Author: Alexander Ivanyuk, Senior Director, Technology
The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in September 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world.
Incident of the month
Between late August and mid-September 2026, four separate nation-state espionage groups independently deployed a new exploit kit dubbed BlueMoon that chains three zero-day vulnerabilities in Chrome and Windows to achieve full code execution and privilege escalation.
Proofpoint first observed BlueMoon in spear phishing campaigns attributed to APT31 — also tracked as JungleBamboo or Violet Typhoon, a Chinese state-aligned actor — beginning on August 28; Volexity identified a second, unrelated actor using the same kit against multiple non-governmental organisations on September 1.
By the time Google and Microsoft issued patches in mid-September, at least two further espionage groups had adopted BlueMoon, bringing the total to four distinct actors exploiting the same zero-day chain within a 12-day window.
BlueMoon chains three specific vulnerabilities: CVE-2026-85046, a type-confusion flaw in Chrome's V8 JavaScript engine that enables remote code execution inside the browser process; CVE-2026-87491, a V8 sandbox escape that promotes that execution out of the renderer sandbox; and CVE-2026-85880, a heap-based buffer overflow in the Windows ALPC subsystem that escalates privileges to SYSTEM.
Proofpoint and Volexity researchers determined that the kit's authors exploited a structural gap in Google's release cadence: Chromium's public source repository receives security-fix commits days or weeks before a patched stable Chrome build reaches end users.
The BlueMoon developers reverse-engineered those public commits to weaponize the vulnerabilities before most organisations had any chance to update. Delivery was via spear phishing — lure documents and fake browser-update pages that triggered the exploit chain when rendered in a Chromium-based browser on a Windows host.
BlueMoon is significant not because any single actor used it, but because four separate nation-state groups adopted the same kit within 12 days — a dynamic that points to an emerging exploit-broker or kit-sharing model for state-sponsored espionage previously more common in financially motivated cybercrime. That rapid multi-actor adoption compressed the window between initial exploitation and widespread use to near zero, leaving defenders no opportunity to prioritize patching based on intelligence about a single known threat actor.
September malware threat detections
In September 2026, the percentage of unique Acronis clients with at least one malware threat blocked at the endpoint fell to approximately 4.3%, a decrease of roughly 0.6 percentage points from August's 4.9%. This is the lowest level recorded in 2026 and extends the downward trend that began after the spring peaks of 6.8% in April and 6.4% in March.
Despite the continued decline from the spring highs, the September reading remains 0.6 percentage points above the year-opening level of 3.7% recorded in January, and just 0.1 percentage points above February's 4.2% — the two levels are now essentially equal, suggesting endpoint malware pressure has returned to the baseline seen at the start of the year.
In September, the top three countries with the highest malware detection rates saw notable reshuffling. Palestine retained the top position at 37.4%, easing from 41.4% in August — a decline of 4.0 percentage points. Iraq entered the top three for the first time this year at 27.5%, displacing Bangladesh, which had ranked second or third across July and August. Vietnam remained in the top three at 22.3%, down from 28.5% the prior month.
Iraq’s entry in second place signals continued elevated risk across the Middle East, while Bangladesh's decline from 24.3% to 16.5% brought it out of the top three. Palestine and Vietnam both eased relative to August but remain far above the global average of 4.3%.
Across the focus countries, September 2026 shows a broadly rising picture compared with August, with most markets increasing — a reversal of August's mixed pattern. The largest gains were in Italy (+2.0 pp, from 7.2% to 9.2%), New Zealand (+1.4 pp, from 7.0% to 8.4%), France (+1.3 pp, from 7.3% to 8.6%) and Canada (+1.2 pp, from 8.6% to 9.8%).
The only markets that declined were India (-0.8 pp, from 10.2% to 9.4%), Germany (-0.6 pp, from 9.1% to 8.5%) and Australia (-0.6 pp, from 8.0% to 7.4%).
Singapore remained flat at 10.0%, while Colombia surged to 10.0%, tying Singapore at the top of the focus group alongside the United States at 9.9%.
URL-based threats accelerated broadly across the focus-country set in September, with Italy posting the sharpest increase (+2.0 pp to 9.2%) and Canada recording a strong rebound to 9.8%. India slipped to 9.4% but remained among the most exposed markets in the focus set. Australia and Germany were the notable exceptions, both easing modestly from their August highs.
Protection
The threats can be detected and mitigated with solutions from Acronis.
Acronis Cyber Platform protects against both known and never-before-seen threats through a multilayered protection approach. This includes behaviour-based detection, AI- and ML-trained detections and anti-ransomware heuristics, which can detect and block encryption attempts and roll back any tampered files automatically without any user interaction.
Additional email security and URL filtering can help you protect against social engineering threats. Acronis GenAI Protection, natively integrated in the Acronis platform, gives you visibility and control over AI usage, blocks sensitive data sharing and detects harmful prompts. Acronis XDR brings the visibility needed to understand attacks while simplifying the context for administrators and enabling efficient remediation of any threats.