{"uuid": "98fac996-e832-47e6-9ed9-4052636066c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50752", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-f93423f0-4afe27d0a06c552d", "content": "IT threat evolution in Q2 2026. Non-mobile statistics\nIT threat evolution in Q2 2026. Non-mobile statisticsIT threat evolution in Q2 2026. Mobile statistics\nThe statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated. The information was provided by Kaspersky users who consented to sharing statistical data.\nQuarterly figures\nIn Q2 2026:\n\nKaspersky products blocked nearly 400 million attacks that originated with various online resources.\nWeb Anti-Virus responded to 52 million unique links.\nFile Anti-Virus blocked more than 16 million malicious and potentially unwanted objects.\nThere were 2538 new ransomware variants discovered.\nMore than 71,000 users experienced ransomware attacks.\n15% of all ransomware victims whose data was published on threat actors\u2019 data leak sites (DLS) were attacked by Qilin.\nMore than 213,000 users were targeted by miners.\n\nRansomware\nQuarterly trends and highlights\nThreat actor disruption\nMicrosoft has dismantled an illicit malware-signing service used by ransomware operators. Microsoft\u2019s Digital Crimes Unit has shut down a malware-signing-as-a-service (MSaaS) operation run by the threat group Fox Tempest. The illicit service abused the Microsoft Artifact Signing platform to generate digital signature certificates for malicious software. Malware signed by these certificates was observed in campaigns conducted by such ransomware groups as Rhysida, Akira, INC, Qilin, and BlackByte. The service was also leveraged by operators of the Oyster loader as well as the Lumma and Vidar infostealers. To disrupt the operation, Microsoft seized the domain used by the MSaaS platform, revoked all associated certificates, and disabled the related accounts. Additionally, the company filed a lawsuit against Fox Tempest.\nVulnerabilities and attacks\nCISA has confirmed that a Windows vulnerability known as BlueHammer is actively being exploited in ransomware attacks. On April 22, the agency updated its Known Exploited Vulnerabilities (KEV) catalog to note the ongoing ransomware exploitation of CVE-2026-33825. The local privilege escalation flaw in Microsoft Defender was originally disclosed earlier in April. Although Microsoft released a fix on April 14, unpatched systems remain vulnerable. CISA did not disclose further details or attribute the attacks to specific threat groups.\nCheck Point has linked zero-day exploitation of CVE-2026-50751 to the Qilin ransomware group. The critical vulnerability affects Check Point Remote Access VPN and Mobile Access. Attackers began exploiting the flaw as a zero-day on May 7, with activity spiking sharply in early June. While several dozen organizations have been targeted, at least one incident has been definitively tied to Qilin. Check Point also disclosed a related certificate validation flaw (CVE-2026-50752) that affects site-to-site VPN connections relying on the legacy IKEv1 key exchange protocol.\nResearchers assess with high confidence that the PayoutsKing group is leveraging the legitimate QEMU emulator to deploy hidden, Alpine Linux-based virtual machines on compromised hosts. Because security solutions often lack visibility inside virtualized environments, the threat actors use this technique to evade detection. Inside the VM image, the operators deploy various tools \u2014 such as credential theft software \u2014 and configure the virtual machine as a backdoor managed via a reverse SSH tunnel to their command-and-control infrastructure. While the technique is not new, and we\u2019ve detailed it before, it remains relatively rare in ransomware attacks.\nThe most prolific groups\nThis section highlights the most prolific ransomware gangs by number of victims added to each group\u2019s DLS. Qilin reclaimed the top spot (accounting for 14.57% of total listings) after placing second last quarter. It is followed by the Akira ransomware (7.80%) and the DragonForce RaaS group (6.88%).\nNumber of each group\u2019s victims according to its DLS as a percentage of all groups\u2019 victims published on all the DLSs under review during the reporting period (download)\nNumber of new ransomware variants\nIn Q2, Kaspersky solutions detected four new ransomware families and 2538 new modifications. This signals a continued stabilization following spikes seen in Q1 and Q4 of last year.\nNumber of new ransomware modifications, Q2 2025 \u2014 Q2 2026 (download)\nNumber of users attacked by ransomware Trojans\nOur solutions protected a total of 71,860 unique users from ransomware during Q2. Ransomware activity peaked in April, with 31,206 targeted users recorded during that month.\nNumber of unique users attacked by ransomware Trojans, Q2 2026 (download)\nTOP 10 countries and territories attacked by ransomware TrojansCountry/territory*%**1South Korea0.872Pakistan0.763China0.714Libya0.495Tajikistan0.466Turkmenistan0.387Cameroon0.388Indonesia0.369Bangladesh0.3610Mozambique0.34\n* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country/territory.