NCC Group Monthly Threat Pulse – Review of September

Ransomware attacks rose by 23% in Q3 as critical infrastructure risks attract attention 

Read the report 

Manchester, October -  Ransomware attacks increased by almost a quarter (23%) in Q3 2026 from Q2. The cyber attack on a UK small power generator in August was demonstrative of the rising threats, highlighting how UK critical infrastructure is a growing target.  

While ransomware levels climbed overall in Q3 from the previous quarter, attacks fell month-on-month by 26% from August, to 821 in September. The quarter also saw a modern trend of threat groups actively weaponising generative AI. Qilin and The Gentlemen were vying for top spot, although Qilin became the most active threat group with 365 attacks, while The Gentlemen was only 7 behind with 359.  

Critical infrastructure comes under fire 

Experiencing over 838 attacks in Q3 2026, industrials was the most targeted sector of all. The gap between industrials and the second most-targeted sector, consumer discretionary was significant at 526 attacks, reflecting the growing use of hybrid warfare by nation-states and malicious actors to wreak major disruption in critical infrastructure (CI).  

An example of this in Q3 was the cyber attack on a small UK power generation facility, which forced it to cease operations for around four days. While the UK government has made no formal confirmation, the attack details are consistent with Iranian-affiliated campaigns against CI, including targeting internet-exposed programmable logic controllers and establishing remote access to operational technology (OT).  

This incident highlights how the increased connectivity of information technology (IT) and OT has created security challenges, which is partly driven by legitimate operational requirements, such as third-party maintenance services centralised management. 

While the Industrials sector is a key component of a nation’s critical infrastructure, many sectors fall under the definition, including: transport, communications, financial services, and health among others. 

Matt Hull, VP of cyber intelligence and response at NCC Group, said, “Not only was this attack a reminder that smaller critical infrastructure operators can’t discount themselves as targets, it’s a direct example of threat actors crossing the boundaries between the digital and physical worlds.  

“We’ve already seen the direct impact of this capability continue into Q4 in the retail sector. There are clear actions around the separation of IT and OT for all critical infrastructure organisations to take – maintaining visibility over privileged accounts, using network segmentation to control access and securely configure remote access.” 

Generative and agentic AI: weaponisation and risks 

Q3 saw the exposure of BraZetsu, a highly sophisticated AI-enhanced Windows malicious framework, which raised concerns around the weaponisation of generative AI to optimise backend systems.  

Having rapidly transitioned into a highly aggressive, specialised Initial Access Toolkit tailored for corporate exploitation, the operators behind BraZetsu use its models to automate victim profiling, handle data triage and prioritse targets based on perceived commercial value.  

Agentic AI risks also made headlines this quarter, marking how legitimate AI agents have become attack vectors through misalignment, prompt injection and excessive permissions. Affected organisations include US government systems and Australian health institutions, demonstrating the importance of monitoring AI agents’ interactions, especially in critical infrastructure and services storing public data.  

Hull added, “We’re witnessing in real time an unintended use case of AI agents, as a pattern emerges of repeated failures rather than isolated incidents. While AI-enabled attacks could be considered a natural consequence of the sophistication of its capabilities, the threat landscape has also been expanded by organisations being compromised by accidental or manipulated agentic actions.”