https://www.focusedhunts.com/blog/last-week-in-threats A weekly retrospective recap of ransomware activity, exploited CVEs, and malicious infrastructure, with attributed metrics. en-us Tue, 08 Sep 2026 11:20:02 GMT https://www.focusedhunts.com/img/logo/Focused-Hunts-Logo.png https://www.focusedhunts.com/blog/last-week-in-threats https://www.focusedhunts.com/blog/last-week-in-threats/2026-W36-Last-Week-in-Threats https://www.focusedhunts.com/blog/last-week-in-threats/2026-W36-Last-Week-in-Threats Mon, 07 Sep 2026 00:00:00 GMT Week 36 (Aug 31 - Sep 6, 2026): Ransomware volume dropped 20%, datacenter hosting dominated the most-reported malicious IPs, and CISA added three developer-tooling vulnerabilities to KEV. https://www.focusedhunts.com/blog/last-week-in-threats/2026-W35-Last-Week-in-Threats https://www.focusedhunts.com/blog/last-week-in-threats/2026-W35-Last-Week-in-Threats Mon, 31 Aug 2026 00:00:00 GMT Qilin ransomware surged 31% week-over-week while overall ransomware victim volume dropped 14.5%. CISA added 11 CVEs targeting developer tooling, infrastructure, and edge appliances. https://www.focusedhunts.com/blog/last-week-in-threats/2026-W34-Last-Week-in-Threats https://www.focusedhunts.com/blog/last-week-in-threats/2026-W34-Last-Week-in-Threats Mon, 24 Aug 2026 00:00:00 GMT Weekly retrospective recap of ransomware leak-site activity, most-reported malicious IPs, and newly exploited vulnerabilities for the week of August 17-23, 2026. Direwolf surged 40 percent, Zimbra and MLflow CVEs under active exploitation, manufacturing sector concentrated. https://www.focusedhunts.com/blog/last-week-in-threats/2026-W33-Last-Week-in-Threats https://www.focusedhunts.com/blog/last-week-in-threats/2026-W33-Last-Week-in-Threats Sun, 23 Aug 2026 00:00:00 GMT Week 33 threat recap: Clop and Qilin ransomware doubled leak-site postings, targeting healthcare and education. Three actively-exploited CVEs added to CISA KEV.