\nTOP 10 most common families of ransomware TrojansNameVerdict%*1(generic verdict)Trojan-Ransom.Win32.Gen28.022WannaCryTrojan-Ransom.Win32.Wanna7.143(generic verdict)Trojan-Ransom.Win32.Crypren6.274(generic verdict)Trojan-Ransom.Win32.Agent4.895(generic verdict)Trojan-Ransom.Win32.Encoder4.656(generic verdict)Trojan-Ransom.Python.Agent3.077(generic verdict)Trojan-Ransom.Win32.Crypmod2.708(generic verdict)Trojan-Ransom.MSIL.Agent2.459PolyRansom/VirLockVirus.Win32.PolyRansom / Trojan-Ransom.Win32.PolyRansom2.3110(generic verdict)Trojan-Ransom.Win32.Phny2.12\n* Unique Kaspersky users attacked by the specific ransomware Trojan family as a percentage of all unique users attacked by this type of threat.\nMiners\nNumber of new miner variants\nIn Q2 2026, Kaspersky solutions detected 6067 new miner variants, almost twice the number for the previous reporting period.\nNumber of new miner modifications, Q2 2026 (download)\nNumber of users attacked by miners\nIn Q2, we detected attacks using miner programs on the computers of 213,003 unique Kaspersky users worldwide.\nNumber of unique users attacked by miners, Q2 2026 (download)\nTOP 10 countries and territories attacked by minersCountry/territory*%**1Mali1.562Senegal1.543Tanzania1.324Panama1.045Bangladesh1.036Ethiopia0.877Costa Rica0.678Bolivia0.679C\u00f4te d\u2019Ivoire0.6510Kazakhstan0.62\n* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.** Unique users whose computers were attacked by miners as a percentage of all unique users of Kaspersky products in the country/territory.\nAttacks on macOS\nQuarterly highlights\nIn April, Aikido researchers reported a new attack by the GlassWorm stealer, which was distributed via malicious IDE extensions on the Open VSX Registry. The payload operated by installing a secondary malicious extension across all installed IDE environments on the host machine. Ultimately, this second-stage implant exfiltrated crypto wallet data, environment variables, and other secrets. It also installed a RAT on the infected device.\nIn May, Socket researchers uncovered a supply chain compromise involving the popular npm package art-template. As a result of the breach, the weaponized package injected the Coruna exploit kit into web applications it was used to build. Coruna targets iOS devices.\nIn June, Palo Alto Networks\u2019 Unit 42 discovered FlutterShell, a new backdoor family that targets macOS devices. Developed with the Flutter framework, the malware leverages the WebView engine to load web pages that contain malicious JavaScript. On the client side, the backdoor registers bridge functions invoked by the loaded JavaScript that allow threat actors to execute arbitrary payloads on the victim\u2019s device. Notably, the malicious applications successfully passed Apple notarization. Although the specific samples analyzed functioned primarily as adware, the underlying architecture permits the delivery of far more sophisticated malicious payloads.\nTOP 20 threats to macOS\n* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky security solutions for macOS (download)\n* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.\nDetections of PasivRobber spyware continued their downward trend. Meanwhile, adware and traffic-routing utilities (categorized as NetTool) rose to the top of the rankings. Additionally, Q2 saw a noticeable spike in detections for the DirtyCow exploit frequently leveraged for iPhone jailbreaking.\nTOP 10 countries and territories by share of attacked usersCountry/territory%* Q1 2026%* Q2 2026Brazil1.131.13China1.041.28Hong Kong0.920.49Singapore0.850.19France0.621.18Mexico0.430.72India0.410.42Thailand0.400.24Germany0.330.71The Netherlands0.310.62\n* Unique users who encountered threats to macOS as a percentage of all unique Kaspersky users in the country/territory.\nIoT threat statistics\nThis section presents statistics on attacks targeting Kaspersky IoT honeypots. The geographic data on attack sources is based on the IP addresses of attacking devices.\nIn Q2 2026, the breakdown of attacking devices and sessions that targeted Kaspersky honeypots by protocol was as follows:\nDistribution of attacked services by number of unique IP addresses of attacking devices (download)\nThe share of SSH attacks saw a slight uptick compared to the previous quarter.\nDistribution of cybercriminal sessions in Kaspersky honeypots (download)\nTOP 10 threats delivered to IoT devices\nShare of each threat delivered to an infected device as a result of a successful attack, out of the total number of threats delivered (download)\nAs is typically the case, Mirai botnet variants continue to dominate the IoT threat landscape. Activity of another prominent botnet, Prometei, also saw an increase.