In the first timeline of May 2026 I collected 82 events, corresponding to an average of 5.47 events per day, an important decrease compared to 108 events of the second timeline of April, where I collected 108 events (7.2 events/day).
Once again, the threat landscape is dominated by cyber crime (70%, slightly up from the previous timeline when it was 67%) and characterized by malware attacks soaring to 50% from 34%.
Cyber espionage operations played an important role even in this timeline, despite slightly down (22% vs 25%). Cyber warfare and hacktivism were both at 3%, showing respectively a decrease from 5% and the same level of the previous timeline.
In terms of attack techniques, the first two techniques confirmed their leadership in the chart, with malware preceding again account takeovers (down to 17% from 20%). Ransomware took the third place with 7%.
And similarly to the previous timeline, in the first half of May, the technique T1190 – exploitation of public-facing applications led the initial access with 28%, slightly up from 25%. T1195.001 – Supply Chain Attacks to software development tools took the second place with 12% ahead of T1566.02 – Spearphishing Links and T1566.01 – Spearphishing Attachments both of them with 7%. And T1566.03 – Spearphishing Services are immediately behind with 6%.
And finally, even in this timeline, targets belonging to J – Information an Communication sector were hit the most with 42% up from 34%, once again a consequence of the growth of supply chain attacks. Even in this fortnight, targets in O – Public Administration were behind with 9%, down from 23%, and K – Finance and Insurance down to 7% from 13%.
Besides these trends, this timeline in particular is rich of interesting events, such as additional mega breaches , so my final suggestion does not change: browse the timeline for the details of all the events collected in this fortnight.
As always bear in mind that the sample refers exclusively to the attacks included in my timelines, available from public sources such as blogs and news sites. Obviously the sample cannot be complete, but only aims to provide an high level overview of the threat landscape.
BE NOTIFIED OF NEW BLOG POSTS: SUSCRIBE!
SUPPORT MY WORK, MAKE A DONATION!
1-15 May 2026 Cyber Attacks TimelineThe threat landscape during May H1 was dominated by cyber crime and characterized by malware attacks, while the exploitation of public-facing applications led the initial access.
16-30 April 2026 Cyber Attacks TimelineIn the second timeline of April 2026 I collected 108 events, corresponding to an average of 7.2 events per day, a number that confirms a growing trend, driven by the increasing number of supply chain attacks, compared to the previous timeline, where I collected 94 ...
Mega Breaches in 2026Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
List Of Hacked Celebrities Who Had (Nude) Photos LeakedDuring Summer we always try to spend our free time in a more profitable manner, for instance reading gossip chronicles. From this point of view, July 2012 has not been a particularly lucky month for Carly Rae Jepsen. On July the 7th, her website has been ...
2018: A Year of Cyber AttacksFinally I can summarize all the events and statistics collected in 2018, quite a complicated year from an infosec perspective. For those of you that keep asking...