The UCSP SOC monitoring center analyzed security incidents from January to June 2026. Data shows that attackers increasingly use combined strikes, simultaneously encrypting infrastructure, stealing sensitive data, and launching DDoS attacks to force victims to pay.
Attacks via third-party contractors have surged, rising from 10% to 30% of all incidents within a year. Currently, one in three compromises begins with a supplier or service provider rather than the target company itself.
The industrial sector has seen a 2.3-fold increase in ransomware infections compared to 2025. Meanwhile, DDoS attacks grew by 27%, with 80% targeting the application layer. Phishing, credential theft, and web vulnerabilities remain the primary entry vectors, accounting for 70–80% of incidents.
Hackers are increasingly demanding 'quiet ransoms' to prevent reporting leaks to regulators, aiming to help businesses avoid turnover-based fines. Reported incidents include a 3 TB leak at an energy company and 636 GB of data stolen from an information resource.
Technical vulnerabilities in network equipment, Linux kernels, and office applications remain critical. For instance, flaws in Check Point VPN gateways potentially exposed up to 60% of Russian companies using these firewalls, while NGINX vulnerabilities affected up to 5.7 million servers globally.
