Ransomware Dominance Continues; New Supply Chain and EDR Evasion Tactics Emerge

Ransomware attacks saw a 3% global increase in Q2 2026, with the manufacturing sector remaining the primary target. The Qilin group continues its dominance, accounting for a significant portion of attacks. Threat actors are increasingly targeting software supply chains, a tactic exemplified by the Trivy compromise and Cisco breach, introducing systemic risk. A new trend highlights ransomware groups standardizing 'EDR-kill' tactics to evade defenses, making it harder for defenders to react. The PEAR ransomware group is blamed for a breach affecting over 1.2 million individuals at a medical billing firm, emphasizing extortion-focused data theft.

In other developments, a new software supply chain threat called 'slopsquatting' leverages AI coding assistants to register malicious packages. Latin American ransomware campaigns are employing unconventional methods, using legitimate system tools like BitLocker and printing physical ransom notes. Infostealer malware has compromised over 100,000 domains in a single week, with default endpoint protection being bypassed. Multiple threat groups are claiming data breaches across diverse sectors, underscoring the high operational tempo of cybercrime.

For public sector agencies, Synack and Carahsoft are offering hybrid pen-testing solutions on AWS. Industrial cybersecurity is being addressed with TXOne Networks' new Sennin platform for OT cyber risk reduction. Security experts are also highlighting a 'containment paradox' where isolating critical systems can cause more immediate financial damage than the attack itself, suggesting a need for business leaders to weigh technical risk against operational consequences. Several vulnerabilities affecting the Linux kernel, including potential denial-of-service conditions, have also been disclosed.