IT threat evolution in Q2 2026. Non-mobile statistics
IT threat evolution in Q2 2026. Mobile statistics
The statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated. The information was provided by Kaspersky users who consented to sharing statistical data.
Quarterly figures
In Q2 2026:
- Kaspersky products blocked nearly 400 million attacks that originated with various online resources.
- Web Anti-Virus responded to 52 million unique links.
- File Anti-Virus blocked more than 16 million malicious and potentially unwanted objects.
- There were 2538 new ransomware variants discovered.
- More than 71,000 users experienced ransomware attacks.
- 15% of all ransomware victims whose data was published on threat actors’ data leak sites (DLS) were attacked by Qilin.
- More than 213,000 users were targeted by miners.
Ransomware
Quarterly trends and highlights
Threat actor disruption
Microsoft has dismantled an illicit malware-signing service used by ransomware operators. Microsoft’s Digital Crimes Unit has shut down a malware-signing-as-a-service (MSaaS) operation run by the threat group Fox Tempest. The illicit service abused the Microsoft Artifact Signing platform to generate digital signature certificates for malicious software. Malware signed by these certificates was observed in campaigns conducted by such ransomware groups as Rhysida, Akira, INC, Qilin, and BlackByte. The service was also leveraged by operators of the Oyster loader as well as the Lumma and Vidar infostealers. To disrupt the operation, Microsoft seized the domain used by the MSaaS platform, revoked all associated certificates, and disabled the related accounts. Additionally, the company filed a lawsuit against Fox Tempest.
Vulnerabilities and attacks
CISA has confirmed that a Windows vulnerability known as BlueHammer is actively being exploited in ransomware attacks. On April 22, the agency updated its Known Exploited Vulnerabilities (KEV) catalog to note the ongoing ransomware exploitation of CVE-2026-33825. The local privilege escalation flaw in Microsoft Defender was originally disclosed earlier in April. Although Microsoft released a fix on April 14, unpatched systems remain vulnerable. CISA did not disclose further details or attribute the attacks to specific threat groups.
Check Point has linked zero-day exploitation of CVE-2026-50751 to the Qilin ransomware group. The critical vulnerability affects Check Point Remote Access VPN and Mobile Access. Attackers began exploiting the flaw as a zero-day on May 7, with activity spiking sharply in early June. While several dozen organizations have been targeted, at least one incident has been definitively tied to Qilin. Check Point also disclosed a related certificate validation flaw (CVE-2026-50752) that affects site-to-site VPN connections relying on the legacy IKEv1 key exchange protocol.
Researchers assess with high confidence that the PayoutsKing group is leveraging the legitimate QEMU emulator to deploy hidden, Alpine Linux-based virtual machines on compromised hosts. Because security solutions often lack visibility inside virtualized environments, the threat actors use this technique to evade detection. Inside the VM image, the operators deploy various tools — such as credential theft software — and configure the virtual machine as a backdoor managed via a reverse SSH tunnel to their command-and-control infrastructure. While the technique is not new, and we’ve detailed it before, it remains relatively rare in ransomware attacks.
The most prolific groups
This section highlights the most prolific ransomware gangs by number of victims added to each group’s DLS. Qilin reclaimed the top spot (accounting for 14.57% of total listings) after placing second last quarter. It is followed by the Akira ransomware (7.80%) and the DragonForce RaaS group (6.88%).
Number of each group’s victims according to its DLS as a percentage of all groups’ victims published on all the DLSs under review during the reporting period (download)
Number of new ransomware variants
In Q2, Kaspersky solutions detected four new ransomware families and 2538 new modifications. This signals a continued stabilization following spikes seen in Q1 and Q4 of last year.
Number of new ransomware modifications, Q2 2025 — Q2 2026 (download)
Number of users attacked by ransomware Trojans
Our solutions protected a total of 71,860 unique users from ransomware during Q2. Ransomware activity peaked in April, with 31,206 targeted users recorded during that month.
