# Rapid7 Q2 2026 Threat Landscape Report: Vulnerability Disclosures Double, AI-Assisted Exploitation Compresses Patch Timelines

> Rapid7 Labs' Q2 2026 Threat Landscape Report finds high/critical CVE disclosures nearly doubled year-over-year (8,539 vs 4,268) while missing-authentication (CWE-306) exploitation surged 247% YoY and 62% of newly exploited flaws required no user interaction. The quarter's active-exploitation backdrop includes an APT28 (Forest Blizzard/Storm-2754) SOHO router DNS-hijacking campaign, a CyberAv3ngers (IRGC-linked) intrusion campaign against internet-exposed Rockwell Automation/Allen-Bradley PLCs, and Qilin leading ransomware activity with 263 victims, prompting Rapid7 to argue that blanket patch-cycle strategies can no longer keep pace with exposure-based risk.

- **Published:** 2026-08-18T00:00:00Z
- **Last reviewed:** 2026-08-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2058
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-rapid7-q2-2026-patch-cycle-report-tl-2026-2058.webp?v=f3a1be73 (Threadlinqs threat intel: Rapid7 Q2 2026 Threat Landscape Report: Analysis & Hunting (TL-2026-2058) — High severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-2058
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17

## Description

Rapid7 Labs' Q2 2026 (April-June) Threat Landscape Report documents a structural shift in the vulnerability-exploitation relationship: 8,539 new high/critical (CVSS 7.0-10.0) CVEs were disclosed, nearly double the 4,268 disclosed in Q2 2025, while the count of vulnerabilities that actually saw new exploitation held roughly flat at 40. Of those 40 actively exploited flaws, 62% (25 of 40) required no user interaction to trigger, up from 53% a year earlier, and CWE-306 (Missing Authentication for Critical Function) exploitation rose 247% YoY (45 to 156 tracked instances), alongside a 50% YoY rise in CWE-89 (SQL Injection) exploitation (318 to 476). Public PoC availability for tracked flaws grew 76% YoY (153 to 270 instances), and Rapid7's dark-web monitoring found 124 exploit/access listings across 20 underground sources covering 23 actively traded CVEs, 87% of which had public PoCs and 39% of which were confirmed exploited in the wild. Rapid7 attributes the compression between disclosure and exploitation to attacker use of automation and AI-assisted tooling, and argues that traditional blanket patch-cycle strategies can no longer keep pace, urging defenders toward exposure-based prioritization instead.

The report's nation-state section names three concurrent, still-active campaigns from the quarter. Russian actor APT28 (tracked by Microsoft as Forest Blizzard/Storm-2754, and long known as Fancy Bear/Sofacy) compromised small office/home office (SOHO) edge routers, including TP-Link consumer/small-business models, to perform DNS hijacking and adversary-in-the-middle traffic interception, enabling credential and authentication-token theft; Microsoft and the UK NCSC jointly disclosed the campaign on 2026-04-07, reporting more than 200 organizations and roughly 5,000 consumer devices affected across government, IT, telecommunications and energy sectors, with confirmed adversary-in-the-middle activity against at least three African government organizations. Separately, Iranian IRGC Cyber Electronic Command (CEC)-linked actors tracked as CyberAv3ngers (aka Shahid Kaveh Group, Storm-0784, Bauxite, UNC5691) have, since at least March 2026, been directly accessing internet-exposed Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs) using the legitimate Rockwell Studio 5000 Logix Designer engineering software -- no zero-day exploitation was required -- to alter project-file logic and manipulate HMI/SCADA displays, overriding safe-operating-parameter instruction sets and causing operational disruption and financial loss across U.S. government-facilities, water/wastewater, and energy-sector victims. CISA/FBI/NSA/EPA/DOE/US Cyber Command issued advisory AA26-097A on this campaign on 2026-04-07 and updated it on 2026-07-22 to add Siemens and Schneider Electric PLCs to the warning; Censys separately catalogued 5,219 internet-exposed Rockwell/Allen-Bradley EtherNet/IP hosts globally, 74.6% of them in the United States. A North Korean APT cluster is referenced by Rapid7 alongside the Russian and Iranian activity as a third persistent nation-state threat this quarter, though the report does not attribute a specific named campaign to it.

