Skip to content
Threat Review

Q2 2026 Threat Review

UltraViolet Cyber's TIDE team tracks the threat actors, vulnerabilities, and social engineering techniques shaping the landscape in Q2 2026.

47%
of initial access incidents traced to the ClickFix technique
11%
of confirmed initial access from vishing — now ahead of email at 6%
$25M+
lost in a single deepfake video impersonation incident

Ransomware groups are running structured affiliate programs and making deliberate decisions about which sectors face the steepest costs from downtime. Nation-state actors are pre-positioning inside the telecom infrastructure that carries everyone else's traffic. And the techniques people use to bypass your defenses no longer fit neatly into "technical" or "human."

A vulnerability disclosed in February had been quietly exploited since 2023. A BitLocker bypass shipped with no CVE and no patch. And the fastest-growing initial access method works because the victim runs the malicious command themselves, no malware required.

If your security program still treats ransomware, nation-state threats, and social engineering as separate problems, you're defending against last quarter's playbook while attackers have already moved on to the next one.

This report breaks down what changed, why it matters for how you prioritize, and where the evidence says to put your next investment.

Download the Report