Q2 2026 Threat Landscape: Qilin Takes the Ransomware Crown, Phishing Dominates Initial Access, and 15,700 New CVEs Hit the Wire

01 — The Quarter in Numbers

Q2 2026 was a high-volume quarter across every source the engine watches. The headline figures below are the raw counts our platform recorded between April 1 and June 30 — leak-site victims, newly-published vulnerabilities, curated CTI reporting, and monitored channels.

Key takeaway: The signal-to-noise problem is getting worse, not better. A mid-sized security team cannot manually triage 172 new CVEs a day, 12 ransomware victims a day, and a constant stream of hacker chatter. The value is no longer in collecting the data — it is in filtering it down to the handful of items that actually touch your assets, sector, and region.

02 — Ransomware: A Reshuffled Leaderboard

The engine tracked 1,082 victims posted to ransomware leak sites during the quarter — 205 in April, 137 in May, and 740 in June, as both a genuinely heavy June and the continued expansion of our leak-site coverage pushed the pace up. More telling than the totals is the churn at the top: the group ranking looks nothing like it did a quarter ago.

Key takeaway: Qilin overtaking the field, LockBit resurfacing as LockBit5 after law-enforcement pressure, and The Gentlemen climbing from a first-quarter newcomer into the top three all point to the same thing — the Ransomware-as-a-Service ecosystem is fluid, and a group that is quiet one quarter can dominate the next. Defenders should track techniques and behaviors, not brand names, because the brand you patched against last quarter may already be gone.

03 — Who Got Hit: Sectors and Geography

Ransomware crews follow the money and the path of least resistance. Business Services and Manufacturing led victim counts — sectors rich in operational-technology exposure, third-party dependencies, and downtime-sensitive operations that raise the odds of a payout.

Geographically, victims skewed heavily toward the United States, which absorbed roughly a third of all leak-site postings, followed by Germany, the United Kingdom, and Canada.

Key takeaway: Healthcare landing in the top five (80 victims) is the most concerning trend — these are attacks with direct human consequences, and the sector continues to run legacy systems that are difficult to patch. Manufacturing at 127 confirms that OT and industrial environments are now squarely in scope, not an afterthought.

04 — Initial Access: Phishing Still Wins

Mapping every article and channel report against MITRE ATT&CK shows where adversaries actually spend their effort. One technique towered over the rest.

Key takeaway: Phishing at 282 mentions — nearly double the next technique — is the clearest signal in the dataset. Despite years of awareness training and email filtering, adversaries keep choosing email because it keeps working. The pairing of T1566 (phishing) into T1486 (encryption) is the canonical ransomware kill chain in miniature: phish the credential, then encrypt the estate. Valid Accounts (T1078) and Remote Services (T1021) rounding out the list show how much of the intrusion lifecycle now runs on legitimate access rather than malware.

05 — The Vulnerability Firehose

15,719 new CVEs were published in Q2 — a rising cadence of 4,791 in April, 5,199 in May, and 5,729 in June. No team can act on all of them, which is exactly why exploit-prediction and known-exploited status matter more than raw CVSS. Of the quarter, 1,727 were Critical, 374 have public exploit code, and 443 sit in the CISA Known Exploited Vulnerabilities catalog.

The vulnerabilities worth losing sleep over are the ones with a high EPSS (exploit-prediction) score. These are the Q2 CVEs the engine flagged as most likely to be exploited:

Key takeaway: A CVE with an EPSS score above 0.9 is more than ninety percent likely to see exploitation within thirty days — regardless of its CVSS rating. Two of the six above already have public exploit code. Teams that patch by CVSS alone will burn cycles on high-severity bugs nobody is exploiting while missing the handful that attackers are actively weaponizing. Prioritize by known-exploited status and EPSS, filtered to your own vendor stack.

06 — Threat Actors in the Spotlight

Beyond ransomware brands, a distinct set of named actors drove Q2 reporting — a mix of financially-motivated extortion crews, state-aligned espionage groups, and hacktivist collectives active on Telegram.

Key takeaway: The defining actor story of Q2 is extortion without encryption. ShinyHunters, Scattered Spider, and Luna Moth all favor stealing data and threatening to leak it over deploying ransomware payloads — a model that sidesteps backup-based recovery entirely. If your incident-response plan assumes decryption is the goal, it is a quarter out of date.

07 — Regional Focus: The Middle East

Cyntelligence was built with the Gulf in mind, so we watch the region closely. Q2 produced 130 Middle East-tagged reports and 29 regional ransomware victims. On monitored channels, the UAE watchlist surfaced chatter in several forms: initial-access brokers advertising firewall access to Emirates targets, forum posts claiming to sell UAE government datasets, and a DragonForce ransomware listing that named an Abu Dhabi hotel.

Key takeaway: Regional volume is lower than North America or Europe in absolute terms, but the targeting is deliberate — energy, government, and telecom entities in the GCC draw both hacktivist attention and state-aligned interest. For organizations in the region, the value of intelligence is not global volume; it is the early warning that your own name, brand, or executives have surfaced in a channel. That is a very different signal from a worldwide feed.

08 — Tooling and Malware

The tools named across Q2 reporting are a familiar blend of dual-use offensive frameworks and commodity malware — a reminder that most intrusions do not need bespoke tooling.

Key takeaway: Cobalt Strike and Metasploit remain the workhorses of hands-on-keyboard intrusion, while info-stealers like StealC feed the credential economy that powers the phishing and valid-account techniques above. Detection engineering that covers these common frameworks — rather than chasing the newest named malware — delivers the widest coverage for the least effort.

09 — Recommendations

Based on the Q2 data, these are the priorities we would set for a lean security team heading into Q3: