Recorded Future H1 2026 Report: Actively Exploited CVEs Up 34%, Ransomware Adopts BYOVD and Post-Quantum Crypto
Recorded Future H1 2026 Report (TL-2026-2310), also tracked as Insikt Group H1 2026 Malware and Vulnerability Trends Report, is a high-severity tracked intrusion set, first published 2026-09-03. It is attributed to Interlock (China) with medium confidence, affects wshberlin Startklar Elementor Addons (WordPress plugin), references 5 CVEs (CVE-2024-4345, CVE-2021-26855, CVE-2026-20131), maps to 11 MITRE ATT&CK techniques (T1005, T1059.001, T1059.003), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-2310
- Threat ID
- TL-2026-2310
- Also known as
- Insikt Group H1 2026 Malware and Vulnerability Trends Report
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- 2026-09-03
- Last reviewed
- 2026-09-03
- Attribution
- Interlock
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- government administration, financial services, manufacturing, critical infrastructure, banking, telecoms
- Target regions
- united states of america, united kingdom, germany, brazil, italy, Europe
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Recorded Future H1 2026 Report
Malware and tooling: AsyncRAT, Cobalt Strike, Ghost RAT, NFCShare, NGate, Reynolds, pe32s, HandyPay
Recorded Future's Insikt Group tracked 215 actively exploited CVEs in H1 2026 (up 34% from 161 in H1 2025), 82% network-accessible and 38% exploited within 7 days of disclosure. Ransomware operators Reynolds (embedded BYOVD via the NSecKrnl driver, CVE-2025-68947) and pe32s (ML-KEM post-quantum key encapsulation) introduced new evasion techniques, Interlock exploited the critical Cisco Secure Firewall Management Center deserialization flaw CVE-2026-20131 five weeks before disclosure, and NFC-relay Android malware (NGate, NFCShare) drove a 188% rise in contactless-payment fraud attacks.
How Recorded Future H1 2026 Report works
Recorded Future's Insikt Group H1 2026 Malware and Vulnerability Trends report documents 215 CVEs confirmed as actively exploited in the wild between January and June 2026, a 34% increase over the 161 identified in H1 2025 (roughly 7 new actively-exploited vulnerabilities per month). Of these, 176 (82%) were network-accessible and 146 (68%) were exploitable without prior authentication; 142 of those 146 combined both properties. 82 involved remote code execution, and 60 RCE flaws combined network access with no authentication requirement. Only 66 (31%) had a public proof-of-concept, yet 81 (38%) were exploited within 7 days of disclosure and 20 (9%) on the day of disclosure itself, underscoring how little PoC availability now gates real-world exploitation timelines; median time-to-exploitation was 31 days. Microsoft led affected vendors with 40 CVEs (43% YoY growth), followed by Red Hat (15), Cisco (13), Vercel (11), and Fortinet (9).
This report is used here to ground five specific, independently verified vulnerabilities Recorded Future ties to active exploitation: CVE-2021-26855 (the ProxyLogon Microsoft Exchange Server SSRF, exploited by the actor RF designates SHADOW-EARTH-053, added to CISA KEV in November 2021), CVE-2023-27532 (Veeam Backup & Replication credential-disclosure flaw, CWE-306, added to CISA KEV in August 2023 and repeatedly abused by ransomware affiliates including The Gentlemen to reach backup infrastructure), CVE-2025-68947 (NSecsoft NSecKrnl Windows driver, CWE-862 missing authorization, published January 2026 and weaponized by the Reynolds ransomware operation), CVE-2026-20131 (Cisco Secure Firewall Management Center insecure deserialization of a user-supplied Java byte stream, CWE-502, CVSS 3.1 10.0, disclosed March 4 2026 and added to CISA KEV March 19 2026 after Amazon disclosed the Interlock ransomware group had been exploiting it unauthenticated since January 26 2026 for root-level RCE), and CVE-2024-4345 (an unrestricted-file-upload flaw, CWE-434, in the Startklar Elementor Addons WordPress plugin, published May 2024) — which Recorded Future's report text attributes to invoice-themed AsyncRAT/XWorm phishing against German manufacturers, though NVD's own record for that identifier describes only the WordPress plugin upload flaw with no phishing or German-manufacturing nexus documented; that discrepancy between the RF report's narrative attribution and the CVE's independently verifiable NVD record is preserved here rather than resolved by assumption.