Number of unique users attacked by ransomware Trojans, Q2 2026 (download)
TOP 10 countries and territories attacked by ransomware Trojans
| Country/territory* | %** | |
| 1 | South Korea | 0.87 |
| 2 | Pakistan | 0.76 |
| 3 | China | 0.71 |
| 4 | Libya | 0.49 |
| 5 | Tajikistan | 0.46 |
| 6 | Turkmenistan | 0.38 |
| 7 | Cameroon | 0.38 |
| 8 | Indonesia | 0.36 |
| 9 | Bangladesh | 0.36 |
| 10 | Mozambique | 0.34 |
* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country/territory.
TOP 10 most common families of ransomware Trojans
| Name | Verdict | %* | |
| 1 | (generic verdict) | Trojan-Ransom.Win32.Gen | 28.02 |
| 2 | WannaCry | Trojan-Ransom.Win32.Wanna | 7.14 |
| 3 | (generic verdict) | Trojan-Ransom.Win32.Crypren | 6.27 |
| 4 | (generic verdict) | Trojan-Ransom.Win32.Agent | 4.89 |
| 5 | (generic verdict) | Trojan-Ransom.Win32.Encoder | 4.65 |
| 6 | (generic verdict) | Trojan-Ransom.Python.Agent | 3.07 |
| 7 | (generic verdict) | Trojan-Ransom.Win32.Crypmod | 2.70 |
| 8 | (generic verdict) | Trojan-Ransom.MSIL.Agent | 2.45 |
| 9 | PolyRansom/VirLock | Virus.Win32.PolyRansom / Trojan-Ransom.Win32.PolyRansom | 2.31 |
| 10 | (generic verdict) | Trojan-Ransom.Win32.Phny | 2.12 |
* Unique Kaspersky users attacked by the specific ransomware Trojan family as a percentage of all unique users attacked by this type of threat.
Miners
Number of new miner variants
In Q2 2026, Kaspersky solutions detected 6067 new miner variants, almost twice the number for the previous reporting period.
Number of new miner modifications, Q2 2026 (download)
Number of users attacked by miners
In Q2, we detected attacks using miner programs on the computers of 213,003 unique Kaspersky users worldwide.
Number of unique users attacked by miners, Q2 2026 (download)
TOP 10 countries and territories attacked by miners
| Country/territory* | %** | |
| 1 | Mali | 1.56 |
| 2 | Senegal | 1.54 |
| 3 | Tanzania | 1.32 |
| 4 | Panama | 1.04 |
| 5 | Bangladesh | 1.03 |
| 6 | Ethiopia | 0.87 |
| 7 | Costa Rica | 0.67 |
| 8 | Bolivia | 0.67 |
| 9 | Côte d’Ivoire | 0.65 |
| 10 | Kazakhstan | 0.62 |
* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by miners as a percentage of all unique users of Kaspersky products in the country/territory.
Attacks on macOS
Quarterly highlights
In April, Aikido researchers reported a new attack by the GlassWorm stealer, which was distributed via malicious IDE extensions on the Open VSX Registry. The payload operated by installing a secondary malicious extension across all installed IDE environments on the host machine. Ultimately, this second-stage implant exfiltrated crypto wallet data, environment variables, and other secrets. It also installed a RAT on the infected device.
In May, Socket researchers uncovered a supply chain compromise involving the popular npm package art-template. As a result of the breach, the weaponized package injected the Coruna exploit kit into web applications it was used to build. Coruna targets iOS devices.
In June, Palo Alto Networks’ Unit 42 discovered FlutterShell, a new backdoor family that targets macOS devices. Developed with the Flutter framework, the malware leverages the WebView engine to load web pages that contain malicious JavaScript. On the client side, the backdoor registers bridge functions invoked by the loaded JavaScript that allow threat actors to execute arbitrary payloads on the victim’s device. Notably, the malicious applications successfully passed Apple notarization. Although the specific samples analyzed functioned primarily as adware, the underlying architecture permits the delivery of far more sophisticated malicious payloads.
