Why the October 2026 cluster of supplier incidents was a signal rather than a coincidence, how AI is changing the speed of supply chain attacks, and what organisations should do in the next 12 months.
An organisation can do everything right internally and still be breached, or brought to a halt, through a supplier. In 2026, that risk grew, concentrated in developer and AI tooling, and began to move at machine speed. The attacks themselves were not new. What changed was the clock: AI made flaws cheaper to find than to fix, made some intrusions faster and cheaper to run, and turned AI tooling into a supplier layer worth stealing from.
Black October, the cluster of supplier incidents disclosed in the third week of October 2026, is best read as a preview of that tempo. This report explains what the cluster was, how supplier risk reaches organisations, what AI is and is not changing, and what to do in the next 30 days, 90 days and 12 months. The name “Black October” reportedly came from a social media post, not from a CERT or intelligence body. The findings apply across sectors: the report is not specific to any one industry.
CYFIRMA data behind this report
42 incidents analysed (November 2025 to October 2026), 34 of them reaching victims through a supplier. Source: CYFIRMA supply chain incident analysis.
8,452 ransomware leak-site victims from 1 January to 28 October 2026, up 45% on the same period of 2025 and 110% on 2024. Source: CYFIRMA DeCYFIR Ransomware monitoring.
New ransomware groups per quarter: 11 to 18 from mid-2024 to early 2026, then 27 in Q2 2026 and 35 in Q3 2026. Source: CYFIRMA DeCYFIR Ransomware monitoring.
32,368 underground forum listings on 28 forums from 1 January to 29 October 2026, 45% of them offering stolen data. Source: CYFIRMA DeCYFIR Underground & Dark Web monitoring.
1. Black October was a disclosure wave, not a campaign, and it will repeat.
At least six unrelated actor sets, plus a certificate authority failure with no attacker behind it, were behind the incidents disclosed in October 2026, and about a third of the October disclosures with a known start date had begun before October. The structural drivers behind the cluster persist, so clusters of similar size are likely within 12 months.
Very likely, high confidence, that it was not coordinated. Likely, moderate confidence, that similar clusters recur.
2. Supplier compromise is one of the leading breach paths, and it is growing.
Verizon’s 2026 Data Breach Investigations Report (DBIR) puts third-party involvement at 48% of breaches, up from 30% a year earlier. IBM ranks supply chain compromise as the second most common entry point, and the largest of 30 cost amplifiers. Part of the DBIR rise reflects a wider definition, but perception data move in the same direction.
Almost certain, high confidence, that it is a leading path. Likely, moderate confidence, that it is growing; the rate is uncertain.
3. Most supplier incidents trace to basic failures, usually at the supplier.
Of the 21 supplier-path incidents in our analysis with a known cause, 14 were basic control gaps. The other 7 were zero-days, newly disclosed product flaws, or non-malicious failures, which customer basics would not reliably have prevented. The failure sat with the supplier in 28 of 34 cases, so organisations need both supplier assurance and the ability to absorb what they cannot prevent.
Likely, moderate confidence.
4. AI’s biggest effect today is on suppliers: flaws are being found faster than they can be fixed.
Microsoft’s monthly security fixes rose from about 590 in July to about 1,410 in October, a rise Microsoft credits to LLM-assisted discovery. Open-source maintainers report triage overload, and coordinated disclosure is under strain: an exploitation attempt against the critical PHP runtime flaws known as PHP2Shell was recorded four days before disclosure.
Very likely, high confidence.
5. Attacker use of AI is real but evolutionary, and AI tooling is now a target in its own right.
Police-investigated intrusions in South Korea and Microsoft’s reporting on a campaign against MSP-connected cloud tenants show AI agents compressing intrusions to hours, using old techniques. AI tools or AI provider keys were the target in 8 of the 34 supplier-path incidents we analysed; gateways and developer platforms hold keys for many model providers in one place.
Likely, moderate confidence, that attacker AI use remains evolutionary. Very likely, moderate confidence, that AI tooling is a priority target.
6. The criminal economy is scaling through new entrants, and stolen data does not expire.
CYFIRMA DeCYFIR Ransomware monitoring shows leak-site victims up 45% in 2025 and 110% in 2024 for the same ten months, driven by new groups that reach scale faster and further than earlier cohorts. CYFIRMA DeCYFIR Underground & Dark Web monitoring shows 45% of 2026 forum listings offering stolen data. AI is a plausible contributor to the ransomware surge, not a proven one.
Almost certain, high confidence, that ransomware activity escalated. Roughly even chance, low confidence, that AI is a material contributor.
Estimative terms follow the scale in Section 09. Confidence reflects the quality of the evidence, not the probability. The incident analysis is weighted towards October 2026 (34 of 42 incidents), and 13 of the 34 supplier-path incidents have no disclosed root cause, so shares are indicative, and counts are shown alongside them (Section 09).
Between 17 and 22 October 2026, a run of supplier incidents became public within days of each other: a certificate authority failure, critical PHP runtime flaws with a broken embargo, a compromised open-source LLM gateway, abuse of an MSP backup application by a Chinese state-aligned actor, secret thefts at several AI developer platforms, and several update-channel compromises. The label “Black October” reportedly came from a viral post by an AI-risk meme account on 22 October, not from a CERT or intelligence body, and spread through the media from there.
Three explanations were offered at the time: one coordinated campaign, possibly run by autonomous AI agents; a chance pile-up of unrelated events; or a step change in attacker capability. The evidence supports none of them on its own.
Was Black October one coordinated campaign?
