14 minhigh
H1 2026 Malware and Vulnerability Trends
H1 2026 threat activity showed adversaries continuing to abuse legitimate tools, trusted platforms, and routine workflows for initial access, lateral movement, and monetization. Insikt Group identified 215 actively exploited CVEs (up 34% YoY), with 60 combining network accessibility, no authentication, and RCE. AsyncRAT led malware submissions with high C2 infrastructure diversity, while supply-chain attacks via npm lifecycle scripts and AI-enabled developer tooling compromises enabled credential theft at scale. Android NFC malware surged 188%, and ransomware operators integrated advanced payload features like BYOVD and post-quantum cryptography while relying on established social engineering and RMM tool abuse for initial access.
Sens:▲ 24h
Showing defanged values
- cveCVE-2021-26855ProxyLogain vulnerability exploited by SHADOW-EARTH-053 for initial access followed by Mimikatz credential dumping.
- cveCVE-2023-27532Exploited by hastalamuerte and The Gentlemen RaaS ecosystems to extract Veeam credentials and interact with backup databases.
- cveCVE-2024-4345Exploited via invoice-themed phishing targeting German manufacturing organizations to deliver AsyncRAT.
- cveCVE-2025-68947Vulnerable driver exploited by Reynolds ransomware via BYOVD to terminate endpoint security product processes including Microsoft Defender, CrowdStrike, Sophos, and Symantec.
- cveCVE-2026-20131Zero-day exploited by Interlock ransomware operators to execute code as root on unpatched devices.
Detection / Hunteropenrouter
What Happened
In the first half of 2026, attackers increasingly used everyday software tools and trusted online platforms to break into organizations, making malicious activity harder to distinguish from normal operations. Researchers found 215 known software vulnerabilities being actively exploited, a 34% increase from the same period in 2025, with many allowing remote code execution without needing a password. The most common malware types were remote access trojans (programs that let attackers control infected computers remotely) and information-stealing programs, with AsyncRAT being the most widely detected. Attackers also compromised software development tools and code libraries to spread malware through trusted supply chains, and targeted Android phones' contactless payment features to steal card data and conduct ATM fraud. Organizations should prioritize patching internet-facing systems, monitor for unusual behavior sequences rather than single alerts, protect developer credentials, and strengthen backup and mobile device security.
Key Takeaways
- 215 actively exploited CVEs identified in H1 2026, up 34% from H1 2025; 60 combined network accessibility, no authentication, and RCE, making them highest priority for remediation on exposed systems.
- AsyncRAT was the top submitted malware family with 59,507 unique hashes and 43,549 unique C2 configurations, indicating broad infrastructure diversity compared to Cobalt Strike's 1,250 configurations.
- Supply-chain attacks via npm package lifecycle scripts (TeamPCP/Shai-Hulud campaigns) harvested developer credentials, propagated across package ecosystems, and targeted AI-enabled tooling like Claude Code and LiteLLM.
- Android NFC malware (NFCShare, NGate) increased 188% in H1 2026, enabling real-time payment card theft, contactless transaction relay, and ATM cash-out schemes.
- Ransomware operators refined payloads (BYOVD in Reynolds, post-quantum crypto in pe32s) while relying on established initial access methods including ClickFix social engineering and RMM tool abuse.