On the ransomware side, Qilin led Q2 2026 activity with 263 listed victims, ahead of The Gentlemen (230), DragonForce (141), Akira (116) and LockBit (107), with INC Ransom, SafePay, RALord, KryBit and Coinbase Cartel also tracked. Business services (23.5%), healthcare (22.0%) and manufacturing (21.0%) were the hardest-hit ransomware sectors; the United States accounted for 881 of the quarter's listed ransomware victims (74.2%), roughly nine times Germany's 99 (8.3%), with the UK, Canada and Italy rounding out the top five and India and Thailand emerging as new affiliate targets. Initial-access telemetry across incident-response engagements shows fake-CAPTCHA/ClickFix paste-and-run social engineering behind 31.8% of incidents, alongside device-code phishing and authentication-broker abuse and social engineering delivered via trusted platforms such as Microsoft Teams. Post-exploitation, Rapid7 observed LSASS credential dumping (commonly via Mimikatz) as a recurring technique, and reported MITRE ATT&CK technique frequency counts of T1071.001 (Application Layer Protocol: Web Protocols, 90 observations), T1027 (Obfuscated Files or Information, 86 observations) and T1105 (Ingress Tool Transfer, 70 observations) across tracked intrusions.

## MITRE ATT&CK

- T1584.008 Compromise Infrastructure: Network Devices
- T1566 Phishing
- T1078 Valid Accounts
- T1204.004 User Execution: Malicious Copy and Paste
- T1204.001 User Execution: Malicious Link
- T1027 Obfuscated Files or Information
- T1557 Adversary-in-the-Middle
- T1003.001 OS Credential Dumping: LSASS Memory
- T1528 Steal Application Access Token
- T1071.001 Application Layer Protocol: Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**LSASS Memory Access (Mimikatz-Pattern) with Adversary-in-the-Middle Token Theft** (`TL-2026-2058-SPL-002`)

Detects processes opening lsass.exe with access rights consistent with Mimikatz-style credential dumping (T1003.001) — a technique Rapid7 reports as recurring across Q2 2026 IR engagements — correlated with adversary-in-the-middle token/session theft (T1557, T1528) enabled by APT28's compromise of SOHO/edge routers for DNS hijacking, and with obfuscated dumping-tool artifacts (T1027).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.001, T1557, T1528, T1027
- **Data sources:** sysmon, windows_security, dns_logs, o365_management_activity
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
TargetImage="*\\lsass.exe"
(GrantedAccess="0x1010" OR GrantedAccess="0x1410" OR GrantedAccess="0x1438" OR GrantedAccess="0x143a" OR GrantedAccess="0x1fffff")
NOT (SourceImage="*\\MsMpEng.exe" OR SourceImage="*\\Wdiag.exe")
| eval detection="lsass_credential_access"
| table _time, ComputerName, SourceImage, SourceProcessId, TargetImage, GrantedAccess, detection
| append
    [ search index=network sourcetype="dns" (record_type=A OR record_type=NS) src_category="soho_router"
      | stats count values(answer) as answers by _time, src_ip, query
      | eval detection="soho_dns_hijack_suspect" ]
| append
    [ search index=o365 sourcetype="o365:management:activity" (Operation="Add OAuth2PermissionGrant." OR Operation="Add service principal.")
      | eval detection="oauth_token_theft_suspect"
      | table _time, UserId, Operation, ClientIP, detection ]
| sort - _time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| join kind=inner (
    DeviceEvents
    | where ActionType == "ProcessAccess" and FileName =~ "lsass.exe"
    | where AdditionalFields has_any ("0x1010","0x1410","0x1438","0x143a","0x1fffff")
) on DeviceId
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, FileName
| union (
    SigninLogs
    | where TimeGenerated > ago(24h)
    | where ResultType == 0 and RiskLevelDuringSignIn in ("medium","high")
    | project Timestamp=TimeGenerated, DeviceName=IPAddress, InitiatingProcessFileName="AiTM_token_reuse", InitiatingProcessAccountName=UserPrincipalName, FileName=AppDisplayName
)
| sort by Timestamp desc
```

### Sigma

