Security Report · github.com/jacobdjwilson

WatchGuard H1 2026 Report Finds Highly Targeted Malware and Persistent Attacks on Old Flaws

Nov 8, 2026 · Original Report (PDF) ↗

Summary

WatchGuard’s H1 2026 report says 95.72% of Q2 endpoint malware detections appeared on one machine, while network attacks targeted old flaws. It also found 95% of detected network malware used TLS, which only 20% of Fireboxes inspect.

Key points

The report draws on opted-in telemetry from tens of thousands of Fireboxes and detections across WatchGuard-protected endpoints.
In Q2, 95.72% of endpoint malware alerts appeared on one machine; never-before-seen endpoint malware rose 2,065% year over year.
Network attack detections per Firebox fell about 79%, while unique IPS signatures increased from 381 to 410.
The median vulnerability referenced among the top 50 IPS signatures was disclosed in 2014; 31 of 44 CVE-referenced signatures involved flaws at least a decade old.
WatchGuard reports that 95% of network malware arrived over TLS, although only 20% of deployed Fireboxes inspect encrypted traffic. On devices with IAV and APT Blocker, 28% of detected malware evaded signature-based methods.
Behavioral and machine-learning engines accounted for over 67% of Q2 endpoint detections. Credential access led Q1 threat-hunting tactics, and process hollowing made up 77.1% of Q2 exploit-technique alerts.
The report recommends prioritizing patches for old, actively targeted flaws, retiring unsupported edge devices, improving TLS inspection, and strengthening Linux monitoring.

Article Details

Publisher: WatchGuard
Report Period: H1 2026
Scope: Global network and endpoint threat detections and public extortion claims.
Sample Size: Tens of thousands of opt-in Fireboxes; network attack regional analysis covered 3,858 IPS-enabled Fireboxes. Endpoint telemetry covered millions of protected endpoints.
Key Statistics: In Q2 2026, 95.72% of endpoint malware alerts involved a file or process observed on exactly one machine.
In H1 2026, 95% of detected network malware arrived over TLS, while 20% of deployed Fireboxes inspected encrypted traffic.
Average network attack detections fell from 845 per Firebox in H2 2025 to 181 in H1 2026, while the number of unique IPS signatures firing rose from 381 to 410.
Of the top 50 network attack signatures, 44 referenced specific CVEs; 31 of those targeted flaws at least a decade old, and the median disclosure year was 2014.
WatchGuard tracked 4,932 public extortion claims in H1 2026; the top eight groups accounted for 50.79% of claims, and 41 new groups appeared.
Recommendations: Enable TLS inspection where feasible and pair it with behavioral and machine-learning malware detection.
Prioritize patching based on exploitation evidence, inventory internet-facing legacy applications, and retire unsupported edge and security appliances.
Monitor Linux preload configuration and system calls, segment IoT devices, and investigate unexpected proxy traffic or CPU spikes.
Disable unused HTTP methods, monitor web-accessible directories for new executable files, and use parameterized queries and input validation.
Track attack reach as well as volume and enable layered IPS protections across network segments.

Indicators of compromise

Type	Indicator	Context
MD5	`213eca72f00563fa2ed788a1212c67e0`	Malicious sample attributed to the TamperedChef campaign in Q2 2026.
MD5	`2413b273c989c846441e9bcebbe0daba`	GuLoader sample detected on endpoints in Q1 2026.
MD5	`2b313ceea938698985abf3cb5daa8d7e`	Unidentified malicious dropper detected in Q1 2026.
MD5	`5261c38bfc6784e95285ad21e62f82fd`	Malicious sample attributed to the TamperedChef campaign in Q1 2026.
MD5	`7d9542ef7c46ed5e80c23153dd5319f2`	Conficker Worm sample detected in both Q1 and Q2 2026.
MD5	`a34ed3654424f72b99ff6da694d7388e`	Malicious sample attributed to the TamperedChef campaign in Q1 2026.
MD5	`a4f2c851f5d4336faa3f0955f9008326`	Coin miner dropper sample detected in Q1 2026.
MD5	`c379aff38f5f05429158a520d896a136`	Gh0stRAT sample detected in Q1 2026.
MD5	`c38f92b1484e0ffeb3c30402d7a6beac`	Floxif file-infector sample detected in Q2 2026.
MD5	`e2a2521cb16da1bed01565c503772125`	Conficker Worm sample detected in Q2 2026.
MD5	`f46329e59f449cdcd96a1d78b4e96f59`	GuLoader sample detected on endpoints in Q1 2026.
MD5	`f6bc17c61524935637887617e5752f88`	Malicious sample attributed to the TamperedChef campaign in Q2 2026.
URL	`hxxps[:]//cloud-onedriveid-bldc23amp[.]meetliaross[.]info/`	Phishing URL embedded in a malicious OneDrive-themed PDF; reported inactive at the time of analysis.