The incidents involve at least six unrelated actor sets, plus a certificate authority failure with no attacker at all. No shared vulnerability or dependency links the nine affected AI platforms. And the timing misleads: of the October disclosures with a known start date, 9 of 26 began before October, some in 2025, with the longest running for 535 days before disclosure. Figure 1 shows the lag for all 32 incidents in the analysis with a recorded start date: 17 were disclosed within 7 days of first activity, 10 within 8 to 60 days, and 5 after more than 60 days. Where no earlier activity was reported, the start date equals detection, so short windows are overstated.
Figure 1. Time from first malicious activity or flaw to public disclosure, 32 incidents with a recorded start date. Source: CYFIRMA supply chain incident analysis.
Was it a chance pile-up?
The incidents share drivers: long-lived secrets and app identities, trusted delivery channels, dependence on a few large suppliers, and a growing backlog of unpatched flaws. AI tools or AI provider keys were the target in eight supplier-path incidents, by different or unknown actors, and the same open-source AI attack agent appeared in the hands of at least four unrelated groups within about two months.
Disclosure mechanics then pulled the incidents into one week. A leaked embargo forced early disclosure of PHP2Shell; Japan’s mandatory incident reporting for critical infrastructure operators took effect on 1 October, and once the label spread, analysts and journalists went looking for more.
Why is it still a signal?
The strongest counter-argument is that nothing new happened. Every October mechanism has precedent: SolarWinds (2020) for update channels, MOVEit (2023) for mass exploitation, the 2024 endpoint update failure for supplier outages, and the 2025 npm worms for self-spreading packages. That argument is right about mechanisms: no new attack class appeared. It misses three changes in rate and target:
It also does not account for exploitation attempts starting before disclosure, as they did with PHP2Shell.
Our assessment
It is very likely (high confidence) that Black October was a disclosure wave of independent incidents rather than a coordinated campaign. It is likely (moderate confidence) that it signals a sustained increase in the speed and frequency of supplier-path incidents, because the shared drivers persist.
The main uncertainty is attribution. Two-thirds of the supplier incidents we analysed (23 of 34) have no public attribution, so hidden links between some of them cannot be ruled out. Annex A shows how the competing explanations were tested.
The IT supply chain is everything an organisation runs but did not build: software and the pipelines that deliver it, the services that host it, the identities that connect it, the security products that guard it, and now the AI tools that write and operate it. Every layer produced at least one significant incident in the past 12 months.
| Layer | What it includes | 2026 example |
| Software and runtimes | Commercial software, open-source libraries, language runtimes | Critical flaws in the PHP runtime, used by about 69% of websites with a known server language according to W3Techs (PHP2Shell) |
| Build and delivery | CI/CD pipelines, package registries, update servers, release signing | A cloud provider’s command-line tool releases and checksums swapped for malware for about 94 minutes |
| Trust infrastructure | Certificate authorities, code signing, root stores | A certificate authority issued eight intermediate certificates with recoverable keys |
| Service providers | SaaS, MSPs, IT outsourcing, cloud and hosting, CDN, payment technology | Ransomware at a Japanese cloud provider disrupted 495 client organisations |
| Identity and integration | OAuth applications, API keys, service accounts, client certificates | An MSP backup application’s identities used to reach more than 2,250 customer cloud tenants |
| Security products | Firewalls, WAFs, security appliances, scanners | A crypto exchange breached through a zero-day in two security appliances it had bought |
| AI layer (new) | Model provider APIs, LLM gateways, AI developer platforms, coding agents, agent frameworks, MCP servers | An open-source LLM gateway published with a credential stealer, downloaded about 49,000 times |
| Physical and OT | Hardware and resellers, OT vendor products, maintenance contractors | An authorised reseller sold hardware wallets with hidden implants; $86M to $102M drained |
Three shifts stand out. The AI layer is now a supplier layer: gateways and developer platforms hold API keys for many model providers in one place. Security products are suppliers too, and were the supplier in 4 of the 34 supplier-path incidents we analysed. And physical and OT channels are back: implanted hardware sold through an authorised channel and refrigeration controllers left reachable online through remote-servicing links both caused real losses in October.
By supplier group, developer and AI tooling produced the most incidents (11 of 34), ahead of service providers (10), software vendor products and update channels (5), security products (4), physical and OT (2) and certificate authorities (1) (Figure 2).
Figure 2. Supplier-path incidents analysed by CYFIRMA, November 2025 to October 2026, by supplier group (33 of 34 shown; one with an unknown supplier is excluded). Developer and AI tooling ecosystem = open-source packages, CI/CD, AI platforms and AI gateways.
What are the four pathways of supplier risk?
Supplier risk arrives through four pathways. The first two can usually be prevented with basic controls, mostly by the supplier. The third can be prevented by the customer when the flaw is known; a zero-day can only be contained. The fourth can mostly only be contained and recovered from.
| Pathway | How it works | Who can prevent it | 2026 examples |
| 1. Supplier pushes something malicious | Attacker compromises the supplier’s release, update, or sales channel; customers install the result themselves | Mostly the supplier | Self-spreading package worms; backdoored update channels; a swapped CLI release; implanted hardware |
| 2. Supplier access is abused | Attacker steals or misuses access the customer granted: OAuth apps, MSP tools, API keys, client certificates | Supplier and customer | MSP application identities; stale payment-provider certificates; stolen plugin connection keys |
| 3. Supplier product flaw exploited at the customer | A flaw in a supplier’s product is exploited where the customer runs it; the vendor itself is not breached | No one if zero-day; the customer if the flaw is known, unpatched or exposed | Security appliance zero-day; PHP runtime flaws; exposed firewall and OT management interfaces |
| 4. Supplier fails or goes down | Provider outage, ransomware at the provider, or a process error stops the customer’s operations | Inherited; only recovery and redundancy help | A global CDN outage; ransomware at a cloud provider; a certificate authority failure |
Which supplier incidents could have been prevented?
