H1 2026 Malware Vulnerability Trends

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – Used to gain initial access by exploiting exposed applications and management interfaces (‘threat actors repeatedly relied on familiar execution…’; ‘Exploitation of public-facing applications’).
• [T1082 ] System Information Discovery – Used to profile infected systems after execution (‘used System Information Discovery to profile infected systems after execution’).
• [T1005 ] Data from Local System – Used to collect data from compromised hosts (‘Data from Local System’).
• [T1105 ] Ingress Tool Transfer – Used to stage and transfer payloads into victim environments (‘Ingress Tool Transfer’; ‘used Ingress Tool Transfer to stage payload delivery’).
• [T1059.001 ] PowerShell – Used for command execution and malicious automation (‘malicious PowerShell command’; ‘PowerShell (T1059.001)’).
• [T1059.003 ] Windows Command Shell – Used for script and command execution on Windows (‘Windows Command Shell (T1059.003)’).
• [T1059.004 ] Unix Shell – Used for shell-based execution in Unix environments (‘Unix Shell (T1059.004)’).
• [T1041 ] Exfiltration Over C2 Channel – Used to send stolen data out through command-and-control channels (‘Exfiltration Over C2 Channel (T1041)’).
• [T1071.001 ] Web Protocols – Used for command-and-control communication over web-based protocols (‘Web Protocols (T1071.001)’).
• [T1505.003 ] Web Shell – Used to maintain persistent access after exploitation (‘Web Shell (T1505.003)’).
• [T1027 ] Obfuscated Files or Information – Used to hide malicious behavior and complicate analysis (‘Obfuscated Files or Information’; ‘LLM-generated decoy logic’).
• [T1204 ] User Execution – Used when victims were tricked into running malicious files or installers (‘User Execution’; ‘developers to install trojanized Open Visual Studio Extensions’).