Recorded Future Reports 34% Rise in Actively Exploited CVEs in H1 2026
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Recorded Future identified 215 actively exploited CVEs in H1 2026, up 34% year over year. Its report highlights persistent RAT activity, developer supply-chain compromises, NFC payment fraud, and AI augmenting established attack methods.
Key points
- Insikt Group identified 215 actively exploited CVEs; 60 combined network accessibility, no authentication requirement, and remote code execution.
- Exploitation evidence preceded, coincided with, or followed NVD disclosure within seven days for 81 vulnerabilities; 53 exploited flaws predated 2025.
- AsyncRAT led the reviewed malware submissions with 59,507 unique hashes and 43,549 C2 configurations. The analysis excluded polymorphic, defunct, or seized families where recent reporting did not justify inclusion.
- The report assesses that most observed AI-enabled malware supported discrete tasks, including persistence and UI interaction, rather than fully autonomous attacks.
- Supply-chain campaigns abused package lifecycle scripts and stolen publishing tokens to harvest developer and CI/CD secrets and propagate through downstream packages.
- Android malware including NFCShare and NGate used social engineering and NFC functionality to steal payment-card information or relay transactions for payment fraud and ATM cash-outs.
- Recommended defenses include prioritizing exposed unauthenticated RCE flaws, correlating suspicious behavior across intrusion stages, protecting developer credentials, and maintaining isolated, tested recovery systems.
Article Details
- Publisher
- Recorded Future | Insikt Group
- Report Period
- 2026-01-01 to 2026-06-30
- Scope
- Actively exploited vulnerabilities, malware submissions, reported intrusions, supply-chain compromises, mobile fraud, and web skimming in H1 2026.
- Sample Size
- 215 actively exploited CVEs; exploitation details mapped to MITRE ATT&CK for 114. Total malware submission and TTP Instance populations not disclosed.
- Key Statistics
- Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025.
- Of 215 exploited CVEs, 142 were network-accessible and required no prior authentication; 60 of these also enabled remote code execution.
- 81 of 215 exploited CVEs (38%) had exploitation evidence before, on, or within seven days of NVD disclosure; the median disclosure-to-exploitation interval was 31 days.
- AsyncRAT ranked first in H1 2026 Malware Intelligence submissions with 59,507 unique hashes and 43,549 unique C2 configurations; submission volume does not directly measure infections.
- Public reporting cited a 188% increase in NFC-based Android attacks between January and April 2026.
- Recommendations
- Inventory internet-facing assets and prioritize patching network-accessible, unauthenticated code-execution vulnerabilities; apply access restrictions, segmentation, WAF rules, or IPS signatures when immediate patching is unavailable.
- Correlate exploitation, script execution, discovery, payload transfer, credential access, lateral movement, and outbound C2 telemetry rather than alerting on isolated events.
- Protect developer and CI/CD secrets, enforce least privilege for package publishing, review package lifecycle scripts, and monitor unauthorized repository creation and dependency changes.
- Restrict remote access tooling, monitor backup-service termination and recovery-inhibition activity, and maintain isolated, regularly tested recovery systems.
- Inventory payment-page scripts and integrations, maintain a strict CSP, and monitor checkout pages for unauthorized scripts, hidden SVG execution, counterfeit payment forms, and administrator-aware evasion.
MITRE ATT&CK
T1005 · Data from Local SystemData collection from local systems was associated with 36 mapped CVEs.T1027 · Obfuscated Files or InformationObfuscated files or information appeared in 201 TTP Instance references; compromised package payloads also used obfuscation.T1041 · Exfiltration Over C2 ChannelExfiltration over C2 channels was associated with 30 mapped CVEs.T1059 · Command and Scripting InterpreterCommand and scripting interpreters appeared in 320 H1 2026 TTP Instance references; Lazarus used command execution after exploiting React2Shell.T1059.001 · PowerShellPowerShell execution was associated with 32 mapped CVEs; Hive0163 also used a ClickFix lure to execute a malicious PowerShell command.T1059.003 · Windows Command ShellWindows Command Shell execution was associated with 31 mapped CVEs.T1059.004 · Unix ShellUnix Shell execution was associated with 31 mapped CVEs.T1071.001 · Web ProtocolsWeb protocols for command and control were associated with 30 mapped CVEs.T1082 · System Information DiscoverySystem information discovery was associated with 39 mapped CVEs and 180 references in H1 2026 TTP Instances.T1105 · Ingress Tool TransferIngress tool transfer was associated with 35 mapped CVEs; a DonutLoader campaign staged follow-on REMCOS RAT delivery.T1190 · Exploit Public-Facing ApplicationThe report associated exploitation of public-facing applications with 77 of 114 CVEs covered by detailed Insikt Group reporting.T1195.002 · Compromise Software Supply ChainCompromised npm publisher accounts and software packages distributed malicious lifecycle scripts to downstream developer and CI/CD environments.T1204 · User ExecutionUser execution appeared in 187 TTP Instance references; GlassWorm relied on developers installing trojanized extensions.T1490 · Inhibit System RecoveryReporting on The Gentlemen described stopping backup services and deleting shadow copies to inhibit victim recovery.T1505.003 · Web ShellWeb shells were associated with 28 mapped CVEs, all also linked to exploitation of public-facing applications.