TOP 20 threats to macOS
* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky security solutions for macOS (download)
* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.
Detections of PasivRobber spyware continued their downward trend. Meanwhile, adware and traffic-routing utilities (categorized as NetTool) rose to the top of the rankings. Additionally, Q2 saw a noticeable spike in detections for the DirtyCow exploit frequently leveraged for iPhone jailbreaking.
TOP 10 countries and territories by share of attacked users
| Country/territory | %* Q1 2026 | %* Q2 2026 |
| Brazil | 1.13 | 1.13 |
| China | 1.04 | 1.28 |
| Hong Kong | 0.92 | 0.49 |
| Singapore | 0.85 | 0.19 |
| France | 0.62 | 1.18 |
| Mexico | 0.43 | 0.72 |
| India | 0.41 | 0.42 |
| Thailand | 0.40 | 0.24 |
| Germany | 0.33 | 0.71 |
| The Netherlands | 0.31 | 0.62 |
* Unique users who encountered threats to macOS as a percentage of all unique Kaspersky users in the country/territory.
IoT threat statistics
This section presents statistics on attacks targeting Kaspersky IoT honeypots. The geographic data on attack sources is based on the IP addresses of attacking devices.
In Q2 2026, the breakdown of attacking devices and sessions that targeted Kaspersky honeypots by protocol was as follows:
Distribution of attacked services by number of unique IP addresses of attacking devices (download)
The share of SSH attacks saw a slight uptick compared to the previous quarter.
Distribution of cybercriminal sessions in Kaspersky honeypots (download)
TOP 10 threats delivered to IoT devices
Share of each threat delivered to an infected device as a result of a successful attack, out of the total number of threats delivered (download)
As is typically the case, Mirai botnet variants continue to dominate the IoT threat landscape. Activity of another prominent botnet, Prometei, also saw an increase.
Attacks on IoT honeypots
the Netherlands, Germany, and The United States accounted for the highest proportions of SSH-based attacks during this period. While the top three countries remained the same as last quarter, their relative rankings shifted.
| Country/territory | Q1 2026 | Q2 2026 |
| The Netherlands | 17.57% | 21.18% |
| Germany | 10.34% | 16.73% |
| United States | 23.74% | 6.76% |
| Bulgaria | 1.10% | 5.50% |
| Sweden | 2.09% | 4.93% |
| Panama | 6.34% | 4.67% |
| Luxembourg | 0.16% | 4.62% |
| Romania | 5.82% | 4.06% |
| Vietnam | 3.50% | 3.91% |
| India | 6.05% | 2.78% |
The percentage of Telnet-based attacks originating from Pakistan continued to climb, knocking China down to second place.
| Country/territory | Q1 2026 | Q2 2026 |
| Pakistan | 27.31% | 36.60% |
| China | 39.54% | 35.62% |
| Russian Federation | 8.25% | 8.75% |
| India | 4.66% | 4.19% |
| Brazil | 3.30% | 3.34% |
| United States | 0.45% | 3.03% |
| Indonesia | 6.71% | 1.52% |
| Philippines | 0.36% | 0.95% |
| France | 0.17% | 0.84% |
| Thailand | 0.55% | 0.66% |
Attacks via web resources
The statistics in this section are based on detection verdicts by Web Anti-Virus, which protects users when suspicious objects are downloaded from malicious or infected web pages. These malicious pages are purposefully created by cybercriminals. Websites that host user-generated content, such as message boards, as well as compromised legitimate sites, can become infected.
TOP 10 countries and territories that served as sources of web-based attacks
The following statistics show the distribution by country/territory of the sources of internet attacks blocked by Kaspersky products on user computers (web pages redirecting to exploits, sites containing exploits and other malware, botnet C&C centers, and so on). One or more web-based attacks could originate from each unique host.