Of the 21 supplier-path incidents with a known root cause, 14 (67%) came down to basic control gaps such as stale credentials, unrotated secrets, disabled release protections, or exposed management interfaces. Five (24%) were zero-days or newly disclosed product flaws, and two (10%) were non-malicious failures (Figure 3). The failure sat with the supplier in 28 of 34 incidents, with both supplier and customer in 5, and with the customer alone in 1.
So two popular claims are both true, for different incidents. Basic measures work, but mostly when suppliers apply them, which makes the customer’s main lever indirect: demand and check the supplier’s basics, and limit what supplier access can reach. The remaining third is largely inherited risk that customers can contain and recover from but rarely prevent.
Stolen or leaked credentials, keys and app identities were the most common entry vector, in 10 of the 27 incidents with a known vector, followed by compromised release or update channels, including package worms (6), exploited product flaws (5), exposed management interfaces and non-malicious process failures (2 each), a hardware implant (1) and AI-agent automated exploitation (1). This differs from the wider breach picture: Verizon’s 2026 DBIR finds that vulnerability exploitation, at 31%, has overtaken credential abuse as the leading initial access vector across all breaches. Supplier compromise skews towards trust that was granted rather than flaws that were found.
Figure 3. Entry vector (27 incidents with a known vector) and root cause (21 incidents with a known cause) of supplier-path incidents. Source: CYFIRMA supply chain incident analysis.
PATHWAY 1 An AI gateway compromised twice in one year
In March, an open-source LLM gateway was poisoned through a compromised security scanner in its build pipeline. In October, developer tokens, likely leaked from the logs of an exposed internal deployment, let an attacker publish a malicious release that carried valid build provenance.
Lesson: provenance proves where something was built, not that the source was trustworthy, and AI gateways concentrate keys for many providers.
PATHWAY 1 Implanted hardware through an authorised reseller
A reseller that had changed owners sold hardware wallets with hidden LTE implants that captured recovery phrases at setup. The device’s secure element was untouched, so integrity checks passed.
Lesson: Authorised channels need re-vetting when ownership changes.
PATHWAY 2 A consented MSP application turned against its customers
A China-aligned actor, Storm-0940, abused the identities of an MSP backup application that customers had already consented to, reaching privileged access in under three hours in some tenants. One application granted itself global admin rights (Microsoft).
Lesson: Consented third-party applications are standing access paths and need the same monitoring as admin accounts.
PATHWAY 2 Offboarded, but still trusted
In Brazil, a bank had left its payment technology provider months earlier, but its old client certificates were still valid and were used in an attack. It was the third successful attack on a payment technology provider in about eight months.
Lesson: Offboarding a supplier means revoking every credential it held.
PATHWAY 3 Security products as the way in
Attackers used a zero-day in one third-party security appliance at a crypto exchange, gained access to a second, moved into the wallet environment, and forged withdrawals worth $387.5M. Neither product has been named publicly, so other customers cannot check their exposure.
Lesson: Security products are Tier 1 suppliers, and silence about affected products extends everyone else’s risk.
PATHWAY 3 The remote-maintenance path as the way in
Internet-exposed refrigeration controllers, mostly from one OT vendor, running old software and in some cases reachable through remote-servicing links such as 3G cards, were forced into continuous defrost at about 50°C. The French government counted about 700 affected supermarkets; French media reported 300 to 400. Fixes had been available since August 2025.
Lesson: The weak link is often the remote-maintenance path and the people who manage it, not only the product.
PATHWAY 4 Trust infrastructure fails too
No attacker was involved. A script error in an April 2025 key ceremony left eight intermediate certificate keys recoverable, and the flaw was found 18 months later. Browsers blocked the certificates within hours; libraries, language runtimes and container images took longer.
Lesson: Certificate Transparency enforcement protected only the clients that enforce it, and replacing about 30,000 certificates takes an inventory most organisations do not have.
Every major dataset ranks supplier compromise near the top of breach causes. The published figures measure different things, though (breaches, costs, affected individuals, executive perception), so they cannot be compared directly. Read together, they show a risk that is large and growing, though probably more slowly than headline numbers suggest.
| Measure | Value | Source | Note |
| Breaches involving a third party | 15% (2024), 30% (2025), 48% (2026) | Verizon DBIR, 2024 to 2026 editions | Definition widened in 2025 and 2026; part of the rise is definitional |
| Supply chain compromise as entry point and cost driver | Second most common entry point after phishing; largest of 30 cost amplifiers (+$227,250 per breach); 258 days to identify and contain, against 247 on average | IBM Cost of a Data Breach 2026 (vendor survey of breached organisations); figures via Reflectiz summary (vendor) | Averages, not medians |
| Individuals affected via a third party | 69% | Kroll Data Breach Outlook 2026 (vendor research) | Counts people, not incidents |
| Large firms naming supply chain their top cyber challenge | 54% (2025), 65% (2026) | World Economic Forum, Global Cybersecurity Outlook 2026 | Perception survey, 804 respondents in 92 countries |
| Firms that map their supply chain | 33% | World Economic Forum, 2026 | The control gap |
| Average time from disclosure to exploitation | 3 days; 71% within 7 days | Rapid7 Q3 2026 Threat Update (vendor research) | High-severity flaws only |
One cross-check suggests growth beyond definitions: perception moved in the same direction as incident data, with the WEF figure up 11 points in a year (Figure 4). Separately, losses from single cyber events with IT dependencies have reached national scale: the UK’s Cyber Monitoring Centre modelled one 2025 manufacturing shutdown at £1.9bn, although a supplier path was not confirmed in that case.