Affected Systems
- Microsoft Windows and Windows Server
- Red Hat Enterprise Linux
- Vercel Next.js
- Cisco Catalyst SD-WAN Manager
- Cisco Secure Firewall Management Center
- Apple iOS and iPadOS
- Microsoft Exchange Server
- Fortinet FortiOS
- F5 BIG-IP
- Apache Shiro
- GeoServer
- Veeam Backup & Replication
- Android devices with NFC capability
- npm package ecosystems
- Magento/Adobe Commerce and WooCommerce e-commerce platforms
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-20131 | Cisco Secure Firewall Management Center | Critical | Zero-day exploited by Interlock ransomware operators to execute code as root on unpatched devices. |
| CVE-2025-68947 | NsecSoft NSecKrnl driver | High | Vulnerable driver exploited by Reynolds ransomware via BYOVD to terminate endpoint security product processes including Microsoft Defender, CrowdStrike, Sophos, and Symantec. |
| CVE-2021-26855 | Microsoft Exchange Server | Critical | ProxyLogain vulnerability exploited by SHADOW-EARTH-053 for initial access followed by Mimikatz credential dumping. |
| CVE-2024-4345 | Exploited via invoice-themed phishing targeting German manufacturing organizations to deliver AsyncRAT. | ||
| CVE-2023-27532 | Veeam Backup & Replication | High | Exploited by hastalamuerte and The Gentlemen RaaS ecosystems to extract Veeam credentials and interact with backup databases. |
Attack Chain
- Initial Access: Threat actors exploit network-accessible unauthenticated RCE vulnerabilities in public-facing applications (Exchange, FortiOS, Cisco SD-WAN, Next.js) or use ClickFix social engineering, phishing lures, and trojanized software installers.
- Execution: Payloads delivered via script execution (PowerShell, batch files, LNK files), npm lifecycle scripts, or DLL sideloading chains; loaders like DonutLoader and CastleLoader stage follow-on malware in memory.
- Discovery and Credential Access: Attackers run Mimikatz for credential dumping, FScan for internal scanning, and System Information Discovery commands to profile the environment.
- Lateral Movement: PsExec, Impacket, RDP via Cloudflare tunnels, and RMM tools (AnyDesk, Atera, DWAgent) used to spread across hosts; stolen SSH keys enable cloud and container access.
- Collection and Exfiltration: Stealware families harvest browser credentials, cryptocurrency wallets, and developer credential stores; data exfiltrated via s5cmd to S3, Rclone, or encrypted channels.
- Impact: Ransomware deployed with anti-recovery techniques (shadow copy deletion, backup service termination, BYOVD to kill security products); mobile NFC malware enables payment fraud and ATM cash-outs.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Recorded Future Hunting Packages, Nuclei templates by Insikt Group
The article references Recorded Future Hunting Packages for monitoring malware family behaviors and Nuclei templates created by Insikt Group for proactive vulnerability scanning. No rule bodies are reproduced in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR would capture process creation, script execution, and credential access behaviors. However, attackers abused legitimate tools (PsExec, AnyDesk, s5cmd, SyncAppvPublishingServer.vbs) that may blend into routine administrative activity. Memory-only loaders and in-process injection reduce file-based detection opportunities. |
| Network Visibility | Medium | Network telemetry would show C2 beaconing, tool transfers, and exfiltration to cloud storage (S3, GitHub repositories). However, attackers used Cloudflare tunnels, legitimate services (Stripe, Google Tag Manager), and web socket communications that may blend into expected HTTPS traffic. |
| Detection Difficulty | Hard | Attackers consistently used legitimate tools, trusted platforms, and routine workflows to blend into expected activity. Detection requires behavioral correlation across multiple stages rather than single-event alerting. Supply-chain attacks via npm lifecycle scripts execute during normal development workflows. Magecart skimming code hides within trusted third-party services. The fragmented CWE distribution (83 distinct classes) means no single signature pattern covers the vulnerability exploitation surface. |
Required Log Sources
- Process creation events (Sysmon EID 1, Windows Security EID 4688)
- Network connection events (Sysmon EID 3)
- PowerShell script block logging (EID 4104)
- Windows Service creation (EID 7045)
- Scheduled task creation (EID 4698)
- npm package installation logs
- Cloud provider audit logs (AWS CloudTrail, GitHub audit logs)
- Web server access logs for public-facing applications
- EDR telemetry for memory injection and process hollowing
- Mobile device management logs for APK installation and accessibility service abuse
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for sequences where exploitation of a public-facing application is followed by shell-based execution, process creation, and ingress tool transfer within a short time window, as 50 of 77 CVEs associated with T1190 also involved command shell execution. | Web server logs, EDR process creation events, network connection logs | Initial Access to Execution | Medium — legitimate administrative activity following application updates may trigger similar patterns. |
