Threat Research
Threat Stats
The most prevalent threats across the Netskope One platform. Last updated October 19, 2026 at 16:52 UTC.
Highlights
Rising
- PavinLoader#879 → #12+1840%
- LsassDump#1015 → #37+800%
- LibeRAT#1800 → #68+550%
Top Threats
Top 10 · trailing four weeksGlobal
Region
Industry
| # | Family | Movement | Change |
|---|---|---|---|
| 1 | ClickFix | — | -5.3% |
| 2 | Yogi | ▲ 3 | +24% |
| 3 | Nemucod | ▲ 7 | +42% |
| 4 | SpyVPN | ▲ 36 | +279% |
| 5 | Mefisto | ▲ 2 | +6.8% |
| 6 | Emotet | — | +3.7% |
| 7 | FakeCaptcha | ▲ 1 | 0.0% |
| 8 | NetSupportRAT | ▼ 4 | -29% |
| 9 | EtherHiding | ▲ 27 | +155% |
| 10 | Metasploit | ▲ 22 | +124% |
Ranked by reach over the trailing four weeks; change vs. the preceding four weeks. Named families only. Movement is the rank change between windows. Trend shows daily tenant reach over the trailing eight weeks.
By industry
| Family | Financial Services | Technology | Manufacturing | SLED | Retail | Healthcare | Telecom |
|---|---|---|---|---|---|---|---|
| ClickFix | 1 | 1 | 1 | 1 | 1 | 1 | 1 |
| Yogi | 6 | 7 | 2 | 5 | 9 | 6 | 6 |
| Nemucod | 2 | 12 | 3 | 16 | 7 | 8 | 16 |
| SpyVPN | 4 | 2 | 15 | 4 | 6 | 2 | 4 |
| Mefisto | 3 | 11 | 4 | 40 | 2 | 5 | 3 |
| Emotet | 5 | 10 | 8 | 27 | 3 | 11 | 2 |
| FakeCaptcha | 12 | 8 | 6 | 2 | 27 | 4 | 7 |
| NetSupportRAT | 13 | 13 | 18 | 3 | 4 | 7 | 5 |
| EtherHiding | 15 | 24 | 5 | 6 | 14 | 12 | 13 |
| Metasploit | 11 | 4 | 22 | 9 | 19 | 17 | 8 |
| Valyria | 8 | 28 | 11 | 45 | 5 | 20 | 135 |
| PavinLoader | 34 | 3 | 9 | 12 | 46 | 13 | 33 |
| XLoader | 10 | 9 | 19 | 29 | 23 | 14 | 24 |
| CVE-2017-0199 | 14 | 19 | 16 | 26 | 384 | 52 | 27 |
| Zusy | 9 | 17 | 12 | 21 | 24 | 39 | 140 |
| Multiverze | 7 | 22 | 29 | 111 | 37 | 18 | 21 |
| Babar | 41 | 30 | 7 | 24 | 52 | 50 | 12 |
| FakeAlert | 56 | 21 | 21 | 13 | 66 | 3 | 35 |
| StopCrypt | 28 | 18 | 54 | 28 | 8 | — | 14 |
| Balada | 57 | 42 | 23 | 7 | 20 | 9 | 9 |
Rank1–56–1011–2526–5051–100— = outside the top 100
By region
| Family | North America | Europe | Asia | Latin America | Middle East | Africa | Oceania |
|---|---|---|---|---|---|---|---|
| ClickFix | 1 | 1 | 1 | 1 | 1 | 1 | 2 |
| Yogi | 2 | 8 | 3 | 10 | 14 | 11 | 16 |
| Nemucod | 3 | 7 | 17 | 2 | 147 | 76 | 13 |
| SpyVPN | 9 | 3 | 4 | 7 | 81 | 3 | 9 |
| Mefisto | 7 | 2 | 5 | 4 | 9 | 2 | 7 |
| Emotet | 4 | 4 | 6 | 11 | 6 | 16 | 12 |
| FakeCaptcha | 6 | 5 | 10 | 15 | 7 | 5 | 3 |
| NetSupportRAT | 10 | 9 | 19 | 6 | 56 | 6 | 4 |
| EtherHiding | 8 | 11 | 14 | 13 | 11 | 17 | 8 |
| Metasploit | 26 | 10 | 11 | 5 | 1309 | 8 | 10 |
| Valyria | 12 | 6 | 18 | 18 | 3 | 4 | 38 |
| PavinLoader | 28 | — | 2 | — | 19 | 13 | 24 |
| XLoader | 63 | 34 | 32 | 3 | 62 | 165 | 227 |
| CVE-2017-0199 | 33 | 15 | 22 | 21 | 5 | 46 | 17 |
| Zusy | 29 | 26 | 8 | 17 | 15 | — | 40 |
| Multiverze | 25 | 21 | 13 | 12 | 18 | 75 | — |
| Babar | 30 | 16 | 21 | 16 | 23 | 39 | 58 |
| FakeAlert | 5 | 12 | 181 | 112 | — | 57 | — |
| StopCrypt | 13 | 14 | 24 | 33 | 13 | 101 | 25 |
| Balada | 34 | 68 | 20 | — | — | — | 1 |
Rank1–56–1011–2526–5051–100— = outside the top 100