Figure 4. Supplier risk indicators in successive editions of two sources. Sources: Verizon DBIR; World Economic Forum, Global Cybersecurity Outlook 2026.
Supplier incidents are also hard to measure from the outside. Of the 34 supplier-path incidents we analysed, 23 have no public attribution, and only two disclosed a direct loss figure, together up to $490M. Most supplier incidents are never tied to an actor or a cost in public, which limits any claim about who is behind the trend.
How does the picture differ by region?
The mechanism is global, but the choke points differ by region. In Europe, OT vendor products reachable through remote-servicing links and shared government web platforms dominated, and PHP2Shell prompted precautionary site shutdowns in at least seven EU states. North American incidents centred on SaaS and MSP integrations and open-source AI infrastructure. In Brazil, a payment technology provider serving more than 200 financial institutions was the third such provider successfully attacked in about eight months. In India, a certificate authority failure reached global trust stores. In Southeast Asia, an authorised hardware reseller served three national markets. In East Asia, AI-agent intrusions hit South Korean financial firms, and ransomware and other intrusions hit Japanese cloud and hosting providers. Public reporting from the Middle East and Africa was too thin to characterise.
AI changes the supplier problem in three ways. It floods suppliers with newly found flaws, it makes some attacks faster and cheaper, and it has created a new class of supplier that holds high-value keys. The first is the best evidenced, the second is proven but narrow, and the third is already a primary target.
Evidence strength in the tables below: corroborated means independently confirmed or officially stated; single source means one credible primary source, often the vendor or AI lab itself; claimed means secondary or self-reported only.
1. Discovery: flaws found faster than suppliers can fix them
Microsoft’s monthly security fixes rose from about 130 in May 2026 to about 200 in June, 590 in July, 410 in August, 970 in September and 1,410 in October, and Microsoft credits LLM-assisted discovery for the rise (Figure 5). These counts are approximate: outlets report different totals for the same month depending on what they include, so for each month we use the average of the reported totals, rounded to the nearest 10. Volume is not exploitation: only 26 Microsoft CVEs entered CISA’s Known Exploited Vulnerabilities catalogue in 2026 up to October. It is, however, a direct measure of the patching load every customer inherits.
Figure 5. Microsoft monthly security fixes, May to October 2026, approximate: each month is the average of the totals reported by outlets including BleepingComputer, Krebs on Security and The Record, rounded to the nearest 10. Microsoft credits LLM-assisted discovery (Windows Experience Blog, 9 July 2026).
| Evidence | Strength | Source |
| PHP2Shell found independently by two teams using frontier models; a third attack vector reported later by an AI lab | Corroborated | Wiz; Calif; OpenAI; PHP Foundation postmortem |
| Partners in one restricted AI research programme found 10,000+ high or critical flaws in about a month; Mozilla separately reported 271 Firefox fixes from an early version of the programme’s model | Single source (few of the flaws can yet be traced to public CVEs) | Anthropic Project Glasswing; Help Net Security |
| Open-source maintainers cannot keep up: curl now publishes low and medium reports openly; a database release was delayed; the PHP Foundation called the fix delay "a structural failure" | Single source | The Register; PHP Foundation via Socket |
| UK NCSC has warned since May 2026 of an AI-driven "patch wave" | Corroborated (official) | NCSC-UK |
PHP2Shell: the risk window now opens before disclosure
Two AI-assisted research teams independently found critical flaws in the PHP runtime and reported them in August. The fix took more than two months, the embargo broke hours early, and Amazon’s honeypots recorded an exploitation attempt on 17 October, four days before disclosure. Governments in at least ten countries took sites offline as a precaution. No government has confirmed a production breach; the confirmed exploitation, reported by a security vendor, was a China-linked actor rooting firewall management interfaces in the US and East Asia using PHP2Shell together with a second flaw. Separately, CYFIRMA’s own advisory on a campaign it attributes, with high confidence, to North Korean state-nexus operators obtained the operators’ target list (216 internet-facing servers in 10 countries) and found that they used a local AI model to rank public exploit code.
When two teams can find the same flaw with the same tools, an embargo protects less, and the response depends on knowing where the component runs.
The bottleneck has moved from finding flaws to triaging, fixing, and deploying the fixes. Every customer inherits that bottleneck from every supplier.
2. Offence: faster and cheaper intrusions, no new attack types yet
| Evidence | Strength | Source |
| At least seven South Korean financial institutions breached by an actor (TAG-217) using an open-source AI pentest agent (ARTEX) and commercial AI models; police investigation | Corroborated (two vendors; not confirmed by authorities) | CrowdStrike; Zscaler; Digital Times |
| A domestic Korean gang used the same agent against 90+ organisations, taking 8.2M records | Single source | Police via BleepingComputer |
| Storm-0940 used ARTEX against MSP-connected cloud tenants: password spraying peaked at 2,900 attempts a minute; privileged access in under three hours | Single source (vendor) | Microsoft; Zscaler separately published prompt history from an ARTEX campaign |
| An operator used an open-source agent platform to breach over 100 companies’ websites at about $50 per success (NorForge researcher’s estimate to Reuters; NorForge’s report gives about $5 per task and a success rate around 10%) | Single source (vendor) | NorForge; Reuters |
| An AI coding agent ran 80 to 90% of tactical operations in an espionage campaign that the AI lab attributes, with high confidence, to a Chinese state-sponsored group (about 30 targets, a handful of confirmed intrusions, September 2025) | Single source (self-reported by the AI lab) | Anthropic |
| Japan’s national CERT confirmed that attackers used AI to scan for known vulnerabilities and attack APIs in a domestic breach wave, which also hit services for users outside Japan; no autonomous intrusion shown | Corroborated (official) | JPCERT/CC |
| AI was cited as an operational component in 8% of the threat reporting Rapid7 tracked in Q3 2026 | Single source (vendor) | Rapid7 |
The proven gains are speed (hours, not days) and cost (dollars per breach). The techniques, such as credential spraying, known-flaw exploitation, and OAuth abuse, are old. The same open-source agent moved across at least four unrelated actor sets within about two months (the three above and North Korean actors reported by Microsoft in late October), which points to tool diffusion rather than coordination. The low 8% share may understate use: AI leaves few traces unless prompt histories or agent configurations are exposed, as they were in the campaign whose prompt history Zscaler published.
