Threat Intelligence Spotlight Report

Threat Intelligence

October 15, 2026

August Threat Intelligence Spotlight Report

Download the Report

Each month, our Cyber Threat Intelligence team compiles data from our engagements to determine key industry trends. We look at the initial access methods threat actors are using to gain entry into a network, types of incidents most commonly impacting organizations, which sectors are being more heavily targeted, and which threat groups are most prevalent.

 

Our Methodology 

  • Kroll CTI monthly spotlights are based on intelligence from Kroll’s cyber incident response engagements where we are engaged to respond, manage, or mitigate a cybersecurity incident.
  • Kroll’s incident response work is informed by intelligence gained from the thousands of engagements handled per year by the Kroll Cyber Risk team.
  • Data is collected and processed by the Kroll Cyber Threat Intelligence team during the initial scoping intake as well as during the lifecycle of a Kroll engagement. 

Download the August Report

We will use this information to respond to your inquiry and process your data in accordance with our privacy policy.

Industry Analysis

  • Professional, scientific, and technical services was the most impacted industry in August 2026 
    • Email compromise was the top reported threat incident type impacting the professional, scientific, and technical industry. 
    • In August, threats against the professional, scientific, and technical services industry most often involved phishing: attachment as the initial access method.
  • Information was the second most impacted industry in August 2026.
    • Unauthorized Access was the top reported threat incident type impacting the finance and insurance industry.
    • In August, threats against the finance and insurance industry most often involved exploit public facing application as the initial access method.

Ransomware Analysis

  • QLIN was the most common ransomware variant observed by Kroll in August 2026.
  • Professional, scientific, and technical services and Healthcare and Social Assistance were was the top industries targeted by ransomware actors observed by Kroll in August 2026.
  • Ransomware actors primarily gained initial access through exploit public-facing applications.
  • Manufacturing was the top industry for victims posted to ransomware actor-controlled shaming sites and blogs.
  • North America was the top region for victims posted to ransomware actor-controlled shaming sites and blogs.

Stay Ahead with Kroll

24x7 Incident Response

Kroll is the largest global IR provider with experienced responders who can handle the entire security incident lifecycle.

Learn more

Cyber Incident Response Retainer

Preparing organizations for critical events and strengthening resilience before they happen.

Learn more

Computer Forensics

Kroll's computer forensics experts ensure that no digital evidence is overlooked and assist at any stage of an investigation or litigation, regardless of the number or location of data sources.

Learn more

Mobile Device Forensics

With a global mobile device forensics team and a proven track record in investigation and litigation support, Kroll enables key digital insights to be accessed quickly and securely.

Learn more