Acronis June 2026 Report Finds Malware Exposure Elevated as PeopleSoft Zero-Day Attacks Target Organizations
Summary
Acronis’s June 2026 threat report, based on data from more than one million endpoints, tracks malware and URL detection trends and highlights claimed ShinyHunters data theft involving a PeopleSoft zero-day.
Key points
- Acronis says its report draws on June 2026 detections and public reporting, covering more than one million endpoints worldwide.
- The report says the share of unique Acronis clients with at least one malware threat blocked fell to 6.0% in June, from 6.2% in May, but remained above early-2026 levels.
- Palestine, Vietnam, and Iraq had the highest reported malware detection rates; Iraq’s rate rose to 31.4% from 27.4% in May.
- URL detection rates generally declined across the focus countries, though Mexico and India recorded notable increases.
- The incident-of-the-month section describes CVE-2026-35273, a PeopleSoft PeopleTools zero-day linked to active data-theft attacks; Oracle released emergency mitigations.
- ShinyHunters claimed it stole data from 300 PeopleSoft instances across more than 100 organizations. The article recommends restricting external access, checking logs, rotating exposed credentials, and investigating persistence.
Article Details
- Publisher
- Acronis Threat Research Unit
- Report Period
- June 2026
- Scope
- Global cyberthreat activity observed by Acronis Threat Research Unit and Acronis sensors.
- Sample Size
- More than one million unique endpoints distributed around the world.
- Key Statistics
- 6.0% of unique Acronis clients had at least one malware threat blocked at the endpoint in June 2026, down from 6.2% in May.
- Malware detection rates were 42.6% in Palestine, 32.1% in Vietnam, and 31.4% in Iraq in June 2026.
- Normalized URL detection rates in June were highest in Colombia (12.9%), India (12.8%), and the United States (12.0%).
- ShinyHunters claimed it stole data from 300 PeopleSoft instances across more than 100 organizations.
- Mandiant reported that 68% of the potentially vulnerable organizations it notified operated in higher education.
- Recommendations
- Prioritize emergency mitigations for PeopleSoft systems.
- Restrict external access to administrative endpoints and review logs for suspicious activity.
- Rotate exposed credentials and verify whether attackers established persistence before bringing affected systems fully back online.
CVE
People
Threat Actors
Vendors
Products
Acronis Cyber Protect CloudAcronis Cyber Protect Cloud protects against both known andAcronis GenAI Protectioncan help you protect against social engineering threats. Acronis GenAI Protection, natively integrated in the Acronis platform, gives youAcronis XDRharmful prompts. Acronis XDR for Acronis Cyber ProtectPeopleSoft Enterprise PeopleToolsWebLogicPeopleSoft and WebLogic environments, exfiltrate data and leave ransom notes on
Tools
Countries
Australiafell from 8.1% to 6.3%. Australia decreased from 9.7% to 8.5%, France fromBrazilUnited States at 12%. Brazil and Mexico also remained elevated at 11.2% andCanadafrom 7.7% to 7%. Canada remained unchanged at 11.3%.Colombiasmaller group of markets increased or remained stable. Colombia recorded theFrancefell from 8.1% to 6.3%. Australia decreased from 9.7% to 8.5%, France fromGermany11.1% to 10.4%, Germany from 10.7% to 9.8%, Italy from 11.5% to 10.6%, BrazilIndiahighest level in June at 12.9%, followed closely by India at 12.8% and theIraqat 32.1% and Iraq at 31.4%.Italy11.1% to 10.4%, Germany from 10.7% to 9.8%, Italy from 11.5% to 10.6%, BrazilJapanpoints. Singapore also declined significantly, from 13.1% to 10.3%, while JapanMexicoUnited States at 12%. Brazil and Mexico also remained elevated at 11.2% andNetherlandsfrom 13% to 11.2%, the Netherlands from 9.9% to 9.1%, and the United KingdomNew Zealandfocus countries showed signs of decline. New Zealand recorded the sharpestPalestinewith May. Palestine recorded the highest rate globally, with 42.6% of affectedSingaporepoints. Singapore also declined significantly, from 13.1% to 10.3%, while JapanSouth Koreaup from 12.7% to 12.9%, and South Korea increased slightly from 5.9% to 6.2%.United Kingdomfrom 13% to 11.2%, the Netherlands from 9.9% to 9.1%, and the United KingdomUnited StatesUnited States at 12%. Brazil and Mexico also remained elevated at 11.2% andVietnamunique clients experiencing at least one malware detection, followed by Vietnam