CVE
CVE-2021-26855Separately, Mimikatz was also associated with the China-linked SHADOW-EARTH-053ʼs exploitation of CVE-2021-26855, which affected Microsoft Exchange Server.CVE-2023-27532references, scripts, and snippets related to extracting Veeam credentials, including references to CVE-2023-27532 affecting Veeam Backup & Replication. The same reporting described commands for creating accounts,CVE-2024-4345- Delivered via invoice-themed phishing targeting German manufacturing organizations that exploited CVE-2024-4345CVE-2025-68947it dropped the vulnerable NsecSoft NSecKrnl driver, registered it as a service, and exploited CVE-2025-68947 to terminate processes associated with security products, including Microsoft Defender, CrowdStrike,CVE-2026-20131- Threat actors deploying Interlock ransomware exploited a Cisco Secure Firewall Management Center zero-day (CVE-2026-20131) to execute code as root on unpatched devices
Threat Actors
APT37North Korean group used Facebook-based pretexting to lure targets into installing a tampered PDFelement installer delivering DOGCALL.Camaro DragonChina-nexus group reported deploying PlugX against Qatari targets.FrostyNeighborUsed spearphishing PDF lures impersonating a Ukrainian telecommunications provider to deliver PicassoLoader and subsequently Cobalt Strike.Hive0163Used a ClickFix clipboard lure to install NodeSnake through PowerShell; the operation also deployed Interlock RAT.KimsukyDistributed AsyncRAT through a multistage LNK infection chain hosted on GitHub and Dropbox.LazarusExploited React2Shell and executed commands to deploy COPPERHEDGE against financial and blockchain-related organizations.SHADOW-EARTH-053China-linked group associated with Mimikatz use following exploitation of CVE-2021-26855 in Microsoft Exchange Server.Storm-1175Described as China-linked; used exploitation, credential theft, remote execution, data-transfer tooling, and Medusa ransomware across a ten-CVE cluster.TeamPCPLinked to developer supply-chain compromises and credential theft. Socket assessed the SAP-related npm activity as linked to TeamPCP with medium confidence; Trend Micro attributed the LiteLLM compromise to the group.VerdantBambooObtained valid SSH credentials through a victim's managed service provider, exploited a sudo misconfiguration, and deployed BRICKSTORM on edge appliances.
Malware
AsyncRATRATs led Insikt Group malware reporting, and Recorded Future Malware Intelligence submissions identified AsyncRAT as the top submitted malware family by total unique hashes and command-and-control (C2) configurations.Gh0st RATAsyncRAT combined high sample volume with high C2 configuration diversity, while Cobalt Strike and Gh0st RAT generated large submission volumes but reused comparatively small sets of C2 configurations.MedusaTen CVEs were associated with the groupʼs use of Mimikatz, Impacket, PsExec, Rclone, and Medusa ransomware.NFCShare- **Android NFC malware was the most notable mobile malware trend in H1 2026**, with families such as NFCShare and NGate abusing device NFC functionality to steal payment card data, relay contactless transactions, andNGateNFC malware was the most notable mobile malware trend in H1 2026**, with families such as NFCShare and NGate abusing device NFC functionality to steal payment card data, relay contactless transactions, andPromptSpyESET identified PromptSpy as the first known Android malware to use generative AI (GenAI), using Googleʼs Gemini to interpret on-screen UI elements and generate step-by-step instructions to improve persistence acrossRemcos RATunique hashes and command-and-control (C2) configurations. AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS RAT remained in the top ten across H1 2025 and H1 2026.Shai-Hulud- Mini Shai-Hulud operators used Obfuscated Files or Information to complicate analysis and conceal malicious behavior within compromised developer workflows.XWormfamily by total unique hashes and command-and-control (C2) configurations. AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS RAT remained in the top ten across H1 2025 and H1 2026.
Vendors
CiscoRed Hat ranked second with fifteen CVEs, Cisco third with thirteen, Vercel fourth with eleven, and Fortinet fifth with nine.FortinetRed Hat ranked second with fifteen CVEs, Cisco third with thirteen, Vercel fourth with eleven, and Fortinet fifth with nine.Microsoft- [Microsoft Remains the Leading Vendor for Exploited Vulnerabilities](#microsoft-remains-the-leading-vendor-for-exploited-vulnerabilities)Red HatRed Hat ranked second with fifteen CVEs, Cisco third with thirteen, Vercel fourth with eleven, and Fortinet fifth with nine.VercelRed Hat ranked second with fifteen CVEs, Cisco third with thirteen, Vercel fourth with eleven, and Fortinet fifth with nine.