The report's headline evasion development is Reynolds ransomware embedding a bring-your-own-vulnerable-driver (BYOVD) component directly inside its payload rather than staging it separately: Reynolds drops the legitimately-signed but vulnerable NSecsoft 'NSecKrnl' driver, registers it as a Windows service, and abuses CVE-2025-68947 to send crafted IOCTL requests that terminate protected processes belonging to Microsoft Defender, CrowdStrike, Sophos, Symantec, ESET, and Avast before encryption begins — eliminating Reynolds' dependency on a vulnerable driver already present on the victim host. Independent analysis places this after an extended reconnaissance/lateral-movement phase following an initially side-loaded loader, with a GotoHTTP remote-access tool deployed post-encryption for negotiation. Separately, the pe32s ransomware operation (file extension .pe32s) has adopted post-quantum cryptography for its encryption key material, explicitly to reduce the odds that future cryptographic advances let victims decrypt without paying; this mirrors the broader 2026 trend of ransomware operators (e.g., the unrelated Kyber group) publicizing NIST-standardized ML-KEM/Kyber1024 key encapsulation in ransom notes for psychological leverage, whether or not it changes practical decryption resistance versus AES-256.
On the mobile front, the report documents an 87% YoY rise in NFC-based Android attacks in H2 2025 accelerating to 188% growth January-April 2026, led by two distinct malware families independently confirmed by ESET and other researchers: NFCShare, distributed via bank-impersonation phishing (first Deutsche Bank, later pivoting in May 2026 to Intesa Sanpaolo, CaixaBank, Banca Sella, Nexi, and other European banking brands) that presents a fake card-verification screen to harvest the card PIN and relays NFC-derived payment-card data to a WebSocket C2 endpoint; and NGate, whose April 2026 variant trojanizes the legitimate HandyPay NFC-relay app (rather than the previously-abused NFCGate tool) to forward stolen card data to an attacker device for real-time ATM cash-out or POS fraud, with victim PINs exfiltrated separately over HTTP to a dedicated C2 server. The report also flags nascent AI-operator-assisted mobile malware (PromptSpy using Gemini to keep a malicious app pinned in the recent-apps list; PixRevolution targeting Brazil's PIX payment system with human-or-AI operator-in-the-loop screen monitoring) as early (AIM3 level 1-3) automation rather than fully autonomous operation.
MITRE ATT&CK techniques used in TL-2026-2310
Collection
T1005 Data from Local System; T1417.002 GUI Input Capture
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell
Command and Control
T1071.001 Web Protocols; T1437 Application Layer Protocol
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505.003 Web Shell; T1543.003 Windows Service
defense-impairment
Affected products and versions in Recorded Future H1 2026 Report
- wshberlin — Startklar Elementor Addons (WordPress plugin)
Vulnerable versions: <= 1.7.13
Fixed in: > 1.7.13 - Microsoft — Exchange Server
Vulnerable versions: Exchange Server 2013/2016/2019 pre-March 2021 CU
Fixed in: March 2021 Exchange Server cumulative security updates - Cisco — Secure Firewall Management Center (FMC)
Vulnerable versions: 6.4.0.13 through 10.0.0 (70+ releases)
Fixed in: Per Cisco advisory cisco-sa-fmc-rce-NKhnULJh - NSecsoft — NSecKrnl (Windows kernel driver)
Vulnerable versions: all versions
Fixed in: none published; mitigate via vulnerable-driver blocklist - Veeam — Backup & Replication
Vulnerable versions: < 11.0.1.1261; < 12.0.0.1420
Fixed in: 11.0.1.1261 (P20230227); 12.0.0.1420 (P20230223)
Remediation for Recorded Future H1 2026 Report
Patches
- Cisco Secure Firewall Management Center fixed releases per cisco-sa-fmc-rce-NKhnULJh (CVE-2026-20131)
- Veeam Backup & Replication 11.0.1.1261 / 12.0.0.1420 (CVE-2023-27532)
- Startklar Elementor Addons > 1.7.13 (CVE-2024-4345)
- Microsoft Exchange Server March 2021 cumulative security updates (CVE-2021-26855)
Immediate actions
- Patch Cisco Secure Firewall Management Center to the fixed release identified in Cisco advisory cisco-sa-fmc-rce-NKhnULJh for CVE-2026-20131; no workaround exists other than removing FMC management-interface internet exposure
