Threat landscape
What attackers are doing right now: ransomware claims and vulnerabilities exploited in the wild, with a focus on Belgium. Refreshed daily from open threat intelligence sources.
Last refreshed: 15 Nov 2026, 10:31 UTC
Ransomware activity
Victims claimed on ransomware leak sites, per week. Claims are made by the attackers themselves and are not verified.
Show the data table
| Week starting | Claims |
|---|---|
| 9 Nov 2026 | 318 |
| 2 Nov 2026 | 258 |
| 26 Oct 2026 | 258 |
| 19 Oct 2026 | 239 |
| 12 Oct 2026 | 322 |
| 5 Oct 2026 | 236 |
| 28 Sep 2026 | 249 |
| 21 Sep 2026 | 245 |
| 14 Sep 2026 | 208 |
| 7 Sep 2026 | 221 |
| 31 Aug 2026 | 180 |
| 24 Aug 2026 | 263 |
| 17 Aug 2026 | 286 |
| 10 Aug 2026 | 268 |
| 3 Aug 2026 | 320 |
| 27 Jul 2026 | 234 |
| 20 Jul 2026 | 207 |
| 13 Jul 2026 | 170 |
| 6 Jul 2026 | 187 |
| 29 Jun 2026 | 155 |
| 22 Jun 2026 | 149 |
| 15 Jun 2026 | 287 |
| 8 Jun 2026 | 208 |
| 1 Jun 2026 | 127 |
| 25 May 2026 | 141 |
| 18 May 2026 | 189 |
Most active groups
Share of claims over the last 30 days.
Belgium
- 3 claims naming a
.bedomain, last 90 days (1 of them in the last 30 days) - Groups behind them: safepay, lockbit5
- Official Belgian advisories: CCB / CERT.be
A .be domain is a rough indicator: some Belgian victims use other domains, and claims are unverified.
Vulnerabilities exploited in the wild
The latest additions to the CISA Known Exploited Vulnerabilities catalog. If you run one of these products, patch it first.
| Added | CVE | Product | Vulnerability |
|---|---|---|---|
| 13 Nov 2026 | CVE-2026-123039 | Check Point Multiple Products | Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability |
| 13 Nov 2026 | CVE-2026-114713 | UnrealIRCd | UnrealIRCd Improper Neutralization of Delimiters Vulnerability |
| 10 Nov 2026 | CVE-2026-20320 | Cisco BroadWorks | Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability |
| 10 Nov 2026 | CVE-2026-125350 | Google Chromium | Google Chromium Use-After-Free Vulnerability |
| 10 Nov 2026 | CVE-2026-124194 | Microsoft Office | Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability |
| 10 Nov 2026 | CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (ESG) | Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability |
| 10 Nov 2026 | CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder | Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability |
| 10 Nov 2026 | CVE-2026-111560 | Barracuda Networks Multiple Products | Barracuda Networks Multiple Products OS Command Injection Vulnerability |
Most targeted vendors
Vendors with the most vulnerabilities added to the catalog over the last 90 days.
Want to know what attackers can see of your company? Request a free external exposure check →
How to read this page
- Ransomware figures count the victims that groups claim on their leak sites to put pressure on them. Some claims are exaggerated, recycled or false, and victims who pay quietly often never appear.
- No victim names are shown here: the claims are unverified, and the organisations behind them are victims.
- A rising curve is a signal worth watching, not a forecast. What matters for you is whether your exposed systems match what attackers are exploiting right now.
Sources
- RansomLook: ransomware leak-site monitoring, data under CC BY 4.0.
- CISA Known Exploited Vulnerabilities catalog: vulnerabilities confirmed as exploited in the wild.