The Q3 Threat Intelligence report issued by Rapid7 has revealed an unprecedented acceleration in the pace of vulnerability exploitation; attackers are now launching attacks on high-severity vulnerabilities within an average of three days from the date of their disclosure, while 71% of them were exploited within just the first week of public disclosure.
Critical Vulnerability Race and Ransomware Dominance
Data indicated that approximately 79% of these vulnerabilities fall under the category of highly critical vulnerabilities, or what is known in security circles as the "Holy Grail," because they allow for remote execution without the need for prior credentials or requiring local user interaction. This acceleration places cyber protection and defense teams under severe time pressure to apply updates and patch vulnerabilities before they turn into large-scale breaches.
At the same time, ransomware continued its position as the most aggressive and globally impactful threat; business services, manufacturing, and healthcare sectors topped the list of targets most susceptible to attacks. The United States led the list of targeted countries with 60% of recorded attacks, followed by Germany at 7%, and Italy and Canada at 5% each. Attacks directed at the government sector saw a notable increase of 15% compared to the previous quarter.
Top Ransomware Gangs and Target Distribution
Regarding actors in the cybercrime arena, two main groups topped the list of successful attacks; the "The Gentlemen" gang claimed responsibility for 342 incidents, followed immediately by the "Qilin" gang with 339 incidents. The rest of the active list included groups such as "INC Ransom" with about 99 attacks, "DeadLock" with 98 attacks, and "Krybit" with 95 announced attacks.
The Actual Reality of AI in Cyber Operations
Contrary to the prevailing hype in technical circles about the total dominance of AI-backed attackers, the report's findings showed that AI tools appeared as an operational element in only 8% of the total incidents tracked. Analyses indicated that attacks are still managed by direct human decisions; the human element determines the target and execution mechanism in all recorded cases, while the role of AI is limited to automating the "middle tactical stage" of the attack chain, such as selecting appropriate techniques, sorting targets, and automatic recovery when a specific step fails.
Rapid7 pointed out the necessity of distinguishing between the pace of AI usage for vulnerability discovery and code auditing, which is genuinely accelerating, and its direct use in executing complex exploitation operations, which has not yet appeared as a large-scale phenomenon in field data. In this context, attackers resort to tricks such as command fragmentation and multi-session prompting to bypass protection mechanisms and detection systems built into service-providing AI models.
Advanced Threat Activity and Initial Access Market
The report monitored the activity of 15 different Advanced Persistent Threat (APT) groups and cyber-espionage gangs, which focused primarily on government institutions, in addition to the defense, transport, media, and energy sectors. This included groups linked to Russia such as "Sandworm" and "Void Blizzard," the Chinese group "APT31," and the "Lazarus" group affiliated with North Korea, which was documented using a previously unrecorded malware package dedicated to Linux environments targeting infrastructure in South Korea.
At the level of "dark web" platforms, the dominance of Initial Access Brokers continued, as advertisements showed the provision of breach paths ranging from full banking credentials to permanent footholds within corporate networks; more than 65% of monitored posts focused on selling access to Remote Desktop Protocol (RDP) or access to internal networks, which represents a vital early indicator that defenders must leverage to monitor future attack vectors.
What Does This Mean for Cyber Defense Teams?
This shift imposes an immediate reordering of defensive priorities within technical institutions, and the requirements for dealing with this landscape can be summarized as follows:
- Reducing vulnerability remediation time: The monthly patching model is no longer sufficient for internet-facing vulnerabilities; the new rate (3 days) requires automating the application of updates and immediate blocking procedures for exposed services.
- Monitoring AI API consumption: Tracking API requests originating from unfamiliar devices or processes within the network for early detection of any unauthorized use of smart tools.
- Hardening remote access points: Enhancing RDP port monitoring and implementing multi-factor authentication to deny initial access brokers the ability to exploit networks and sell them to ransomware gangs.