Rapid7 Q2 2026 Threat Landscape Report: Vulnerability Disclosures Double, AI-Assisted Exploitation Compresses Patch Timelines

Key facts for Rapid7 Q2 2026 patch-cycle report

Detection coverage for Rapid7 Q2 2026 patch-cycle report

As of 2026-08-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2058 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LSASS Memory Access (Mimikatz-Pattern) with Adversary-in-the-Middle Token Theft

Detects processes opening lsass.exe with access rights consistent with Mimikatz-style credential dumping (T1003.001) — a technique Rapid7 reports as recurring across Q2 2026 IR engagements — correlated with adversary-in-the-middle token/session theft (T1557, T1528) enabled by APT28's compromise of SOHO/edge routers for DNS hijacking, and with obfuscated dumping-tool artifacts (T1027).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.001, T1557, T1528, T1027
• Data sources: sysmon, windows_security, dns_logs, o365_management_activity
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
TargetImage="*\\lsass.exe"
(GrantedAccess="0x1010" OR GrantedAccess="0x1410" OR GrantedAccess="0x1438" OR GrantedAccess="0x143a" OR GrantedAccess="0x1fffff")
NOT (SourceImage="*\\MsMpEng.exe" OR SourceImage="*\\Wdiag.exe")
| eval detection="lsass_credential_access"
| table _time, ComputerName, SourceImage, SourceProcessId, TargetImage, GrantedAccess, detection
| append
    [ search index=network sourcetype="dns" (record_type=A OR record_type=NS) src_category="soho_router"
      | stats count values(answer) as answers by _time, src_ip, query
      | eval detection="soho_dns_hijack_suspect" ]
| append
    [ search index=o365 sourcetype="o365:management:activity" (Operation="Add OAuth2PermissionGrant." OR Operation="Add service principal.")
      | eval detection="oauth_token_theft_suspect"
      | table _time, UserId, Operation, ClientIP, detection ]
| sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| join kind=inner (
    DeviceEvents
    | where ActionType == "ProcessAccess" and FileName =~ "lsass.exe"
    | where AdditionalFields has_any ("0x1010","0x1410","0x1438","0x143a","0x1fffff")
) on DeviceId
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, FileName
| union (
    SigninLogs
    | where TimeGenerated > ago(24h)
    | where ResultType == 0 and RiskLevelDuringSignIn in ("medium","high")
    | project Timestamp=TimeGenerated, DeviceName=IPAddress, InitiatingProcessFileName="AiTM_token_reuse", InitiatingProcessAccountName=UserPrincipalName, FileName=AppDisplayName
)
| sort by Timestamp desc

Sigma

title: LSASS Memory Access Consistent with Mimikatz Credential Dumping
id: 9c4b7d21-3e5a-4f8c-8b1a-2d6f9a0c5e17
status: experimental
description: Detects processes opening lsass.exe with access rights consistent with Mimikatz-style credential dumping, recurring in Q2 2026 IR engagements per Rapid7, often paired with adversary-in-the-middle token theft from compromised SOHO routers.
references:
    - https://www.rapid7.com/research/report/quarterly-threat-landscape-report/
    - https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-18
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1557
    - attack.t1528
    - attack.t1027
    - attack.tool.mimikatz
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess:
            - '0x1010'
            - '0x1410'
            - '0x1438'
            - '0x143a'
            - '0x1fffff'
    filter_av:
        SourceImage|endswith:
            - '\MsMpEng.exe'
            - '\Wdiag.exe'
    condition: selection and not filter_av
falsepositives:
    - Endpoint security and diagnostic tools that legitimately read LSASS memory (filter by an allowlist of known process paths)
    - Crash-dump utilities collecting a full process dump for a legitimate support case
level: high

Known false positives:

• Endpoint security and diagnostic tools that legitimately read LSASS memory
• Crash-dump utilities collecting a full process dump for a legitimate support case

Tuning notes: Maintain a process-path allowlist for EDR/AV vendors and legitimate dump tools that legitimately open LSASS with high access rights; raise the DNS-hijack sub-search to alert only when authoritative NS/A answers for a monitored domain change outside a maintenance window; require the OAuth-grant leg to correlate on the same UserId within 15 minutes of an LSASS hit before escalating to critical.