| Consider hunting for npm install executions that trigger network connections to non-standard endpoints or result in credential file access patterns, indicating malicious lifecycle scripts harvesting developer credentials. | Endpoint process logs, file access monitoring for credential stores, network DNS and connection logs | Initial Access via Supply Chain | Low to Medium — legitimate npm packages may access credential stores during normal operation, but combined with outbound connections to newly created repositories is suspicious. |
| Consider hunting for remote access tool installations (AnyDesk, Atera, DWAgent) occurring shortly after exploitation events or unusual process execution, as ransomware operators used these for persistence and lateral movement. | EDR process installation events, software inventory logs, Windows service creation events | Persistence and Lateral Movement | Medium — these tools have legitimate administrative uses; correlation with prior exploitation activity reduces false positives. |
| Consider hunting for Android devices with accessibility service enrollment combined with NFC API access and WebSocket connections, as NFCShare and NGate used this pattern for payment card data exfiltration. | Mobile device management logs, Android accessibility service enrollment events, network connection logs from mobile devices | Collection and Exfiltration | Low — legitimate accessibility services rarely require NFC access combined with WebSocket connections. |
| Consider hunting for web shell creation on public-facing servers followed by outbound C2 connections, as all 28 web-shell-associated CVEs also included T1190 exploitation. | File creation events on web server directories, web server access logs, EDR file integrity monitoring | Persistence | Low — web shell files in web-accessible directories are rarely legitimate. |
Control Gaps
- Signature-based vulnerability scanning alone would not catch post-exploitation tool reuse across different initial vulnerabilities, as the same tool stacks were applied across CVEs spanning 2016-2025.
- Network security controls may not detect exfiltration through legitimate cloud services (Amazon S3 via s5cmd, GitHub repositories) or encrypted channels like Cloudflare tunnels.
- Client-side security controls may not detect Magecart skimming code delivered through trusted third-party services like Google Tag Manager and Stripe APIs.
- Traditional endpoint detection may miss memory-only loader techniques that reconstruct shellcode in memory and inject into legitimate processes without writing payload files to disk.
- Package manager security controls that do not inspect lifecycle scripts (preinstall/postinstall) would miss credential harvesting during routine npm install operations.
- Mobile security controls without NFC permission monitoring would miss contactless payment relay attacks.
Key Behavioral Indicators
- Process ancestry showing user-driven execution (browser or email client) followed by script execution, system discovery, and ingress tool transfer in sequence
- Service creation registering kernel drivers (BYOVD pattern) followed by security product process termination
- npm install followed by credential file access and outbound connections to newly created GitHub repositories
- Web shell file creation in web-accessible directories following exploitation of public-facing applications
- RMM tool installation (AnyDesk, Atera, DWAgent) occurring after exploitation events or unusual process chains
- Android accessibility service enrollment combined with NFC API access and WebSocket network connections
- Scheduled task creation following ClickFix-style social engineering execution via msiexec, rundll32, or regsvr32
- Backup service termination and shadow copy deletion preceding ransomware encryption activity
- Modified Claude Code configuration files containing session hooks that execute on tool startup
False Positive Assessment
Medium — The report emphasizes that attackers deliberately used legitimate tools, trusted platforms, and routine workflows to blend into expected activity. Behavioral detections correlating sequences of events would produce fewer false positives than single-indicator alerts, but administrative use of PsExec, AnyDesk, s5cmd, and PowerShell is common in enterprise environments. Supply-chain detections around npm lifecycle scripts require careful tuning to avoid alerting on legitimate package installations. Mobile NFC monitoring has lower false positive potential since legitimate accessibility services rarely combine NFC access with WebSocket connections.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider prioritizing remediation of the 60 CVEs that combine network accessibility, no authentication, and RCE on internet-facing systems.
