Attacks against information-sector customers rose 48% in Q3 2026. Phishing, account abuse, and exploitation all contributed, creating pressure across multiple parts of the environment rather than one dominant entry point.
For organizations delivering digital services, publishing content, or keeping communications running, the challenge extends beyond spotting individual threats. Security teams need to understand how a compromised account or application could put customer data and service availability at risk.
Ransomware Attackers Are Diversifying
The number of information-sector organizations named on ransomware data-leak sites increased 61% from Q2 to Q3. Activity spread across more operators rather than becoming concentrated around a few groups.
“Qilin” and “The Gentlemen” remained recurring operators, while “Cyberleek” appeared only in the latest period and showed disproportionate information-sector activity. “DragonForce” and “ShinyHunters” dropped out after appearing in the prior period, showing a stable core of recurring ransomware and extortion groups surrounded by constant churn.
Defending against a shifting mix of ransomware operators means focusing on shared tradecraft, not one named actor. Prioritize phishing-resistant MFA for VPN and remote administration, patch edge devices quickly, use application control to block unapproved tools, and tune EDR detections to identify credential theft and mass file staging.
The Attack Mix Is Spreading Across Techniques
Average time to exploitation edged from nine to 11 days, but the number of CVEs observed being exploited rose from 62 to 109, and those exploited on the day of disclosure rose from 17 to 32. A longer average doesn’t give defenders much breathing room when a growing share of exploitation happens immediately.
Vulnerability exploitation was only part of the picture. The sector’s most observed techniques show why defense cannot stop at preventing initial access:
MITRE ATT&CK Technique | Percentage of Observed Techniques |
|---|---|
Web Shell | 13% |
Spearphishing Link | 7% |
Phishing | 5% |
Valid Accounts | 4% |
Accessibility Features | 4% |
Compared with the prior period, Exploit Public-Facing Application’s share fell from 11% to 4%, while Embedded Payloads declined from 7% to 2%. Web Shell now leads the sector’s observed techniques at 13%. Together, these shifts suggest attackers are putting more effort into persisting after exploitation than into the initial exploit itself. Accessibility Features, Compute Hijacking, and Domain Accounts also gained share, pointing to more varied post-compromise access and resource abuse.
Lower shares for individual techniques do not mean lower overall risk. Defenders can use these findings to pressure-test coverage beyond initial access, identifying gaps where attackers could persist or misuse resources unnoticed. Because web shells give attackers durable access to internet-facing servers, monitor web roots for new or modified files, hunt for web shells on internet-facing servers, and review web server processes for unexpected child processes or outbound connections.
How Agentic Defense Executes Across the Information Sector
GreyMatter’s Universal Translator normalizes telemetry from connected endpoint, identity, cloud, and network tools into a common schema. Information-sector teams can connect suspicious account activity with server and cloud events without manually translating evidence between consoles.
Detection at source runs detection logic at integrated technologies, while Transit applies multi-event detection to streaming data before it is indexed or stored. Security teams can identify related behaviors without making every detection dependent on centralized ingestion.
GreyMatter’s Agentic Teammates bring that evidence into a connected investigation, assembling context across tools rather than leaving analysts to reconstruct each incident manually. Automated Response Playbooks execute predefined actions—such as revoking compromised sessions or isolating affected endpoints—with approval requirements aligned to operational risk.
The sector’s containment results show meaningful progress. During Q3, information-sector customers reduced mean time to contain from 1 hour and 17 minutes to 21 minutes. Organizations using Automated Response Playbooks averaged five minutes.
Rising attack volume doesn’t have to dictate response speed. Connecting detection, investigation, and automated action helps remove the manual delays that give attackers more time to operate.
