# T0819 Exploit Public-Facing Application > As of 2026-10-24, T0819 (Exploit Public-Facing Application) appears in 10 tracked threats, first reported 2024-12-16 and most recently 2026-10-24, with linked actors including Cyber Av3ngers, Static Tundra; it most often appears alongside T1190 (Exploit Public-Facing Application). - **Tracked threats:** 10 (3 critical, 6 high, 1 medium) - **First seen:** 2024-12-16 - **Last seen:** 2026-10-24 - **Threat actors:** 2 - **Detection rules:** 21 (counts only; Blue tier and above) ## Key facts - **ID:** T0819 - **Framework:** MITRE ATT&CK - **Tactics:** Initial Access (ICS) - **Matrix:** ICS - **Data as of:** 2026-10-24 - **MITRE:** https://attack.mitre.org/techniques/T0819/ ## Activity timeline T0819 first appeared in tracked threats on 2024-12-16 and was most recently reported on 2026-10-24. The busiest month was 2026-10 with 3 reports, and 9 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T0819 Exploit Public-Facing Application is catalogued by MITRE ATT&CK under the Initial Access (ICS) tactic in the ICS matrix. Threadlinqs maps 10 of 3210 tracked threats (0.3%) to it; by severity that is 3 critical, 6 high, 1 medium. Threats that use T0819 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (9 threats), [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (6 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (5 threats), [T0859 Valid Accounts](https://intel.threadlinqs.com/technique/T0859) (4 threats), [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078) (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 2 tracked threat actors appear in the threats that use T0819; the most frequent are [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) (2), [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) (1). ## Threat actors using it - [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) — 2 - [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) — 1 ## Tracked threats 10 tracked threats use T0819. - [CVE-2026-21659 - Johnson Controls Frick Controls Quantum HD Unauthenticated Local File Inclusion Leading to…](https://intel.threadlinqs.com/threat/TL-2026-4352) — high — 2026-10-24 - [CVE-2026-25196: Copeland XWEB Pro OS Command Injection via Wi-Fi SSID/Password Fields (Authenticated RCE)](https://intel.threadlinqs.com/threat/TL-2026-3586) — high — 2026-10-15 - [CVE-2026-21659 - Johnson Controls Frick Controls Quantum HD Unauthenticated Arbitrary Code Execution via…](https://intel.threadlinqs.com/threat/TL-2026-3572) — high — 2026-10-15 - [CVE-2026-42542: TDengine unauthenticated integer underflow lets a single RPC packet crash taosd](https://intel.threadlinqs.com/threat/TL-2026-2746) — high — 2026-09-28 - [ORB Networks and Nation-State CNI Targeting: Destructive Wiper Attack on Polish Energy Infrastructure via…](https://intel.threadlinqs.com/threat/TL-2026-2317) — high — 2026-09-03 - [AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-2076) — critical — 2026-08-19 - [ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT…](https://intel.threadlinqs.com/threat/TL-2026-1659) — high — 2026-07-23 - [NCSC CEO Richard Horne: Hostile States Linked to Three-Quarters of Cyber Attacks on UK Critical National…](https://intel.threadlinqs.com/threat/TL-2026-2239) — medium — 2026-06-17 - [Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A)](https://intel.threadlinqs.com/threat/TL-2026-0335) — critical — 2026-04-08 - [CVE-2024-49775: Unauthenticated Heap-Based Buffer Overflow in Siemens User Management Component (UMC)…](https://intel.threadlinqs.com/threat/TL-2026-2488) — critical — 2024-12-16 ## Related CVEs CVEs referenced by the tracked threats that use T0819, most frequent first. - [CVE-2021-22681](https://intel.threadlinqs.com/cve/CVE-2021-22681) - [CVE-2020-15782](https://intel.threadlinqs.com/cve/CVE-2020-15782) - [CVE-2020-15791](https://intel.threadlinqs.com/cve/CVE-2020-15791) - [CVE-2022-38465](https://intel.threadlinqs.com/cve/CVE-2022-38465) - [CVE-2024-33698](https://intel.threadlinqs.com/cve/CVE-2024-33698) - [CVE-2024-49775](https://intel.threadlinqs.com/cve/CVE-2024-49775) - [CVE-2024-54678](https://intel.threadlinqs.com/cve/CVE-2024-54678) - [CVE-2025-24811](https://intel.threadlinqs.com/cve/CVE-2025-24811) - [CVE-2025-27127](https://intel.threadlinqs.com/cve/CVE-2025-27127) - [CVE-2025-40759](https://intel.threadlinqs.com/cve/CVE-2025-40759) - [CVE-2025-40943](https://intel.threadlinqs.com/cve/CVE-2025-40943) - [CVE-2026-15105](https://intel.threadlinqs.com/cve/CVE-2026-15105) - [CVE-2026-42542](https://intel.threadlinqs.com/cve/CVE-2026-42542) - [CVE-2026-51218](https://intel.threadlinqs.com/cve/CVE-2026-51218) ## Detection coverage Threadlinqs maintains 21 detection rules mapped to T0819 (SPL 8, KQL 4, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only. 21 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T0819 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)