- If your EDR supports behavioral correlation, consider tuning detections to alert on sequences of user-driven execution followed by script activity, discovery, tool transfer, and credential access rather than isolated events.
- Consider auditing developer environments for compromised npm packages, particularly checking package lifecycle scripts (preinstall/postinstall) for credential harvesting behavior.
- If applicable, consider blocking or restricting RMM tools (AnyDesk, Atera, DWAgent, SimpleHelp) on endpoints where they are not explicitly approved.
- Consider reviewing internet-facing management interfaces, security appliances, and application frameworks for exposure to known exploited CVEs, especially Microsoft Exchange, FortiOS, Cisco SD-WAN, and Vercel Next.js.
Infrastructure Hardening
- Consider enforcing multi-factor authentication on all administrative interfaces for edge devices, VPNs, and firewalls.
- Evaluate whether segregating edge-device management networks from production networks would limit lateral movement from a compromised VPN or firewall.
- Consider implementing strict Content Security Policy on e-commerce payment pages to control loaded resources and reduce unauthorized script execution from third-party services.
- If you operate Magento, Adobe Commerce, or WooCommerce sites, consider monitoring checkout pages for unauthorized JavaScript, SVG-based execution, fake payment forms, and script changes that appear only for non-administrator users.
- Consider auditing CI/CD pipelines for exposed secrets, enforcing least privilege for package publishing, and monitoring for unauthorized repository creation or dependency changes.
- Evaluate whether restricting Claude Code and other AI-enabled developer tool configurations to prevent session hook execution would reduce persistence risk.
User Protection
- Consider restricting unnecessary PowerShell, command shell, msiexec, HTA, JavaScript, and package manager execution on endpoints where these are not required for business operations.
- If you manage mobile devices, consider enforcing MDM controls that block APK sideloading, monitor accessibility service abuse, and alert on NFC relay indicators.
- Consider requiring users to install mobile applications only from trusted app stores and blocking application sideloading where supported by your MDM platform.
- Evaluate whether application allowlisting would reduce the risk of trojanized installers and fake AI tool downloads reaching execution on endpoints.
Security Awareness
- Consider incorporating ClickFix-style social engineering awareness into existing training programs, emphasizing that fake browser-crash prompts and CAPTCHA verifications can trigger malicious command execution.
- If applicable to your workforce, consider training developers on supply-chain risks including the dangers of unvetted npm packages, malicious lifecycle scripts, and compromised maintainer accounts.
- Consider adding guidance on verifying AI tool installers and extensions through official channels, given the rise of trojanized Claude Code, OpenClaw, and Cursor AI distributions.
- Consider reminding employees that legitimate remote access tools should only be installed by IT personnel, as ransomware operators abused AnyDesk and similar tools for persistence.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping13 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Command Lines:
- Purpose: Exfiltrate stolen data to Amazon S3 cloud storage | Tools:
s5cmd| Stage: Exfiltration |s5cmd cp <local_path> s3:// - Purpose: Execute lateral movement and remote command execution on Windows hosts | Tools:
PsExec| Stage: Lateral Movement |psexec \\<host> -u <user> -p - Purpose: Trigger ClickFix-style payload execution through native Windows utilities | Tools:
msiexec,rundll32,regsvr32| Stage: Execution |msiexec /i <url> - Purpose: Execute malicious npm lifecycle scripts during package installation to harvest credentials | Tools:
npm,node| Stage: Initial Access |npm install <package> - Purpose: Abuse legitimate VBScript component to stage AutoIt loader script | Tools:
SyncAppvPublishingServer.vbs,AutoIt| Stage: Execution |cscript SyncAppvPublishingServer.vbs - Purpose: Register vulnerable kernel driver as a service for BYOVD attack to disable security products | Tools:
sc.exe| Stage: Defense Evasion |sc.exe create <servicename> binpath=
- Purpose: Exfiltrate stolen data to Amazon S3 cloud storage | Tools:
