Acronis Cyberthreats Update, July 2026

Author: Alexander Ivanyuk, Senior Director, Technology

In June 2026, Oracle released emergency mitigations for a critical PeopleSoft PeopleTools zero-day vulnerability, tracked as CVE-2026-35273, after it was linked to active data-theft attacks by the ShinyHunters extortion group. The flaw allowed unauthenticated remote code execution and affected PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, putting enterprise HR, finance, payroll, procurement and student administration environments at risk. ShinyHunters claimed it used a combination of old and zero-day flaws to steal data from 300 PeopleSoft instances across more than 100 organizations.

The campaign was particularly notable because it targeted systems that often contain highly sensitive internal business and personal data. Most of the organizations claimed to be affected were in the education sector, and Mandiant reported that 68% of the potentially vulnerable organizations it notified operated in higher education. Attackers were also observed using staging infrastructure, custom MeshCentral agents, reconnaissance scripts and tooling designed to move through PeopleSoft and WebLogic environments, exfiltrate data and leave ransom notes on compromised servers.

This incident highlights the continuing risk of enterprise application compromise: Widely used business platforms can become high-value extortion targets when exposed to the internet or left insufficiently segmented. Unlike opportunistic credential theft, exploitation of a zero-day in core ERP infrastructure can give attackers access to data-rich systems that are deeply connected to identity, HR, finance and student records. Organizations running PeopleSoft or similar enterprise platforms should prioritize emergency mitigations, restrict external access to administrative endpoints, review logs for suspicious activity, rotate exposed credentials and verify whether attackers established persistence before bringing affected systems fully back online. 

In June 2026, the percentage of unique Acronis clients with at least one malware threat blocked at the endpoint decreased to 6.0%, down 0.2 percentage points from 6.2% in May 2026. Although this marks a second consecutive month-over-month decline following April’s peak of 6.8%, June remained the fourth-highest level in the period shown and continued to indicate elevated malware exposure compared with the start of the year.

Compared with February 2026, when the share stood at 4.2%, June was 1.8 percentage points higher. It was also 2.3 percentage points above January 2026, showing that malware exposure remained substantially above early-2026 levels despite the continued month-over-month decrease.

In June, the top three countries with the highest malware detection rates remained unchanged compared with May. Palestine recorded the highest rate globally, with 42.6% of affected unique clients experiencing at least one malware detection, followed by Vietnam at 32.1% and Iraq at 31.4%.

Compared with May, malware detection rates declined slightly in Palestine and Vietnam, while Iraq recorded a notable increase. Palestine fell by 2.9 percentage points from 45.5% to 42.6%, and Vietnam edged down by 0.1 percentage points from 32.2% to 32.1%. By contrast, Iraq increased by four percentage points from 27.4% to 31.4%.

Despite the mixed month-over-month movement, the ranking remained stable, showing that malware exposure continued to be concentrated in the same three countries as in May.

Across the focus countries, June 2026 showed a generally softer picture compared with May. Most countries in the table recorded lower normalized URL detection rates, while a smaller group of markets increased or remained stable. Colombia recorded the highest level in June at 12.9%, followed closely by India at 12.8% and the United States at 12%. Brazil and Mexico also remained elevated at 11.2% and 11.1%, respectively.

The largest month-over-month increase was recorded in Mexico, which rose from 8.5% in May to 11.1% in June, up 2.6 percentage points. India also increased notably, from 11.1% to 12.8%, while the United States rose from 11.6% to 12%. Colombia edged up from 12.7% to 12.9%, and South Korea increased slightly from 5.9% to 6.2%.

At the same time, most focus countries showed signs of decline. New Zealand recorded the sharpest decrease, falling from 12.7% in May to 9.8% in June, down 2.9 percentage points. Singapore also declined significantly, from 13.1% to 10.3%, while Japan fell from 8.1% to 6.3%. Australia decreased from 9.7% to 8.5%, France from 11.1% to 10.4%, Germany from 10.7% to 9.8%, Italy from 11.5% to 10.6%, Brazil from 13% to 11.2%, the Netherlands from 9.9% to 9.1%, and the United Kingdom from 7.7% to 7%. Canada remained unchanged at 11.3%.

URL-based threat activity remained elevated in several markets — particularly Colombia, India, the United States, Brazil and Mexico, but the overall movement across the focus-country set was downward. The strongest upward pressure shifted toward Mexico and India, while the sharp declines in New Zealand and Singapore suggest a meaningful easing in countries that had been among the highest-rate markets in May. Overall, June indicated broader stabilization across the focus countries, with increases concentrated in a smaller number of markets. 

The threats can be detected and mitigated with solutions from Acronis.

Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) protects against both known and never-before-seen threats through a multilayered protection approach. This includes behavior-based detection, AI- and ML-trained detections and anti-ransomware heuristics, which can detect and block encryption attempts and roll back any tampered files automatically without any user interaction.

Additional email security and URL filtering can help you protect against social engineering threats. Acronis GenAI Protection, natively integrated in the Acronis platform, gives you visibility and control over AI usage, blocks sensitive data sharing and detects harmful prompts. Acronis XDR for Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) brings the visibility needed to understand attacks while simplifying the context for administrators and enabling efficient remediation of any threats.