• 🔒 ClickFix Fake-CAPTCHA Paste-and-Run Initial Access Chain · unlock with TL Creds
• 🔒 LSASS Memory Access (Mimikatz-Pattern) with Adversary-in-the-Middle Token Theft · unlock with TL Creds
• 🔒 Web-Protocol C2 Beaconing, Ingress Tool Transfer & Unauthorized PLC Engineering Sessions · unlock with TL Creds
• 🔒 ClickFix Fake-CAPTCHA Paste-and-Run Initial Access Chain · unlock with TL Creds
• 🔒 LSASS Memory Access (Mimikatz-Pattern) with Adversary-in-the-Middle Token Theft · unlock with TL Creds
• 🔒 Web-Protocol C2 Beaconing, Ingress Tool Transfer & Unauthorized PLC Engineering Sessions · unlock with TL Creds
• 🔒 ClickFix Fake-CAPTCHA Paste-and-Run Initial Access Chain · unlock with TL Creds
• 🔒 Web-Protocol C2 Beaconing, Ingress Tool Transfer & Unauthorized PLC Engineering Sessions · unlock with TL Creds

Indicators of compromise for Rapid7 Q2 2026 patch-cycle report

As of 2026-08-18, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2058.

How Rapid7 Q2 2026 patch-cycle report works

The quarter's active-exploitation backdrop includes an APT28 (Forest Blizzard/Storm-2754) SOHO router DNS-hijacking campaign, a CyberAv3ngers (IRGC-linked) intrusion campaign against internet-exposed Rockwell Automation/Allen-Bradley PLCs, and Qilin leading ransomware activity with 263 victims, prompting Rapid7 to argue that blanket patch-cycle strategies can no longer keep pace with exposure-based risk.

Rapid7 Labs' Q2 2026 (April-June) Threat Landscape Report documents a structural shift in the vulnerability-exploitation relationship: 8,539 new high/critical (CVSS 7.0-10.0) CVEs were disclosed, nearly double the 4,268 disclosed in Q2 2025, while the count of vulnerabilities that actually saw new exploitation held roughly flat at 40. Of those 40 actively exploited flaws, 62% (25 of 40) required no user interaction to trigger, up from 53% a year earlier, and CWE-306 (Missing Authentication for Critical Function) exploitation rose 247% YoY (45 to 156 tracked instances), alongside a 50% YoY rise in CWE-89 (SQL Injection) exploitation (318 to 476). Public PoC availability for tracked flaws grew 76% YoY (153 to 270 instances), and Rapid7's dark-web monitoring found 124 exploit/access listings across 20 underground sources covering 23 actively traded CVEs, 87% of which had public PoCs and 39% of which were confirmed exploited in the wild. Rapid7 attributes the compression between disclosure and exploitation to attacker use of automation and AI-assisted tooling, and argues that traditional blanket patch-cycle strategies can no longer keep pace, urging defenders toward exposure-based prioritization instead.