3. AI tooling as a supplier, and a target
AI gateways and developer platforms sit between an organisation and many model providers, and they store the keys for all of them. AI tools or AI provider keys were the target in 8 of the 34 supplier-path incidents we analysed (the nine October platform breaches count as four; see Section 09). Stolen keys are resold or used for model distillation and “LLMjacking”. Wiz traced two Amazon Bedrock keys stolen in platform breaches: one made about 800,000 calls over more than 30 hours, the other about 1.7 million calls in 13 hours, together likely running up more than $100,000 in usage. Both keys were tested within 30 minutes of the reported credential access (Wiz, vendor research).
| Pattern | 2026 example | Strength |
| LLM gateways concentrate keys for many model providers | An open-source LLM gateway compromised twice in 2026 | Corroborated |
| AI developer platforms hold customers’ secrets | Nine platforms breached in October, with no shared vulnerability or dependency | Single source (vendor compilation of platform disclosures) |
| Package worms now steal AI tool configuration and target AI agent packages | Two self-spreading npm worm waves | Corroborated |
| Exposed agent control panels hijacked to steal model API and SSH keys | One campaign against internet-facing agent panels | Single source |
| A trusted AI coding extension shipped with a destructive prompt | 2025 reference case | Corroborated |
Demand is visible underground. CYFIRMA DeCYFIR Underground & Dark Web monitoring found leaked keys for commercial models offered for about $10, alongside leaked “private AI gateway” access and account checkers for an AI model router (30 listings, 12 unique, on 5 forums).
Does AI favour attackers or defenders?
In the short term, AI favours attackers. Discovery is now cheap for both sides, but fixes still move at human speed through suppliers, and exploitation of high-severity flaws follows disclosure in about three days on average. Defensive gains are real, including independent rediscovery and faster triage tools, but they reach customers only through suppliers’ patch pipelines, which are the bottleneck.
Supplier compromise feeds a criminal economy that sells two products: extortion and stolen data. CYFIRMA’s monitoring of both shows the same pattern of growth through new entrants and recycled data, with AI a plausible accelerant but not yet a proven driver.
Ransomware: more groups, not bigger groups
CYFIRMA DeCYFIR Ransomware monitoring recorded 8,452 verified leak-site victims between 1 January and 28 October 2026, up 45% on the same period of 2025 and 110% on 2024 (5,837 and 4,032 victims; Figure 6). Over the same two years, the number of active groups rose 82% and the number of victim countries 26% (from 85 to 155 groups and from 112 to 141 countries). Between 1 July and 28 October, postings averaged 14.3 victims a day in 2024, 18.5 in 2025 and 33.3 in 2026.
Figure 6. Ransomware escalation, 1 January to 28 October of each year; percentage changes compare 2026 with 2024. Source: CYFIRMA DeCYFIR Ransomware monitoring.
From January 2024 to June 2026, postings grew steadily by about 0.5 victims a day each month. August 2026 (37.7 a day) and October 2026 (38.4 a day) sit about 2.7 standard deviations above that trend. August includes 89 victims of one mass-exploitation campaign (Cl0p), and October was driven largely by one new group. The growth comes from new groups (Figure 7):
Figure 7. New ransomware groups per quarter and the share of victims posted by groups under six months old. Source: CYFIRMA DeCYFIR Ransomware monitoring.
Is AI behind the rise in ransomware?
If AI mainly helps attackers behind the scenes, in reconnaissance, exploitation, localisation, and negotiation, the leak-site data should show the patterns below.
| If AI helps attackers, expect | What CYFIRMA monitoring shows | Consistent? |
| Lower skill barrier: more new groups reach scale quickly | Groups reaching 30+ victims within 60 days of first posting: 4 (2024 cohort), 10 (2025), 15 (2026). One September 2026 entrant posted 158 victims in 37 countries within 40 days, the fastest ramp in our data | Yes |
| Lower language and reconnaissance barriers: wider geographic reach | USA share fell from 52% to 39% (Q1 2024 to Q3 2026); victims outside 2024’s top-10 countries rose from 21% to 35%; a record 116 victim countries in Q3 2026 (Figure 8) | Yes |
| More automated campaigns: burstier posting | Group-days with 10+ posts rose from about 12 a quarter (2024) to 20 (2025) and 47 (Q3 2026); days with 50+ victims overall: 13 in Q3 2026, against 1 to 5 a quarter before | Yes, but not specific to AI |
| More output per operator | Not visible at group level; output per affiliate cannot be measured from leak sites | No |
| Timing aligned with the spread of AI tools | The step-up starts in Q2 and Q3 2026, overlapping the AI-driven patch wave (from May) and the first police-investigated AI-agent intrusion campaigns (preparation from late August, attacks from September) | Yes (correlation only) |
Figure 8. Share of each quarter’s verified ransomware victims located in the USA and outside the ten most-hit countries of 2024. Source: CYFIRMA DeCYFIR Ransomware monitoring.