```yaml
title: LSASS Memory Access Consistent with Mimikatz Credential Dumping
id: 9c4b7d21-3e5a-4f8c-8b1a-2d6f9a0c5e17
status: experimental
description: Detects processes opening lsass.exe with access rights consistent with Mimikatz-style credential dumping, recurring in Q2 2026 IR engagements per Rapid7, often paired with adversary-in-the-middle token theft from compromised SOHO routers.
references:
    - https://www.rapid7.com/research/report/quarterly-threat-landscape-report/
    - https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-18
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1557
    - attack.t1528
    - attack.t1027
    - attack.tool.mimikatz
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess:
            - '0x1010'
            - '0x1410'
            - '0x1438'
            - '0x143a'
            - '0x1fffff'
    filter_av:
        SourceImage|endswith:
            - '\MsMpEng.exe'
            - '\Wdiag.exe'
    condition: selection and not filter_av
falsepositives:
    - Endpoint security and diagnostic tools that legitimately read LSASS memory (filter by an allowlist of known process paths)
    - Crash-dump utilities collecting a full process dump for a legitimate support case
level: high
```

**Known false positives:**

- Endpoint security and diagnostic tools that legitimately read LSASS memory
- Crash-dump utilities collecting a full process dump for a legitimate support case

**Tuning notes:** Maintain a process-path allowlist for EDR/AV vendors and legitimate dump tools that legitimately open LSASS with high access rights; raise the DNS-hijack sub-search to alert only when authoritative NS/A answers for a monitored domain change outside a maintenance window; require the OAuth-grant leg to correlate on the same UserId within 15 minutes of an LSASS hit before escalating to critical.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix Fake-CAPTCHA Paste-and-Run Initial Access Chain (locked: unlock with TL Creds)
- LSASS Memory Access (Mimikatz-Pattern) with Adversary-in-the-Middle Token Theft (locked: unlock with TL Creds)
- Web-Protocol C2 Beaconing, Ingress Tool Transfer & Unauthorized PLC Engineering Sessions (locked: unlock with TL Creds)
- ClickFix Fake-CAPTCHA Paste-and-Run Initial Access Chain (locked: unlock with TL Creds)
- LSASS Memory Access (Mimikatz-Pattern) with Adversary-in-the-Middle Token Theft (locked: unlock with TL Creds)
- Web-Protocol C2 Beaconing, Ingress Tool Transfer & Unauthorized PLC Engineering Sessions (locked: unlock with TL Creds)
- ClickFix Fake-CAPTCHA Paste-and-Run Initial Access Chain (locked: unlock with TL Creds)
- Web-Protocol C2 Beaconing, Ingress Tool Transfer & Unauthorized PLC Engineering Sessions (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles](https://www.rapid7.com/blog/post/tr-new-report-ai-threats-q2-2026-ends-traditional-patch-cycles)
- [Quarterly Threat Landscape Report](https://www.rapid7.com/research/report/quarterly-threat-landscape-report/)
- [Rapid7 Finds Nearly Two-Thirds of Vulnerabilities Exploited in Q2 2026 Required No User Interaction to Initiate](https://www.manilatimes.net/2026/08/18/tmt-newswire/globenewswire/rapid7-finds-nearly-two-thirds-of-vulnerabilities-exploited-in-q2-2026-required-no-user-interaction-to-initiate/2407693)
- [Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks](https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/)
- [Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign](https://thehackernews.com/2026/04/russian-state-linked-apt28-exploits.html)
- [US agencies update advisory on Iranian cyber campaign targeting internet-connected PLCs in critical infrastructure](https://industrialcyber.co/control-device-security/us-agencies-update-advisory-on-iranian-cyber-campaign-targeting-internet-connected-plcs-in-critical-infrastructure/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2058