked by CVSS score and exploitation frequency. Patch these first.
Observed shifts in attacker behaviour, technique prevalence, and campaign targeting over the quarter.
Percentage of confirmed incidents by sector. Healthcare and critical infrastructure continue to bear disproportionate attack volume relative to sector size.