Malware vs Ransomware

Malware activity averaged 39,341 hits per firewall in the first half of 2026, giving financial services the second-highest per-device malware intensity of any industry, behind only healthcare.

Ten ransomware families were active against the financial services sector in the first half of 2026, including REvil (Sodinokibi) and Prometheus.

11% of the top 100 vendors most commonly used by universities currently show evidence of active infostealer malware infections.

IT and security professionals rate attackers using AI to generate self-mutating malware as a high or extreme risk at 55.9%, employees leaking sensitive data into public LLMs at 53.5%, AI-driven evasion techniques at 52.5%, and deepfakes or voice cloning used in fraud or BEC at 51.9%.

1 in 7 of Austrailian SME owners or managers reported malware.

33.9% of Australian SME owners or managers reported experiencing malware.

67.3% of the 832 malicious accounts banned between March 2025 and March 2026 used AI to write malware.

Across organizations in Europe, GitHub and Microsoft OneDrive are the most abused platforms for malware distribution, each impacting 10% of organizations.

495 malicious AI models were identified on Hugging Face.

969 malicious AI agent skills were identified carrying high-impact payloads.

56 malicious extensions were identified on OpenVSX.

The most prevalent malware families observed in 2025 are Cobalt Strike, Sliver, Metasploit, Burp, PlugX, SuperShell C2, Havoc, Panda C2, Brute Ratel, and ShadowPad.

Credential-stealer infections were dominated by RedLine with 911,968 infections (50.80%), Lumma with 499,784 infections (27.84%), and Vidar with 236,778 infections (13.19%).

The majority of businesses and charities have implemented basic technical controls, such as updated malware protection (81% businesses and 63% charities), backing up data securely via a cloud service (74% businesses and 57% charities), password policies (74% businesses and 56% charities), network firewalls (74% businesses and 45% charities) and restricted admin rights (73% businesses and 65% charities).

46% of IT security professionals report that AI is contributing to a rise in adaptive and evasive malware.

Big game hunting adversaries named 572 technology entities on dedicated leak sites for extortion.

Professional services recorded 69.9 million ransomware hits in the first half of 2026, more than any other vertical.

Ten active ransomware families operated simultaneously against the professional services sector in the first half of 2026, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).

460 organizations in the professional services sector are actively detecting ransomware campaigns, representing the broadest exposure of any vertical.

7% of reported cybercrime cases in Africa in 2025 involved ransomware or Banking Trojan stealers.

The highest ransom demand in Q2 2026 was $25 million.

Qilin accounted for 285 undisclosed attacks (14%), The Gentlemen accounted for 219 (11%), and Dragon Force accounted for 137 (7%) in Q2 2026.

The number of undisclosed ransomware attacks fell 6% compared to the previous quarter.

41% of ransomware attacks exploited brand reputation.

35% of ransomware attacks exploited employee data.

31% of ransomware attacks exploited intellectual property.

Ransomware incidents made up over 20% of Cisco Talos Incident Response engagements this quarter, similar to just under 20% last quarter.

Threat actors maintained undetected access for approximately three days before ransomware deployment in the observed Sinobi engagement.

Q2 2026 recorded 1,988 ransomware attack claims from 89 groups across 101 countries.

The US accounted for 42.5% of ransomware claims, Canada for 5% and Germany for 4.8%.