Global cyber threats rose in February 2026, according to the latest Acronis Cyberthreats Update, which showed another monthly increase in blocked malicious URLs. The rise was just under 10 percent, lower than January’s surge. The share of endpoints with blocked malware rose by 0.5 percentage points to 4.2 percent compared with the previous month.
Acronis Cyberthreats Update delivers monthly threat landscape briefs and expert analysis from the Acronis Threat Research Unit (TRU) to help organizations and individuals defend against evolving security challenges. In February 2026, Acronis solutions blocked nearly 10 percent more malicious URLs than in January, after January’s increase versus December 2025 had reached 35.6 percent. At the same time, the proportion of users with at least one blocked malware incident on an endpoint rose by 0.5 percentage points to 4.2 percent, up from 3.7 percent in January. Publicly reported data breaches numbered 715 in February, similar to the prior month (723).
The three most active malware families in February again included familiar names: the IoT malware Mirai, the banking trojan Grandoreiro and the remote access trojan AsyncRAT, which often evades detection through obfuscation techniques. Among ransomware groups, Qilin remained the most active with 107 reported victims—unchanged from the previous month—followed by The Gentlemen with 88 and Akira with 47 reported incidents.
Additional insights
• In Germany, the normalized detection rate for malicious URLs fell from 9.8 percent in January to 8.7 percent in February 2026. Among the focus countries analyzed, Germany ranked second, behind the United States at 9.0 percent.
• URL detection rates showed uneven shifts across countries: they dropped sharply in Singapore (-33 percent) and Canada (-24 percent), while increasing significantly in New Zealand (+20 percent) and Italy (+16 percent).
• Palestine reported the highest malware detection rate worldwide in February, with 52.5 percent of affected users—unchanged from January—well above Sri Lanka (19.7 percent) and Bangladesh (13.7 percent).
“The threat landscape in February offers no reason for complacency,” says Markus Fritz, General Manager DACH at Acronis. “Endpoint malware detection rates remained moderate while the number of blocked malicious URLs rose again. Large regional differences in URL detections reflect a geographic shift in threat activity, not a global slowdown. Organizations should continually review their defenses and adopt solutions that combine behavior-based and AI-driven detection.”
Protection tips against current threats
• Use strong, unique passwords and a password manager
• Store sensitive files in encrypted cloud storage
• Deploy a comprehensive security solution that combines behavioral, AI- and ML-based detection and anti-ransomware heuristics
• Implement automated recovery for encrypted or tampered files
• Use advanced email security and URL filtering to guard against phishing and social engineering attacks
• Maintain patch management to keep software up to date
• Verify signed installers not only for their signature but also for the configuration data they contain
• Critically review remote access software and limit its use to what is strictly necessary
The full Acronis Cyberthreats Update for March 2026 is available from Acronis’ TRU blog.
About Acronis
Acronis is a global cybersecurity company offering a uniquely integrated platform for cybersecurity, data protection and infrastructure management tailored to MSPs and IT teams. Acronis solutions help organizations identify and secure their IT environments, detect and respond to threats, and recover and manage data to preserve data integrity and business continuity.
Acronis is a Swiss company founded in 2003 in Singapore. The company operates 15 offices worldwide and employs staff across more than 60 countries. The Acronis Cyber Platform is available in 26 languages across more than 150 countries and is used by more than 21,000 service providers to protect over 750,000 organizations.
For more information, visit the Acronis website.