To determine the geographic source of web attacks, we matched the domain name with the real IP address where the domain is hosted, then identified the geographic location of that IP address (GeoIP).
In Q2 2026, Kaspersky solutions blocked 399,312,961 attacks launched from internet resources worldwide. Web Anti-Virus was triggered by 52,850,592 unique URLs.
Web-based attacks by country/territory, Q1 2026 (download)
Countries and territories where users faced the greatest risk of online infection
To assess the risk of malware infection via the internet for users’ computers in different countries and territories, we calculated the share of Kaspersky users in each location on whose computers Web Anti-Virus was triggered during the reporting period. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.
This ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.
| Country/territory* | %** | |
| 1 | Bangladesh | 11.71 |
| 2 | India | 7.40 |
| 3 | Tajikistan | 7.13 |
| 4 | Venezuela | 7.05 |
| 5 | New Zealand | 6.58 |
| 6 | Vietnam | 6.34 |
| 7 | Taiwan | 6.28 |
| 8 | Belgium | 6.24 |
| 9 | France | 5.97 |
| 10 | Hungary | 5.92 |
| 11 | Nepal | 5.91 |
| 12 | Portugal | 5.86 |
| 13 | Italy | 5.77 |
| 14 | Costa Rica | 5.72 |
| 15 | Canada | 5.65 |
| 16 | Qatar | 5.61 |
| 17 | Dominican Republic | 5.52 |
| 18 | Palestine | 5.48 |
| 19 | Greece | 5.47 |
| 20 | UAE | 5.43 |
* Excluded are countries and territories with relatively few (under 10,000) Kaspersky product users.
** Unique users targeted by web-based Malware attacks as a percentage of all unique users of Kaspersky products in the country/territory.
On average during the quarter, 4.54% of users’ computers worldwide were subjected to at least one Malware web attack.
Local threats
Statistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer by infecting files or removable media, or initially made their way onto the computer in non-open form. Examples of the latter are programs in complex installers and encrypted files.
Data in this section is based on analyzing statistics produced by anti-virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The statistics are based on detection verdicts from the On-Access Scan (OAS) and On-Demand Scan (ODS) modules of File Anti-Virus and include detections of malicious programs located on user computers or removable media connected to the computers, such as flash drives, camera memory cards, phones, or external hard drives.
In Q2 2026, our File Anti-Virus detected 16,986,351 malicious and potentially unwanted objects.
Countries and territories where users faced the highest risk of local infection
For each country and territory, we calculated the percentage of Kaspersky users whose computers had the File Anti-Virus triggered at least once during the reporting period. These statistics reflect the level of personal computer infection in different countries.
Note that this ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out File Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.
| Country/territory* | %** | |
| 1 | Turkmenistan | 46.38 |
| 2 | Cuba | 29.70 |
| 3 | Tajikistan | 28.46 |
| 4 | Afghanistan | 28.19 |
| 5 | Yemen | 27.85 |
| 6 | Burundi | 26.82 |
| 7 | Mozambique | 25.01 |
| 8 | Republic of the Congo | 24.88 |
| 9 | Syria | 23.17 |
| 10 | Uzbekistan | 22.49 |
| 11 | China | 21.92 |
| 12 | Nicaragua | 21.60 |
| 13 | Cameroon | 21.47 |
| 14 | Bangladesh | 20.43 |
| 15 | Democratic Republic of the Congo | 20.25 |
| 16 | Algeria | 19.78 |
| 17 | Uganda | 19.48 |
| 18 | Ethiopia | 18.57 |
| 19 | Tanzania | 18.54 |
| 20 | Mali | 18.53 |
* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users on whose computers Malware local threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.
On average worldwide, Malware local threats were detected at least once on 10.93% of users’ computers during Q2.
Russia scored 10.78% in these rankings.
IT threat evolution in Q2 2026. Non-mobile statistics