Products
Cisco Catalyst SD-WAN Managerunique CVEs, followed by Red Hat Enterprise Linux with thirteen, Vercel Next.js with eleven, Cisco Catalyst SD-WAN Manager with eight, and Apple iOS and iPadOS with seven.Cisco Secure Firewall Management Center- Threat actors deploying Interlock ransomware exploited a Cisco Secure Firewall Management Center zero-day (CVE-2026-20131) to execute code as root on unpatched devicesClaude Code- Distributed via a trojanized Claude Code installeriOSLinux with thirteen, Vercel Next.js with eleven, Cisco Catalyst SD-WAN Manager with eight, and Apple iOS and iPadOS with seven.iPadOSwith thirteen, Vercel Next.js with eleven, Cisco Catalyst SD-WAN Manager with eight, and Apple iOS and iPadOS with seven.LiteLLMIn March 2026, Trend Micro reported that TeamPCP compromised LiteLLM, an AI gateway used to connect applications with multiple large language model providers, and used the access to harvest API keys, cloud credentials,Microsoft WindowsAt the product-family level, Windows and Windows Server accounted for the largest H1 2026 concentration, with twenty unique CVEs, followed by Red Hat Enterprise Linux with thirteen, Vercel Next.js with eleven, CiscoNext.js2026 concentration, with twenty unique CVEs, followed by Red Hat Enterprise Linux with thirteen, Vercel Next.js with eleven, Cisco Catalyst SD-WAN Manager with eight, and Apple iOS and iPadOS with seven.Red Hat Enterprise LinuxServer accounted for the largest H1 2026 concentration, with twenty unique CVEs, followed by Red Hat Enterprise Linux with thirteen, Vercel Next.js with eleven, Cisco Catalyst SD-WAN Manager with eight, and AppleVeeam Backup & Replicationrelated to extracting Veeam credentials, including references to CVE-2023-27532 affecting Veeam Backup & Replication. The same reporting described commands for creating accounts, assigning database permissions inWindows ServerAt the product-family level, Windows and Windows Server accounted for the largest H1 2026 concentration, with twenty unique CVEs, followed by Red Hat Enterprise Linux with thirteen, Vercel Next.js with eleven, Cisco
Tools
Cobalt Strike- [Cobalt Strike Beacon and Stealware Most Frequently Associated with Post-Exploitation Activity](#cobalt-strike-beacon-and-stealware-most-frequently-associated-with-post-exploitation-activity)fscanIn the StrikeShark campaign, SharkLoader, Cobalt Strike Beacon, FScan, Searchall, Pillager Stealer, and SharpGPOAbuse were linked to the same thirteen CVEs.ImpacketTen CVEs were associated with the groupʼs use of Mimikatz, Impacket, PsExec, Rclone, and Medusa ransomware.MimikatzTen CVEs were associated with the groupʼs use of Mimikatz, Impacket, PsExec, Rclone, and Medusa ransomware.Nucleiremediation measures. With Vulnerability Intelligence, Recorded Future customers also gain access to Nuclei templates created by Insikt Group, enabling proactive scanning and rapid detection of emergingPsExecsocial engineering; exploitation of public-facing applications; abuse of legitimate tools such as s5cmd, PsExec, and AnyDesk; and techniques intended to reduce victimsʼ recovery options.RCloneTen CVEs were associated with the groupʼs use of Mimikatz, Impacket, PsExec, Rclone, and Medusa ransomware.s5cmdsocial engineering; exploitation of public-facing applications; abuse of legitimate tools such as s5cmd, PsExec, and AnyDesk; and techniques intended to reduce victimsʼ recovery options.SearchallIn the StrikeShark campaign, SharkLoader, Cobalt Strike Beacon, FScan, Searchall, Pillager Stealer, and SharpGPOAbuse were linked to the same thirteen CVEs.SharpGPOAbuseIn the StrikeShark campaign, SharkLoader, Cobalt Strike Beacon, FScan, Searchall, Pillager Stealer, and SharpGPOAbuse were linked to the same thirteen CVEs.
Countries
Brazil- In April 2026, a new NGate variant targeting Android users in Brazil trojanized the legitimate HandyPay NFC relay application. The malware relayed payment card NFC data to attacker-controlled devices to facilitateChinaSeparately, Mimikatz was also associated with the China-linked SHADOW-EARTH-053ʼs exploitation of CVE-2021-26855, which affected Microsoft Exchange Server.India- Delivered in an updated v1.1 campaign via a malicious Compiled HTML Help (CHM) file that targeted India's banking sector and South Korean government entitiesUnited States- Deployed using the ZPHP JavaScript loader, which was spread through ClickFix and fake CAPTCHA prompts targeting US state, local, tribal, and territorial (SLTT) government organizations
Industries
Banking- Delivered in an updated v1.1 campaign via a malicious Compiled HTML Help (CHM) file that targeted India's banking sector and South Korean government entitiesE-commercepayment interfaces, and administrator-aware evasion to conceal payment-card theft within legitimate e-commerce workflows.Government- Deployed using the ZPHP JavaScript loader, which was spread through ClickFix and fake CAPTCHA prompts targeting US state, local, tribal, and territorial (SLTT) government organizationsManufacturing- Delivered via invoice-themed phishing targeting German manufacturing organizations that exploited CVE-2024-4345SoftwareThreat actors used exposed software, developer tools, remote access utilities, payment workflows, and third-party services to gain access, steal credentials, move laterally, and monetize intrusions while blending into