The report's nation-state section names three concurrent, still-active campaigns from the quarter. Russian actor APT28 (tracked by Microsoft as Forest Blizzard/Storm-2754, and long known as Fancy Bear/Sofacy) compromised small office/home office (SOHO) edge routers, including TP-Link consumer/small-business models, to perform DNS hijacking and adversary-in-the-middle traffic interception, enabling credential and authentication-token theft; Microsoft and the UK NCSC jointly disclosed the campaign on 2026-04-07, reporting more than 200 organizations and roughly 5,000 consumer devices affected across government, IT, telecommunications and energy sectors, with confirmed adversary-in-the-middle activity against at least three African government organizations. Separately, Iranian IRGC Cyber Electronic Command (CEC)-linked actors tracked as CyberAv3ngers (aka Shahid Kaveh Group, Storm-0784, Bauxite, UNC5691) have, since at least March 2026, been directly accessing internet-exposed Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs) using the legitimate Rockwell Studio 5000 Logix Designer engineering software -- no zero-day exploitation was required -- to alter project-file logic and manipulate HMI/SCADA displays, overriding safe-operating-parameter instruction sets and causing operational disruption and financial loss across U.S. government-facilities, water/wastewater, and energy-sector victims. CISA/FBI/NSA/EPA/DOE/US Cyber Command issued advisory AA26-097A on this campaign on 2026-04-07 and updated it on 2026-07-22 to add Siemens and Schneider Electric PLCs to the warning; Censys separately catalogued 5,219 internet-exposed Rockwell/Allen-Bradley EtherNet/IP hosts globally, 74.6% of them in the United States. A North Korean APT cluster is referenced by Rapid7 alongside the Russian and Iranian activity as a third persistent nation-state threat this quarter, though the report does not attribute a specific named campaign to it.

On the ransomware side, Qilin led Q2 2026 activity with 263 listed victims, ahead of The Gentlemen (230), DragonForce (141), Akira (116) and LockBit (107), with INC Ransom, SafePay, RALord, KryBit and Coinbase Cartel also tracked. Business services (23.5%), healthcare (22.0%) and manufacturing (21.0%) were the hardest-hit ransomware sectors; the United States accounted for 881 of the quarter's listed ransomware victims (74.2%), roughly nine times Germany's 99 (8.3%), with the UK, Canada and Italy rounding out the top five and India and Thailand emerging as new affiliate targets. Initial-access telemetry across incident-response engagements shows fake-CAPTCHA/ClickFix paste-and-run social engineering behind 31.8% of incidents, alongside device-code phishing and authentication-broker abuse and social engineering delivered via trusted platforms such as Microsoft Teams. Post-exploitation, Rapid7 observed LSASS credential dumping (commonly via Mimikatz) as a recurring technique, and reported MITRE ATT&CK technique frequency counts of T1071.001 (Application Layer Protocol: Web Protocols, 90 observations), T1027 (Obfuscated Files or Information, 86 observations) and T1105 (Ingress Tool Transfer, 70 observations) across tracked intrusions.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1528 Steal Application Access Token; T1557 Adversary-in-the-Middle

Defense Evasion

T1027 Obfuscated Files or Information

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Initial Access

T1078 Valid Accounts; T1566 Phishing

Execution

T1204.001 User Execution: Malicious Link; T1204.004 User Execution: Malicious Copy and Paste

Resource Development

T1584.008 Compromise Infrastructure: Network Devices

Remediation for Rapid7 Q2 2026 patch-cycle report

Patches

• Apply vendor firmware updates to internet-exposed SOHO/edge routers (TP-Link and similar consumer/small-business models)
• Apply Rockwell Automation, Siemens and Schneider Electric PLC firmware and configuration hardening guidance issued with CISA AA26-097A

Immediate actions

• Remove internet-facing PLCs (Rockwell/Allen-Bradley, Siemens, Schneider Electric) from direct internet exposure per CISA AA26-097A
• Patch or replace vulnerable/EOL SOHO routers used for remote or hybrid work, and rotate credentials/tokens on any device suspected of DNS hijacking
• Prioritize patching for CVEs matching this quarter's exploited profile: no-user-interaction, missing-authentication (CWE-306) and SQL injection (CWE-89) flaws with public PoC
• Train users to recognize ClickFix/fake-CAPTCHA paste-and-run lures and device-code phishing prompts, especially via Microsoft Teams

Workarounds

• Disable remote/internet-facing management interfaces on PLCs and SOHO routers where patching is not immediately possible
• Block or monitor unsolicited clipboard-paste-into-Run-dialog and terminal execution patterns associated with ClickFix