Other explanations fit the same data:
It is almost certain (high confidence) that ransomware leak-site activity escalated sharply in 2026. There is a roughly even chance (low confidence) that AI-assisted tooling is a material contributor. Four indicators point the same way, and the timing overlaps the spread of agentic attack tools, but no ransomware operation in this data is tied directly to an AI tool, and the alternative explanations remain open.
How is stolen data sold and reused?
Much of the underground economy never breaches anything. It aggregates, repackages, and resells data stolen elsewhere. Of 32,368 listings captured by CYFIRMA DeCYFIR Underground & Dark Web monitoring on 28 forums between 1 January and 29 October 2026, 45% offered stolen data: stealer-log drops, databases and breach dumps, combolists, and identity documents (Figure 9). The largest single themes were stealer-log drops (20.3%), databases and breach dumps (11.6%), combolists (9.0%), identity documents and fullz (8.5%), and corporate access (8.1%).
This matters for supplier risk because supplier breaches export customer and staff data into this market. There, it accumulates and is reused to select and profile the people who hold supplier access, such as maintainers, DevOps engineers, helpdesk and MSP staff, feeding the next compromise. A customer’s exposure continues after the supplier incident is closed.
Figure 9. Underground forum listings by theme, 1 January to 29 October 2026 (n = 32,368; themes overlap). Source: CYFIRMA DeCYFIR Underground & Dark Web monitoring.
Profiling is a commodity. Lookup, background-check and people-search services appeared in 468 listings on 19 forums, selling Social Security numbers, dates of birth, driving licences and credit reports; one stealer-log search engine advertises 21 billion records with free daily lookups. Lead lists segmented by wealth or role appeared in 452 listings on 20 forums, including executive “full doxx” packages. Identity documents and full identity profiles (“fullz”) appeared in 2,749 listings.
Old data does not expire. Of 2026 listings that state the year of the data (stealer-log drops excluded, n = 2,530), 33% offer data at least one year old, 15% at least two years old, and 6% at least five. A 2024 people-search breach of 120 million records was still on sale in 2026. Passwords and tokens lose value as they are rotated. Dates of birth, addresses, identity documents, and employment details do not, and these are what profiling needs.
AI appears at the margins. Beyond the AI keys noted in Section 05, listings offered deepfake document and KYC-bypass services (87 listings, 32 unique, 12 forums), AI agents and tools applied to fraud, including a “carding with AI agents” proof of concept posted in October 2026 (30 listings, 15 unique), and jailbreaks for mainstream models (5 listings). We did not observe offers of AI-driven victim selection, profiling, or AI-generated lures.
It is very likely (moderate confidence) that stolen data is the largest category on offer in this market, and that profiling-ready identity data is widely available. It is unlikely (low confidence) that AI-driven victim profiling is yet sold as a service, although buyers can apply AI after purchase and sellers have no reason to advertise it. Listing volumes dipped in May and June 2026, when law-enforcement action disrupted several forums, so these figures describe what is on offer rather than a volume trend.
The most likely path is sustained acceleration: more flaws, faster exploitation and recurring disclosure clusters through supplier layers. A cascade shock, in which one supplier compromise stops many sectors across several countries for days, is less likely in any given year but would dominate the impact if it happened.
Scenarios S1 and S2 are mutually exclusive baselines. S3 is a high-impact event that can occur under either.
| Scenario | What it looks like | Likelihood (12 months) | Signposts that it is unfolding |
| S1. Sustained acceleration | AI-driven discovery keeps vendor patch volumes high; time to exploit stays at about 3 days or falls; disclosure clusters of October’s size recur every few months; AI-key theft becomes routine criminal business | Likely (55 to 70%) | Monthly vendor fixes stay above 1,000; more embargo failures; underground markets list AI keys and gateway access at scale; government advisories begin naming AI use |
| S2. Plateau and adjustment | October was partly a one-off backlog clearance; patch volumes fall back; suppliers adopt AI triage; coordinated disclosure adapts with shorter embargoes | Unlikely (30 to 45%) | Vendor fix counts fall below 500 a month; open-source projects report triage under control; no repeat of pre-disclosure exploitation in the next major multi-party disclosure |
| S3. Cascade shock (can occur under S1 or S2) | A widely used supplier (MSP platform, identity provider, cloud region, security product, or AI gateway) is compromised or fails, stopping operations across several sectors and countries for days | Very unlikely to unlikely (15 to 25%) | Access broker listings for MSP or identity platforms; a nation-state actor seen inside a major supplier; unpatched flaws in security products with mass internet exposure |
Figure 10. Assessed likelihood ranges for the three scenarios over the next 12 months. Source: CYFIRMA assessment.
What should we watch over the next 12 months?
| Indicator | What a rise would signal | Reading in November 2026 |
| Monthly security fixes from major vendors | Discovery outpacing fixing (S1) | About 1,410 at Microsoft in October, up from about 590 in July |
| Time from disclosure to exploitation | A shrinking response window | 3 days on average; exploitation attempts before disclosure in one major case |
| Embargo failures in multi-party disclosures | Coordinated disclosure breaking down | One major failure (PHP2Shell) |
| AI use named in government advisories | Official confirmation of AI-enabled attacks | Japan’s national CERT and Korean police so far |
| Underground listings for AI keys, LLM gateway or AI platform access | The AI layer maturing as a criminal market | 30 listings in 2026 (12 unique) on 5 forums |
| Ransomware groups reaching 30+ victims within 60 days of first posting | A lower barrier to scale, consistent with AI tooling | 15 in the 2026 cohort, up from 4 (2024) and 10 (2025) |
The measures that work are still mostly basic, but they now have to run at machine speed and extend to suppliers. Prevention addresses the preventable two-thirds of supplier incidents with a known cause; containment and recovery address the inherited third. Each control below is tied to a 2026 incident or reference case where its absence caused harm. Pathway numbers refer to the four pathways in Section 03.
