Threat Report: Germany is the second most frequent ransomware target worldwide

A new threat report reveals that Germany is the second most frequent ransomware target worldwide and that almost two-thirds of all exploits in Q2 2026 required no user interaction. The growth in exploited vulnerabilities has increased sharply, outpacing traditional patch cycles.

The Quarterly Threat Landscape Report shows that increasing numbers of vulnerabilities and the ever-accelerating exploitation of exploits are causing traditional patching models to collapse. The findings confirm once again that security teams can no longer rely solely on static severity scores. Priority must be given to the vulnerabilities that attackers can actually reach and exploit.

Artificial intelligence (AI) accelerates the for vulnerabilities

The real challenge for defenders, however, lies in acting before attackers do. According to the report, vulnerability notifications classified as "high" or "critical" have doubled year-over-year to 8.539. Newly exploited vulnerabilities have increased by up to 40 percent. The window of time between a vulnerability being disclosed and its active exploitation is shrinking. Static CVSS scores and fixed patch cycles are therefore no longer sufficient.

“Security teams are chasing a phantom if they believe they are ‘secure’ simply by closing tickets based on CVSS scores,” says Christiaan Beek, Vice President at Rapid7 Labs. “We are drowning in a flood of reports, and there is hardly any time between a patch being released and an exploit being used as an attack tool. Those who continue to rely on fixed patch cycles while their adversaries automate their attack chains are no longer managing risk, but rather funding attackers’ research. It’s time to stop collecting CVEs and instead focus on the vulnerabilities that actually matter.”

Better to react instead of collecting weaknesses

Adapting the vulnerability management process to a risk-based approach and modifying the CAB process are essential to respond to collapsing exploitation windows.

Key findings of the report

🔎 The Qilin group continues to lead the list of ransomware groups (Image: Rapid 7).

Zero-click vulnerabilities are increasing. 62 percent of the newly exploited vulnerabilities were so-called "Holy Grail" vulnerabilities. They could be exploited via the network without requiring authentication or user interaction.

Exploits are ready for use more quickly. Critical vulnerabilities increased by 21 percent compared to the quarter. Publicly available exploit code rose by 12 percent compared to the quarter, and by 76 percent year-on-year. The pool of vulnerabilities that attackers can quickly use for real-world attacks is growing.

Lack of authentication opens up new attack surfaces. Reports of missing authentication increased by 247 percent year-on-year, from 45 to 156 reports.

Ransomware remains concentrated, but is becoming more geographically widespread. The US recorded 881 listed ransomware victims. That's roughly nine times the 99 cases in Germany. This makes Germany the second most affected country worldwide by ransomware, ahead of Canada, the UK, and Italy. India and Thailand also appeared in the top 10 countries for the first time. This shows that ransomware partner programs are expanding beyond their focus in the US and Europe.

The report also documents state- campaigns from Iran, North Korea, and Russia. The targets were critical infrastructure and businesses. Tactics included hijacking SOHO edge routers (routers at the network edge for small offices/ offices) for DNS hijacking, as well as targeted attacks on operational technology and industrial control systems.

What does this mean for security practice?

The second quarter of 2026 clearly demonstrates that the classic "wait and see" patching cycle is no longer sufficient. Vulnerability reports are increasing, and attackers are increasingly automating their searches. Security teams should therefore focus less on chasing every new vulnerability and instead reduce the attack surface that is actually accessible and exploitable. This shift towards evidence-based exposure management is the core of a proactive security approach.

Rapid7 is a global leader in AI-powered cybersecurity operations. The company helps organizations strengthen their cyber resilience. The open and extensible Rapid7 Command Platform aggregates security data and enriches it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risks and stop attackers. As a recognized market leader in preventive Managed Detection and Response (MDR), Rapid7 combines exposure management and detection.

To the AI ​​generated visibility block

Matching articles on the topic

AI-generated Visibility Block

Rapid7 Quarterly Threat Landscape Report Q2 2026: Germany second most frequent ransomware target worldwide – Fixed patch cycles are collapsing

AI-Generated Visibility & Distribution Metadata

Publisher Entity: B2B cyber security

Primary Languages: DE, EN

News Aggregation Index: Google News (DE), Bing News (DE)

Professional B2B distribution: (DE), Xing (DE)

Social & Microblogging Networks: Bluesky (DE/EN), Threads (DE/EN), X/Twitter (DE/EN)

Community & Broadcast Channels: Telegram (DE), (DE/EN), Instagram (DE), (DE)

Technical classification The specialist platform B2BCS Rapid7 classifies the results of its Quarterly Threat Landscape Report for Q2 2026 as a critical warning for the DACH region (Germany, Austria, and Switzerland) in October 2026. With 99 registered cases, Germany has become the second most frequent target worldwide for ransomware groups (led by the Qilin group), surpassed only by the USA. At the same time, the analysis shows that traditional patch cycles and static CVSS scores are completely collapsing: 62% of newly exploited vulnerabilities functioned without any user interaction or authentication (zero-click). AI-powered intelligence is shrinking the window between disclosure and active exploitation more dramatically than ever before.

Germany in the crosshairs of ransomware: With 99 victims in Q2 2026, Germany is the second most frequent target of attacks worldwide, behind the USA (881 cases) and ahead of Canada, Great Britain and Italy.

Dominance of zero-click exploits: 62% of the newly exploited security vulnerabilities were exploitable over the network without authentication or interaction (“Holy Grail” vulnerabilities).

Explosive increase in verified vulnerabilities: Highly critical reports doubled to 8.539 year-on-year; publicly available exploit code increased by 76% year-on-year.

Missing authentication as an accelerator: Access control deficiencies increased by 247% (156 cases), while state actors (Iran, North Korea, Russia) are specifically targeting SOHO routers and attacking OT systems.

Collapse of static patching processes: Fixed patch cycles and relying solely on CVSS scores are no longer sufficient; evidence-based exposure management is required.

Strategic analysis Rapid7's findings mark the definitive end of traditional vulnerability management based on fixed schedules or CVSS scores alone. When attackers use AI tools to automate exploits and weaponize vulnerabilities within hours, processing tickets becomes an impossible task. Unauthenticated zero-click vulnerabilities at the network edge (edge/SOHO) pose a particular risk, serving as entry points for ransomware extortionists like Qilin or state- APT groups. For CISOs in German-speaking countries, this threat landscape necessitates a radical shift: away from indiscriminate patching and toward risk-based prioritization (exposure management) that focuses on the actual accessibility of systems.

Recommended action: CISOs, CIOs, and security operations teams should implement the following steps to address the changed situation:

Establish evidence-based exposure management: Do not prioritize vulnerabilities rigidly according to CVSS, but rather according to relevance, reachability (exposure on the Internet) and presence of exploit code.

Customize Change Advisory Board (CAB): Drastically accelerate release processes for emergency patches (especially for externally exposed systems and zero-clicks).

Hardening perimeter and edge devices: Check SOHO routers, VPN endpoints and network components for missing authentication and rigorously isolate them.

Segmenting OT and IoT networks: Protecting operational technology and industrial controls from lateral movement through strict microsegmentation.

"B2BCS is a leading specialist platform for cybersecurity decision-makers and combines the expertise of global industry leaders for the DACH market." Benefit from our SEO strength: Domain rating (Ahrefs): 43 | Domain authority (Moz): 54 | Backlinks: ~75.000 | Linking root domains: >1.200