Longer-term hardening

• Shift from calendar-based blanket patch cycles to exposure-based vulnerability prioritization as Rapid7 recommends
• Segment OT/ICS networks from IT and the public internet; restrict engineering software (e.g., Studio 5000 Logix Designer) access to trusted management networks
• Deploy phishing-resistant MFA (FIDO2/WebAuthn) to blunt AiTM and device-code-phishing credential theft
• Expand EDR coverage for LSASS access/credential-dumping detection given continued Mimikatz use in incident response engagements

Affected and fixed versions

• Rockwell Automation — Allen-Bradley Programmable Logic Controllers (PLCs)
  Vulnerable versions: Internet-exposed EtherNet/IP-enabled units accessible via Studio 5000 Logix Designer
• Siemens — Industrial control system PLCs
  Vulnerable versions: Internet-connected OT devices added to CISA AA26-097A in the 2026-07-22 update
• Schneider Electric — Industrial control system PLCs
  Vulnerable versions: Internet-connected OT devices added to CISA AA26-097A in the 2026-07-22 update
• TP-Link — SOHO home/small-office routers
  Vulnerable versions: Internet-exposed consumer/small-office router models compromised for DNS hijacking and AiTM

Timeline of Rapid7 Q2 2026 patch-cycle report

• 2026-03-01 CyberAv3ngers (Iranian IRGC CEC-linked actors) begin directly accessing internet-exposed Rockwell Automation/Allen-Bradley PLCs via Studio 5000 Logix Designer, per CISA advisory AA26-097A ('since at least March 2026').
• 2026-04-01 Start of the Q2 2026 quarter covered by Rapid7's Threat Landscape Report.
• 2026-04-07 Microsoft and the UK NCSC jointly disclose the APT28 (Forest Blizzard/Storm-2754) SOHO router DNS-hijacking and adversary-in-the-middle campaign, reporting 200+ organizations and ~5,000 consumer devices affected.
• 2026-04-07 CISA, FBI, NSA, EPA, DOE and US Cyber Command jointly publish advisory AA26-097A on Iranian-affiliated exploitation of internet-facing Rockwell/Allen-Bradley PLCs.
• 2026-06-30 End of the Q2 2026 quarter covered by Rapid7's Threat Landscape Report.
• 2026-07-22 FBI, CISA, NSA, EPA, DOE, US Cyber Command-CNMF and Treasury update advisory AA26-097A to add Siemens and Schneider Electric PLCs to the ongoing Iranian ICS/OT exploitation warning.
• 2026-08-18 Rapid7 Labs publishes the Q2 2026 Threat Landscape Report, arguing traditional blanket patch-cycle strategies can no longer keep pace with exposure-based risk.

Sources cited for Rapid7 Q2 2026 patch-cycle report

• Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A) CISA · Government advisory · 2026-04-07
• New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles Rapid7 · Vendor report · 2026-08-18
• Quarterly Threat Landscape Report Rapid7 · Vendor report · 2026-08-18
• SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks Microsoft · Vendor report · 2026-04-07
• Rapid7 Finds Nearly Two-Thirds of Vulnerabilities Exploited in Q2 2026 Required No User Interaction to Initiate manilatimes.net · News · 2026-08-18
• Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign The Hacker News · News · 2026-04-07
• US agencies update advisory on Iranian cyber campaign targeting internet-connected PLCs in critical infrastructure industrialcyber.co · News · 2026-07-22

Threats related to Rapid7 Q2 2026 patch-cycle report

• ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT 'BH Alert' Android Spyware Targeting Bahrain
• Iran-Linked CyberAv3ngers (BAUXITE) Exploiting Internet-Exposed Rockwell, Schneider Electric, and Siemens PLCs Across US Water, Energy, and Government Infrastructure (CISA AA26-097A)
• Forest Blizzard (Russian GRU Unit 26165) SOHO Router DNS-Hijacking Campaign Enables AitM Credential Theft Against Outlook Web Access — Operation Masquerade
• Sage Water Resources Utah saltwater disposal facility PLC intrusion — Iranian IRGC-CEC (CyberAv3ngers) logic manipulation bypasses pump safeguards

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors