Security Report · raw.githubusercontent.com

WatchGuard H1 2026 Report Finds More Novel Malware Despite Falling Network Detections

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

WatchGuard’s H1 2026 report found declining network detection volumes but rising novel endpoint malware. Nearly 96% of Q2 endpoint alerts involved a single machine, while older vulnerabilities and encrypted malware delivery remained prominent.

Key points

The report analyzes opt-in Firebox telemetry and WatchGuard-protected endpoints. Expanded MDR ingestion and endpoint detection coverage provide important context for comparisons.
Average malware detections per Firebox fell 28% from the previous half-year, while network exploit detections fell roughly 79%; the number of distinct IPS signatures detected increased from 381 to 410.
WatchGuard reported a 2,065% year-over-year increase in never-before-seen endpoint threats. In Q2, 95.72% of endpoint alerts involved exactly one machine, and behavioral or machine-learning engines accounted for over 67% of detections.
TLS connections carried 95% of detected network malware, but only 20% of deployed Fireboxes inspected encrypted traffic. Among devices using proactive detection engines, 28% of detected malware evaded signatures.
The median disclosure year for vulnerabilities referenced by the top 50 IPS signatures was 2014; none referenced flaws disclosed in 2025 or 2026. The report recommends addressing legacy patch backlogs and retiring unsupported appliances.
Credential access led Q1 threat-hunting activity, particularly browser password theft; Q2 shifted toward persistence through registry AutoStart keys and startup folders.
Endpoint ransomware detections rose 11.67% in Q1 and about 6% in Q2. WatchGuard tracked 4,932 public extortion claims and 41 newly appearing extortion groups during the half-year.

Article Details

Publisher: WatchGuard
Report Period: 2026-01-01 to 2026-06-30
Scope: Global network and endpoint threat telemetry, threat hunting detections, and public ransomware extortion claims.
Sample Size: Opt-in telemetry from tens of thousands of Fireboxes and millions of protected endpoints; network attack analysis included 3,858 IPS-enabled Fireboxes. The ransomware tracker recorded 4,932 public extortions.
Key Statistics: In H1 2026, 95% of network malware detections involved TLS-encrypted connections, while only 20% of deployed Fireboxes inspected encrypted traffic.
In Q2 2026, 95.72% of endpoint alert composition involved threats appearing on exactly one machine.
New endpoint threats per 100,000 active machines increased 21.57% from Q4 2025 to Q1 2026 and 8.01% into Q2; the report describes a 2065% year-over-year increase.
Among the top 50 IPS signatures, the median vulnerability disclosure year was 2014; 31 of 44 CVE-referenced signatures targeted vulnerabilities at least a decade old, and none referenced vulnerabilities disclosed in 2025 or 2026.
The tracker recorded 41 new extortion groups in H1 2026. The top eight groups accounted for 2,505 of 4,932 public extortions, or 50.79%; these are tracked public claims, not independently confirmed breaches.
Recommendations: Prioritize patching using exploitation evidence and CISA's Known Exploited Vulnerabilities catalog; inventory internet-facing legacy applications and retire unsupported edge and security appliances.
Enable TLS inspection and layered network malware protection, including behavioral and machine-learning detection; use EDR-grade behavioral protection on endpoints.
Monitor Linux systems using system-call or kernel-level visibility, inspect /etc/ld.so.preload for unexpected entries, and segment IoT and embedded devices from production networks.
Hunt for web shells using web-root file integrity monitoring, disable unused HTTP methods such as PUT, use parameterized queries and input validation, and maintain IPS coverage for web applications.
Require phishing-resistant MFA on remote access paths, discourage browser storage of corporate credentials, deploy a managed password manager, and investigate browser credential-store alerts as probable active intrusions.

Indicators of compromise

Type	Indicator	Context
MD5	`2413b973c989c846441ef9bcfbbf0dab`	Additional GuLoader sample listed in the endpoint malware hash table.
MD5	`5261c38bfc6784f95285ad21f62f82fd`	TamperedChef sample listed in the endpoint malware hash table.
MD5	`7d9542ef7c46ed5e80c23153dd5319f2`	Conficker Worm sample identified as W32/Conficker.C.worm in the endpoint malware hash table.
MD5	`a4f9c851f5d4336faa3f0955f9008326`	Coin Miner Dropper sample listed in the endpoint malware hash table.
MD5	`c38f92b1484e0ffeb3c30402d7a6beac`	Floxif sample listed in the endpoint malware hash table.
MD5	`f46329f59f449cdcd96a1d78b4f96f59`	GuLoader sample listed in the report's endpoint malware hash table.
URL	`hxxps[:]//cloud-onedriveid-bldc23amp[.]meetliaross[.]info/`	Phishing URL embedded in Docu-details1.pdf to steal Microsoft and OneDrive credentials or deliver malware; the report states the link was inactive at analysis time.