H1 2025 Malware and Vulnerability Trends

MITRE Techniques

• [T0011 ] Command and Control – Identified as the most frequently observed malware tactic with “over 194,000 detections” illustrating heavy use of C2 for post‑compromise operations.
• [T1486 ] Data Encrypted for Impact – Used by ransomware actors; report notes “data encrypted for impact (T1486)” highlighting widespread ransomware deployments.
• [T1078 ] Valid Accounts – Employed as an Initial Access and persistence vector: report references “Valid Accounts (T1078)” indicating credential theft and reuse for access.
• [T1005 ] Data from Local System – Observed as a common technique for data theft: report lists “data from local systems (T1005)” among top techniques.
• [T1190 ] Exploit Public‑Facing Application – Most frequent technique for exploited CVEs: “Exploit Public‑Facing Application (T1190), observed in 73% of actively exploited vulnerabilities.”
• [T1203 ] Exploitation for Client Execution – Noted as a top technique: “Exploitation for Client Execution (T1203)” indicating attacks requiring user interaction or client‑side exploits.
• [T1068 ] Exploitation for Privilege Escalation – Listed among top techniques: “Exploitation for Privilege Escalation (T1068)” used to gain higher system privileges post‑exploit.
• [T1586 ] Compromise Accounts – Observed in malware TTPs: report references “Compromise Accounts (T1586)” showing account takeover activity supporting persistence and access.
• [T1133 ] External Remote Services – Highlighted as an Initial Access and persistence technique: “External Remote Services (T1133)” used to leverage stolen credentials and remote access portals.
• [T1021 ] Remote Services – Mapped to lateral movement/persistence: report mentions “Remote Services (T1021)” as supporting lateral activities across networks.