Loading story…
A July cyber-attack roundup recorded 188 confirmed incidents across 69 countries, with financially motivated cybercrime driving roughly three-quarters of reported activity. One breakdown counted 146 cybercrime cases (76.0%), alongside 33 cyber-espionage incidents (17.2%) and 6 cyber-warfare cases (3.1%). The United States appeared most often among affected countries, with 47 mentions, underscoring its continued prominence in global incident reporting.
Malware was the leading attack method, appearing in 77 cases (41.0%), while ransomware and account takeover each accounted for 23 incidents (12.2%). The most common initial access vector was exploitation of public-facing applications using MITRE ATT&CK technique T1190, cited in 56 incidents (29.3%). By sector, Information and Communication organizations were targeted most heavily, with 58 incidents (24.9%), indicating sustained pressure on internet-facing and communications-dependent infrastructure.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
HACKMAGEDDON's July 2026 dataset covered attacks occurring from 2026-07-01 through 2026-07-31 and reported 188 confirmed cyber attacks across 69 countries. The statistical summary characterized financially motivated cybercrime as the dominant motive during the month.
HACKMAGEDDON published its July 2026 cyber attack statistical overview, reporting 192 events by motivation and highlighting malware as the leading attack vector. The report also identified exploitation of public-facing applications as the most common initial access technique and Information and Communication as the most targeted sector.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcehackmageddon.com
Open sourcehackmageddon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
February 2026 security reporting highlighted both macro-level incident trends and a set of high-risk, actively exploited vulnerabilities requiring rapid remediation. Hackmageddon’s February 2026 cyberattacks statistics roundup reported a threat landscape dominated by **malware (33%)**, followed by **ransomware (20%)** and **account takeovers (8%)**, based on a curated set of publicly reported events. Recorded Future’s Insikt Group reported a **43% month-over-month decrease** in “high-impact” vulnerabilities (13 in February vs. 23 in January), but emphasized that all 13 carried a **Very Critical** risk score and were **actively exploited**. The report noted **Microsoft** accounted for **6 of 13** vulnerabilities (and that these were added to **CISA KEV** the same day), described a suspected China-nexus **Lotus Blossom** supply-chain compromise of *Notepad++* updates via `CVE-2025-15556` to deliver **Cobalt Strike** and the **Chrysalis** backdoor, and stated **APT28** exploited an **MSHTML** flaw (`CVE-2026-21513`) using malicious Windows Shortcut files; it also flagged that multiple issues had public proof-of-concept exploits and referenced a critical **BeyondTrust Remote Support** OS command injection affecting versions **25.3.1 and earlier**.
Jun 29, 2026
Multiple weekly cybersecurity roundups and newsletters highlighted a mix of policy, threat, and vulnerability developments rather than a single discrete incident. UK government messaging featured prominently, including a campaign urging businesses to “lock the door” against cyber criminals and publication of longitudinal survey results indicating most organizations continue to experience cyber incidents (with reported rates in the 70–80% range across businesses and charities). Separately, commentary from European security circles emphasized growing calls for **offensive cyber capabilities** (“strike back”) amid concerns about Russian aggression and sabotage activity across Europe, including references to cyber operations targeting critical infrastructure. Threat reporting in the same period emphasized escalating **nation-state and proxy activity** against critical infrastructure and the defense industrial base, citing research that espionage groups (including those linked to China, Russia, and North Korea) have compromised organizations by exploiting **zero-day vulnerabilities in edge devices** (e.g., VPNs and gateways). Additional reporting pointed to newly identified OT-focused threat groups (e.g., **Sylvanite**, **Azurite**, **Pyroxene**) and a broad set of emerging technical risks and product/security changes, including discussion of an **OpenSSL RCE** risk, **Foxit 0-days**, and analysis of **LockBit 5.0** ransomware techniques (e.g., ETW tampering, process hollowing, log clearing) alongside Android platform security changes (e.g., deprecating cleartext traffic defaults and adding HPKE support).
Jun 29, 2026
Threat actors continue to prioritize internet-facing infrastructure that provides high-leverage initial access, with multiple reports highlighting **active exploitation of remote code execution (RCE) paths** in widely deployed services. A DFIR case study described attackers exploiting **Apache ActiveMQ** `CVE-2023-46604` by sending a crafted OpenWire command that forced the broker to load a remote Spring XML configuration, leading to payload retrieval via `certutil`, rapid privilege escalation to **SYSTEM**, credential dumping from **LSASS**, and eventual **LockBit** ransomware deployment via **RDP** after re-entry using previously stolen privileged credentials. Separately, incident-response reporting warned of ongoing exploitation against **Managed File Transfer (MFT)** products, including Gladinet *CentreStack* (an LFI issue `CVE-2025-11371` used in an exploit chain culminating in RCE, patched as `CVE-2025-30406`) and Fortra *GoAnywhere MFT* (`CVE-2025-10035`, improper deserialization leading to RCE), with observed activity linked to a threat group associated with **Medusa** ransomware. Broader telemetry and research reinforced that edge and externally exposed services remain the primary battleground for initial access at scale. GreyNoise reported nearly **3 billion** malicious sessions against edge infrastructure in 2H 2025, with heavy targeting of enterprise VPNs (notably **Palo Alto GlobalProtect**) and continued exploitation attempts for older issues such as `CVE-2020-2034`, alongside pervasive scanning of **SSH** and remote access services. In parallel, financially motivated and cybercrime-enabling ecosystems are improving their ability to reach victims: Varonis detailed **1Campaign**, a cloaking service that helps malicious **Google Ads** evade review by serving benign pages to scanners while directing real users to phishing/crypto-drainer content, and Have I Been Squatted documented **Diesel Vortex**, a logistics-focused credential-phishing operation using dozens of domains and an exposed backend repository to support industrialized theft. These trends align with reporting that attackers are increasingly using **AI-assisted social engineering and tooling** (including deepfakes and AI-generated phishing) and with law-enforcement actions such as Interpol-backed **Operation Red Card 2.0**, which resulted in **651 arrests** and $4.3M recovered from cyber-enabled fraud activity across 16 African countries.
Jun 29, 2026