Within 30 days
| Control | Pathway | Why: evidence |
| Inventory every consented third-party application, OAuth grant, API key, and service account; alert on new credentials added to existing apps | 2 | An MSP backup application granted itself global admin rights; one OAuth token theft in 2025 potentially affected 700+ organisations |
| Rotate secrets completely after any supplier incident, and give every token an expiry | 2 | A developer platform was breached a second time through admin credentials missed in rotation |
| Revoke every credential and certificate a former supplier held | 2 | Payment-provider certificates were abused months after a bank had left the provider |
| Take management interfaces of firewalls, appliances and OT controllers off the internet | 3 | Firewalls rooted through exposed interfaces; refrigeration controllers driven to 50°C |
| Know where shared components run (runtimes, libraries, certificates) so an emergency patch or shutdown takes days, not weeks | 3, 4 | PHP flaws targeted before disclosure; a certificate authority failure forced replacement of about 30,000 certificates |
Within 90 days
| Control | Pathway | Why: evidence |
| Pin dependencies, container images and CI actions by hash; ban floating tags such as "latest" | 1 | A malicious LLM gateway release reached users through "latest" tags; CI action tags were repointed in 2025 |
| Delay adoption of brand-new package versions by a few days, with registry malware scanning | 1 | Malicious package releases were typically detected within minutes to hours |
| Treat security products as Tier 1 suppliers: patch them first, isolate their management planes, monitor them | 3 | An exchange was breached through two security appliances; a Japan-market WAF was exploited |
| Keep AI provider keys in a secrets manager, scope and cap them, monitor usage, and keep them out of AI coding agents’ reach | 2 | Stolen AI keys were tested within 30 minutes of theft; stealers now read AI tool configuration files |
| Separate privileged developer and operations workstations from paths that can move money or sign releases | 2 | A record crypto exchange theft in October 2026 started from a DevOps laptop |
| Require suppliers to show the basics: MFA, credential rotation, signed and immutable releases, incident notification deadlines | 1, 2 | A release and checksum swap succeeded with release immutability switched off |
Within 12 months
| Control | Pathway | Why: evidence |
| Map critical suppliers, including their own critical suppliers, and tier them | All | Only 33% of organisations surveyed map their supply chain (WEF) |
| Build exit plans and tested manual fallbacks for critical SaaS, PaaS and hosting | 4 | Platforms shut down after breaches; one cloud provider’s ransomware incident disrupted 495 organisations |
| Keep immutable, offline backups and test restoration | 4 | Backups were deleted in an attack on a logistics supplier (2025) |
| Design out single-provider dependency for systems that must stay up | 4 | CDN and cloud outages; the 2024 endpoint update failure |
| Buy hardware through the manufacturer or re-vetted channels; re-check resellers after ownership changes | 1 | Implanted hardware wallets sold through an authorised reseller |
| Run joint incident exercises with critical suppliers | All | Only 27% of organisations surveyed run incident or recovery exercises with partners, including suppliers (WEF) |
This report combines published research and official reporting with three CYFIRMA data sources. Information cut-off: 2 November 2026.
Limits
The incident analysis is a sample of publicly reported incidents, not a census, and is weighted towards October 2026 (34 of 42 incidents) because collection focused on that period. One incident moves a share by about three percentage points, so counts are shown alongside shares. Coverage is strongest in English-language and vendor sources; the Middle East and Africa are underrepresented. Thirteen of the 34 supplier-path incidents have no disclosed root cause, so root-cause shares use the 21 known cases. Incidents are generally coded one per supplier compromise. The nine AI developer platform breaches disclosed in October are coded as four incidents: three platforms with their own detailed disclosures, and one aggregate row for the other six, so that a single wave does not inflate counts. Counted one per platform, supplier-path incidents would total 39, AI-targeted supplier-path incidents 13, and AI developer platforms would be the largest single supplier category.
Sources and naming
Where a figure comes from a vendor that sells a product addressing the risk it describes, or from an organisation describing its own incident, the text says so. Victims and compromised organisations are described generically. Vulnerabilities, threat actors, tools, open-source projects, government agencies and publishers are named.
Estimative language
| Term | Probability |
| Almost certainly | 95 to 99% |
| Very likely | 80 to 95% |
| Likely | 55 to 80% |
| Roughly even chance | 45 to 55% |
| Unlikely | 20 to 45% |
| Very unlikely | 5 to 20% |
Confidence reflects the evidence base, not the probability. High: several independent, reliable sources agree. Moderate: credible but limited or partly single-source evidence. Low: fragmentary, vendor-only, or inferred.
Key sources
We used Analysis of Competing Hypotheses (ACH) to test four explanations of the October 2026 cluster against 12 evidence items. ACH looks for evidence that is inconsistent with each hypothesis; the explanation with the fewest inconsistencies survives best.
