Looking for a Shorter Overview?
AI Summary
Key Moments
Malware reduction
Global malware detection rates decreased from 6.8% in April to 5.6% in July.Increase in data breaches
Reported data breaches rose from 705 to 885 during the month of July.Ransomware group activity
Groups such as The Gentlemen and Qilin significantly increased their activity with more victims.Importance of multi-layered strategy
Acronis emphasizes the need for continuous monitoring and a strong security strategy against cyber threats.Acronis’ latest Cyberthreats Update shows a two-pronged trend in the global cyber threat landscape. The percentage of malware detected decreased for the third consecutive month, while the number of reported data breaches increased sharply and ransomware groups continued to intensify their attacks.
The global cyber threat landscape showed mixed trends in July. According to telemetry data from Acronis, the global malware detection rate fell for the third consecutive month to 5.6 percent. URL-based threats also decreased in all 16 markets that the company specifically monitors.
At the same time, the number of reported data breaches increased significantly to 885, compared to 705 the previous month. Additionally, ransomware groups such as The Gentlemen and Qilin have increased their activity significantly in just a few weeks.
Acronis Cyberthreats Update is published monthly and compiles current insights into the cyber threat landscape as well as analysis from the experts within the Acronis Threat Research Unit, TRU.
Claims program decreases for the third month in a row
According to Acronis telemetry data, the malware detection rate decreased by 0.4 percentage points in July, from 6.0 to 5.6 percent.
This marks the third consecutive monthly decline since the year's highest level of 6.8 percent was recorded in April.
URL-based threats also showed an improvement in July, with the normalized detection rate decreasing compared to June in all 16 focus markets.
In Germany, the level decreased by 2.5 percentage points to 7.3 percent. Particularly large declines were noted in Brazil, from 11.2 to 6.7 percent, Italy, from 10.6 to 7.0 percent, and Colombia, from 12.9 to 9.4 percent.
Ransomware groups continue to increase activity
At the same time, developments in ransomware continued to be very dynamic.
The Gentlemen topped the list in July with 162 known victims, followed by Qilin with 128 cases and DragonForce with 42 cases.
The Gentlemen and Qilin thus increased their activity significantly compared to June, when the groups were linked to 91 and 78 victims respectively.
Meanwhile, DragonForce moved into the top three most active players, at the expense of LockBit 5.0. The figures show how quickly individual ransomware groups can scale up or down their operations in just a few weeks.
Vidar, AsyncRAT and XWorm among the most active threats
In terms of malware activity, Vidar, AsyncRAT, and XWorm were at the top.
According to the report, the combination of information-stealing malware and remote access tools shows how cybercriminals are both trying to steal sensitive information directly and establish long-term access to compromised systems.
Additional findings from the report
During July, 885 data breaches were reported, a clear increase compared to the previous month's 705.
The highest normalized malware detection rates were recorded in Palestine at 42.6 percent, Vietnam at 30.5 percent, and Guadeloupe at 26.8 percent.
For malicious URLs, Singapore ranked highest among the focus markets at 10.2 percent, followed by India at 10.0 percent and Colombia at 9.4 percent. The United States was noted at 8.8 percent.
Incident of the month: Ernst & Young
Acronis also highlights an incident linked to Ernst & Young, EY.
Unauthorized actors allegedly gained access via a platform provided by an external IT provider and used by the tax advisory business between March 28 and April 12, 2026. The attackers were able to download documents from several clients.
The ShinyHunters ransomware group publicly claimed responsibility for the attack on July 27, citing compromised supply chain credentials.
According to Acronis The incident highlights the importance of particularly protecting accounts belonging to service providers and external parties with access to ITSM, DevOps, and cloud environments.
Acronis: No reason to lower your guard
“The third consecutive decline is a positive sign, but there is no reason to overstate the danger. The malware detection rate is still clearly above the level at the beginning of the year, while the regional centers of gravity are rapidly changing. Companies should therefore focus on continuous monitoring, consistently secured third-party access, and a multi-layered security strategy,” said Markus Fritz, General Manager DACH at Acronis.
Acronis advice for protecting against current cyber threats
Acronis recommends, among other things, that organizations use strong and unique passwords along with a password manager and encrypted cloud storage for confidential files.
Companies should also implement automated recovery of encrypted or tampered files and use advanced email security and URL filtering to strengthen protection against phishing and other forms of social engineering.
Patch management should be used to keep software up to date. Additionally, signed installation files should be checked not only based on their signature but also based on the configuration data they contain.
Acronis also recommends that remote access software be carefully reviewed and that its use be limited to what is actually needed.
The company finally highlights the importance of a robust security solution with behavioral-based, AI- and machine learning-based detection, as well as heuristics for protection against ransomware.
About Acronis
Acronis is a global cybersecurity company that offers an integrated platform for cybersecurity, data protection and infrastructure management for Managed Service Providers and IT departments.
Acronis solutions help organizations identify and protect their IT environments, detect and manage threats, and recover and manage data to ensure data integrity and business continuity.
Acronis is a Swiss company founded in Singapore in 2003. The company has 15 offices globally and employees in more than 60 countries. The Acronis Cyber Platform is available in 26 languages and in more than 150 countries and is used by over 21,000 service providers for
Swedish
Danish
Norwegian
Finnish
English
German
Dutch