\nAttacks on IoT honeypots\nthe Netherlands, Germany, and The United States accounted for the highest proportions of SSH-based attacks during this period. While the top three countries remained the same as last quarter, their relative rankings shifted.Country/territoryQ1 2026Q2 2026The Netherlands17.57%21.18%Germany10.34%16.73%United States23.74%6.76%Bulgaria1.10%5.50%Sweden2.09%4.93%Panama6.34%4.67%Luxembourg0.16%4.62%Romania5.82%4.06%Vietnam3.50%3.91%India6.05%2.78%\nThe percentage of Telnet-based attacks originating from Pakistan continued to climb, knocking China down to second place.Country/territoryQ1 2026Q2 2026Pakistan27.31%36.60%China39.54%35.62%Russian Federation8.25%8.75%India4.66%4.19%Brazil3.30%3.34%United States0.45%3.03%Indonesia6.71%1.52%Philippines0.36%0.95%France0.17%0.84%Thailand0.55%0.66%\nAttacks via web resources\nThe statistics in this section are based on detection verdicts by Web Anti-Virus, which protects users when suspicious objects are downloaded from malicious or infected web pages. These malicious pages are purposefully created by cybercriminals. Websites that host user-generated content, such as message boards, as well as compromised legitimate sites, can become infected.\nTOP 10 countries and territories that served as sources of web-based attacks\nThe following statistics show the distribution by country/territory of the sources of internet attacks blocked by Kaspersky products on user computers (web pages redirecting to exploits, sites containing exploits and other malware, botnet C&C centers, and so on). One or more web-based attacks could originate from each unique host.\nTo determine the geographic source of web attacks, we matched the domain name with the real IP address where the domain is hosted, then identified the geographic location of that IP address (GeoIP).\nIn Q2 2026, Kaspersky solutions blocked 399,312,961 attacks launched from internet resources worldwide. Web Anti-Virus was triggered by 52,850,592 unique URLs.\nWeb-based attacks by country/territory, Q1 2026 (download)\nCountries and territories where users faced the greatest risk of online infection\nTo assess the risk of malware infection via the internet for users\u2019 computers in different countries and territories, we calculated the share of Kaspersky users in each location on whose computers Web Anti-Virus was triggered during the reporting period. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.\nThis ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.Country/territory*%**1Bangladesh11.712India7.403Tajikistan7.134Venezuela7.055New Zealand6.586Vietnam6.347Taiwan6.288Belgium6.249France5.9710Hungary5.9211Nepal5.9112Portugal5.8613Italy5.7714Costa Rica5.7215Canada5.6516Qatar5.6117Dominican Republic5.5218Palestine5.4819Greece5.4720UAE5.43\n* Excluded are countries and territories with relatively few (under 10,000) Kaspersky product users.** Unique users targeted by web-based Malware attacks as a percentage of all unique users of Kaspersky products in the country/territory.\nOn average during the quarter, 4.54% of users\u2019 computers worldwide were subjected to at least one Malware web attack.\nLocal threats\nStatistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer by infecting files or removable media, or initially made their way onto the computer in non-open form. Examples of the latter are programs in complex installers and encrypted files.\nData in this section is based on analyzing statistics produced by anti-virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The statistics are based on detection verdicts from the On-Access Scan (OAS) and On-Demand Scan (ODS) modules of File Anti-Virus and include detections of malicious programs located on user computers or removable media connected to the computers, such as flash drives, camera memory cards, phones, or external hard drives.\nIn Q2 2026, our File Anti-Virus detected 16,986,351 malicious and potentially unwanted objects.\nCountries and territories where users faced the highest risk of local infection\nFor each country and territory, we calculated the percentage of Kaspersky users whose computers had the File Anti-Virus triggered at least once during the reporting period. These statistics reflect the level of personal computer infection in different countries.\nNote that this ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out File Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.Country/territory*%**1Turkmenistan46.382Cuba29.703Tajikistan28.464Afghanistan28.195Yemen27.856Burundi26.827Mozambique25.018Republic of the Congo24.889Syria23.1710Uzbekistan22.4911China21.9212Nicaragua21.6013Cameroon21.4714Bangladesh20.4315Democratic Republic of the Congo20.2516Algeria19.7817Uganda19.4818Ethiopia18.5719Tanzania18.5420Mali18.53\n* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.** Unique users on whose computers Malware local threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.\nOn average worldwide, Malware local threats were detected at least once on 10.93% of users\u2019 computers during Q2.\nRussia scored 10.78% in these rankings. \nsecurelist.com/malware-report-\u2026", "creation_timestamp": "2026-08-10T10:24:20.213595Z"}