C = consistent, I = inconsistent, N = neutral or not diagnostic.
| # | Evidence item | HA | HB | HC | HD |
| E1 | At least six unrelated actor sets, plus a certificate authority failure with no attacker | I | C | C | N |
| E2 | 9 of 26 October disclosures with a known start began before October (some in 2025) | I | C | C | I |
| E3 | PHP2Shell embargo leak and an exploitation attempt four days before disclosure | N | C | C | C |
| E4 | AI tools or AI provider keys targeted in 8 supplier-path incidents by different or unknown actors | C | I | C | C |
| E5 | A developer platform described a "series of attacks" on platforms holding AI inference keys | C | I | C | N |
| E6 | The same open-source AI agent used by at least four unrelated actor sets | I | I | C | C |
| E7 | Microsoft monthly fixes rose from about 590 to about 1,410 in three months, credited to LLMs | N | I | C | C |
| E8 | Proceeds of one exchange theft mixing with another; the FBI attributes the larger one to DPRK | C | I | C | N |
| E9 | The "Black October" label reportedly originated in a meme post and spread through media | N | C | C | N |
| E10 | No shared vulnerability or dependency across nine affected AI platforms | I | C | C | N |
| E11 | AI is cited as an operational component in only 8% of tracked threat reporting | N | N | C | I |
| E12 | Japan’s mandatory incident reporting for critical infrastructure began on 1 October | N | C | C | N |
| Inconsistent items | 4 | 5 | 0 | 2 |
E1, E2 and E10 argue most strongly against coordination (HA). E4, E6 and E7 argue against pure chance (HB). E2 and E11 argue against AI as the main cause (HD).
HC is consistent with every item partly because it is the broadest hypothesis, and a broad hypothesis is hard to contradict. Its standing rests on the evidence that weakens each narrower alternative, so it should be read as the explanation that remains, not as one proven directly. The judgment would change if a government attribution tied several October incidents to one operator or to shared infrastructure.
What was Black October?
A cluster of supplier incidents made public between 17 and 22 October 2026: a certificate authority failure, critical PHP runtime flaws (PHP2Shell) with a broken embargo, a compromised open-source LLM gateway, abuse of an MSP backup application by a China-aligned actor, secret thefts at AI developer platforms and several update-channel compromises. The name reportedly came from a social media post, not from a CERT or intelligence body.
Was Black October a coordinated attack?
Very likely not (high confidence). The incidents involve at least six unrelated actor sets plus a certificate authority failure with no attacker, 9 of the 26 October disclosures with a known start date began before October, and no shared flaw or dependency links the nine affected AI platforms. Because 23 of the 34 supplier-path incidents have no public attribution, hidden links cannot be ruled out.
Will it happen again?
Likely (moderate confidence), within 12 months. The drivers behind the cluster persist: long-lived secrets, trusted delivery channels, dependence on a few large suppliers, and a growing backlog of unpatched flaws.
How common are supplier breaches?
Verizon’s 2026 Data Breach Investigations Report puts third-party involvement at 48% of breaches, against 30% a year earlier; part of the rise reflects a wider definition. IBM ranks supply chain compromise as the second most common entry point, and the largest of 30 cost amplifiers, and the World Economic Forum reports that 65% of large firms name supply chain their top cyber challenge.
How does supplier risk reach an organisation?
Through four pathways: a supplier pushes something malicious; access granted to a supplier is abused; a flaw in a supplier’s product is exploited at the customer; or a supplier fails or goes down. The first two can usually be prevented, mostly by the supplier. The third can be prevented by the customer when the flaw is known. The fourth can mostly only be contained and recovered from.
Could these incidents have been prevented?
Mostly, and mostly by suppliers. Of the 21 supplier-path incidents with a known root cause, 14 (67%) came down to basic control gaps such as stale credentials, unrotated secrets, disabled release protections, or exposed management interfaces. The failure sat with the supplier in 28 of 34 cases.
What is AI changing?
Three things. Flaws are being found faster than suppliers can fix them: Microsoft’s monthly security fixes rose from about 590 in July to about 1,410 in October 2026. Some intrusions have become faster and cheaper, though they still use old techniques. And AI tooling has become a supplier worth stealing from: AI tools or AI provider keys were the target in 8 of the 34 supplier-path incidents.
Are attackers using AI agents?
Yes. South Korean police investigated a domestic gang that used the open-source ARTEX agent against more than 90 organisations, taking 8.2 million records, and Microsoft reported a China-aligned actor using ARTEX against MSP-connected cloud tenants, reaching privileged access in under three hours. The same agent reached at least four unrelated actor sets in about two months. No new attack types have appeared.
Why are AI gateways and developer platforms a target?
They store API keys for many model providers in one place. Two stolen cloud AI keys traced by Wiz likely ran up more than USD 100,000 in usage, and both were tested within 30 minutes of the reported credential access. Leaked keys for commercial models are offered underground for about USD 10.
Is ransomware growing, and is AI the cause?
CYFIRMA recorded 8,452 ransomware leak-site victims between 1 January and 28 October 2026, up 45% on the same period of 2025 and 110% on 2024. The growth comes from new groups: 27 appeared in Q2 2026 and 35 in Q3. There is a roughly even chance (low confidence) that AI-assisted tooling is a material contributor.
What happens to stolen data?
It is sold and reused. Of 32,368 underground forum listings in 2026, 45% offered stolen data, and 33% of the listings that state the year of the data offer data at least one year old. That data is used to select and profile the people who hold supplier access, which feeds the next compromise.
What is most likely over the next 12 months?
Sustained acceleration is likely (55 to 70%), with more flaws, faster exploitation, and recurring disclosure clusters. A plateau is unlikely (30 to 45%). A cascade shock, in which one supplier compromise or failure stops several sectors across countries for days, is assessed at 15 to 25% and can occur in either case.
What should organisations do first?
Within 30 days: inventory every consented third-party application, OAuth grant, API key and service account; rotate secrets completely after any supplier incident and give every token an expiry; revoke every credential a former supplier held; take management interfaces off the internet; and know where shared components run, so an emergency patch or shutdown takes days, not weeks.
How far can the numbers be relied on?
The incident analysis is a sample of publicly reported incidents, not a census, and is weighted towards October 2026 (34 of 42 incidents). 13 of the 34 supplier-path incidents have no disclosed root cause, so root-cause shares use the 21 known cases. Leak-site postings are not attack counts: victims who paid or were never posted are missing.
