Kaspersky Reports Nearly 400 Million Cyber Attacks Blocked in Q2 2026

In the second quarter of 2026, Kaspersky reported a staggering nearly 400 million cyber attacks blocked across various online resources, highlighting the persistent and evolving nature of cyber threats. This data, derived from Kaspersky’s detection verdicts, underscores the ongoing battle against malware, ransomware, and other malicious activities that continue to plague users worldwide. For a detailed breakdown of these findings, refer to the full report on Kaspersky’s website.

Ransomware: A Growing Concern

Ransomware remains a significant threat, with Kaspersky identifying 2,538 new variants in Q2 2026 alone. More than 71,000 users fell victim to ransomware attacks during this period, with the Qilin group being particularly notorious, accounting for 15% of all ransomware victims whose data was published on data leak sites. This trend reflects a broader pattern of increasing ransomware activity, which peaked in April with over 31,000 unique users targeted.

In a notable development, Microsoft dismantled a malware-signing service operated by the Fox Tempest group, which had been used to generate digital signatures for various ransomware campaigns. This disruption is a critical step in combating the ransomware ecosystem, as it limits the ability of threat actors to authenticate their malicious software.

Emerging Threats and Vulnerabilities

The cybersecurity landscape is also witnessing the exploitation of new vulnerabilities. The Cybersecurity and Infrastructure Security Agency (CISA) confirmed that a Windows vulnerability, known as BlueHammer, is actively being exploited in ransomware attacks. Despite a patch being released, many systems remain unprotected, leaving them vulnerable to exploitation.

Additionally, the Qilin ransomware group has been linked to the exploitation of a zero-day vulnerability in Check Point’s VPN services, further emphasizing the need for organizations to remain vigilant and proactive in their cybersecurity measures.

Mining Malware on the Rise

In Q2 2026, Kaspersky detected 6,067 new miner variants, nearly double the number from the previous reporting period. This surge in mining malware has targeted over 213,000 unique users globally, indicating a shift in focus among cybercriminals towards cryptocurrency mining as a lucrative avenue for illicit profit.

Attacks on macOS and IoT Devices

The threat landscape is not limited to traditional operating systems. Attacks targeting macOS devices have increased, with new malware families such as FlutterShell emerging. This backdoor, developed using the Flutter framework, allows attackers to execute arbitrary payloads on infected devices, showcasing the evolving tactics used by cybercriminals.

Moreover, Kaspersky’s IoT honeypots revealed a continued dominance of Mirai botnet variants, with SSH attacks seeing a slight uptick. The Netherlands, Germany, and the United States were the top sources of these attacks, indicating a concentrated effort by cybercriminals to exploit vulnerabilities in IoT devices.

Conclusion: The Ongoing Battle Against Cyber Threats

The findings from Kaspersky’s Q2 2026 report paint a concerning picture of the current cybersecurity landscape. With nearly 400 million attacks blocked, the data underscores the critical need for robust cybersecurity measures across all sectors. As cyber threats continue to evolve, organizations must remain vigilant, adapting their defenses to counteract the sophisticated tactics employed by cybercriminals.