In the second quarter of 2026, cybersecurity firms observed a dynamic threat landscape, marked by significant ransomware activity, the emergence of new malware variants, and notable disruptions to cybercriminal operations. Kaspersky products alone blocked nearly 400 million online attacks and identified over 16 million malicious objects during this period.
Ransomware continued to be a prominent threat, with 2,538 new variants discovered and more than 71,000 users experiencing attacks. The Qilin ransomware group was particularly active, accounting for 15% of all ransomware victims whose data was published on data leak sites. Qilin also reclaimed the top spot for most prolific ransomware gangs by victim count on data leak sites, representing 14.57% of total listings, followed by Akira (7.80%) and DragonForce (6.88%).
Several critical vulnerabilities were actively exploited in ransomware campaigns. The Cybersecurity and Infrastructure Security Agency (CISA) confirmed that CVE-2026-33825, a local privilege escalation flaw in Microsoft Defender, was being exploited in ransomware attacks. Although Microsoft released a fix on April 14, unpatched systems remained vulnerable. Additionally, Check Point linked zero-day exploitation of CVE-2026-50751, a critical vulnerability affecting Check Point Remote Access VPN and Mobile Access, directly to the Qilin ransomware group. Attackers began exploiting this flaw on May 7, with activity peaking in early June. Check Point also disclosed a related certificate validation flaw, CVE-2026-50752, impacting site-to-site VPN connections using the legacy IKEv1 key exchange protocol.
Threat actors also employed sophisticated evasion techniques. Researchers observed the PayoutsKing group leveraging the legitimate QEMU emulator to deploy hidden, Alpine Linux-based virtual machines on compromised hosts. This method allows attackers to operate within virtualized environments, often evading detection by security solutions, and configure these VMs as backdoors managed via reverse SSH tunnels to their command-and-control infrastructure.
In a significant counter-offensive, Microsoft’s Digital Crimes Unit dismantled a malware-signing-as-a-service (MSaaS) operation run by the threat group Fox Tempest. This illicit service abused the Microsoft Artifact Signing platform to generate digital signature certificates for malicious software. Malware signed by these certificates was used in campaigns by ransomware groups such as Rhysida, Akira, INC, Qilin, and BlackByte, as well as by operators of the Oyster loader and the Lumma and Vidar infostealers. Microsoft’s disruption involved seizing the domain, revoking associated certificates, disabling accounts, and filing a lawsuit against Fox Tempest.
Beyond ransomware, miner programs also posed a considerable threat, with Kaspersky solutions detecting 6,067 new miner variants—nearly double the number from the previous quarter. These attacks targeted 213,003 unique Kaspersky users worldwide. South Korea, Pakistan, and China were among the top countries affected by ransomware Trojans, while Mali, Senegal, and Tanzania experienced the highest percentages of users attacked by miners.
