Cyber Threat
Intelligence Reports

Ransomware activity increased during Q2 2026, while VPN-focused intrusions, supply chain compromises, and geopolitical developments continued to shape the threat landscape.

June 2026 key insights:

• 665 global ransomware attacks were recorded in June, contributing to a 3% increase in ransomware activity across Q2 2026 compared to Q1
• Industrials remained the most targeted sector in June, accounting for 183 attacks (28%), while representing 30% of all attacks across Q2
• North America remained the most targeted region in June, accounting for 275 attacks (41%), followed by Europe with 153 attacks (23%). This trend was also reflected across Q2, where North America accounted for 980 attacks (44%) and Europe for 579 attacks (26%)
• Qilin remained the most active ransomware group in June, responsible for 79 attacks (12%), closely followed by The Gentlemen at 11%. Across Q2, Qilin accounted for 14% of all recorded attacks
• Supply chain attacks continued to increase in scale and sophistication throughout the quarter, highlighting growing risks across trusted software development ecosystems

Ransomware activity remained consistently high throughout the second quarter, while broader threat activity continued to reflect a shift towards more scalable and collaborative attack models. From the targeting of VPN infrastructure and edge devices to the compromise of software supply chains, threat actors increasingly leveraged trusted systems and established processes to expand their reach. These trends underscore how attackers are improving both the speed and efficiency of their operations, enabling them to achieve greater impact with fewer barriers to entry.