- Add the NSecsoft NSecKrnl.sys driver hash/certificate to the Microsoft vulnerable driver blocklist (HVCI/WDAC) to block BYOVD loading used by Reynolds ransomware
- Patch Microsoft Exchange Server against CVE-2021-26855 (ProxyLogon) and hunt for historical webshell persistence on any still-unpatched host
- Patch Veeam Backup & Replication to 11.0.1.1261 (P20230227) / 12.0.0.1420 (P20230223) or later to close CVE-2023-27532 credential disclosure
- Update the Startklar Elementor Addons WordPress plugin beyond 1.7.13 to close the CVE-2024-4345 arbitrary file upload flaw
Workarounds
- For CVE-2026-20131: remove FMC management interface from public internet access to reduce attack surface pending patch
- Add NSecKrnl.sys to a kernel-mode driver blocklist / HVCI-enforced allowlist to prevent Reynolds' BYOVD load even without a vendor patch
Longer-term hardening
- Deploy EDR with tamper-protection/self-defense hardened against kernel-driver process-termination abuse, not just signature detection of known malicious drivers
- Block or monitor consumer NFC-relay apps (e.g., HandyPay) on managed devices and educate banking customers never to enter card PIN in response to an SMS/email prompt to 'verify' a card via NFC tap
- Restrict FMC and similar security-management-plane interfaces to out-of-band/management networks, never direct internet exposure
- Track CISA KEV additions and Recorded Future exploitation-velocity data to prioritize patching within the median 31-day and worst-case 7-day observed exploitation windows rather than standard patch-Tuesday cadences
CVEs associated with Recorded Future H1 2026 Report
CVE-2024-4345, CVE-2021-26855, CVE-2026-20131, CVE-2025-68947, CVE-2023-27532
Weaknesses (CWE) in Recorded Future H1 2026 Report
CWE-434, CWE-918, CWE-502, CWE-862, CWE-306
Timeline of Recorded Future H1 2026 Report
- CVE-2021-26855 (Microsoft Exchange ProxyLogon SSRF) added to CISA's Known Exploited Vulnerabilities catalog after exploitation by SHADOW-EARTH-053 and others
- CVE-2023-27532 published: Veeam Backup & Replication credential-disclosure flaw allowing access to backup infrastructure hosts
- CVE-2023-27532 added to CISA KEV catalog following repeated ransomware-affiliate abuse against backup infrastructure
- CVE-2024-4345 published: arbitrary file upload vulnerability in the Startklar Elementor Addons WordPress plugin
- NGate NFC-relay Android malware C2 server 108.165.230.223 first observed active
- NFCShare Android banking trojan first documented, distributed via Deutsche Bank-themed phishing harvesting NFC payment-card data and PINs
- CVE-2025-68947 published: NSecsoft NSecKrnl Windows driver missing-authorization flaw allowing termination of SYSTEM/Protected Processes via crafted IOCTL requests
- Interlock ransomware group begins exploiting unauthenticated CVE-2026-20131 against internet-exposed Cisco Secure Firewall Management Center instances, five weeks before public disclosure
- Cisco discloses CVE-2026-20131 (CVSS 3.1 10.0 insecure deserialization RCE in Secure Firewall Management Center) and publishes advisory cisco-sa-fmc-rce-NKhnULJh
- CVE-2026-20131 added to CISA KEV catalog after Amazon publicly reported Interlock's active exploitation
- New NGate variant trojanizes the legitimate HandyPay NFC-relay application to steal and relay payment-card data for ATM cash-out and POS fraud
- NFCShare operators pivot phishing lures to Italian and broader European banking brands including Intesa Sanpaolo, CaixaBank, and Banca Sella
- NFCShare campaign analysis published documenting 31+ trojanized banking-app samples and WebSocket C2 infrastructure
- Recorded Future Insikt Group H1 2026 Malware and Vulnerability Trends report closes its tracking window: 215 actively exploited CVEs (+34% YoY), Reynolds BYOVD and pe32s post-quantum encryption highlighted as new ransomware evasion techniques
Sources cited for Recorded Future H1 2026 Report
- H1 2026 Malware and Vulnerability Trends
- CVE-2026-20131: Cisco Secure Firewall RCE Vulnerability
- Cisco FMC flaw was exploited by Interlock weeks before patch was available
- Cisco Vulnerability CVE-2026-20131 Exploited by Interlock
- Reynolds Ransomware: BYOVD Evasion & NSecKrnl Abuse
- Reynolds Ransomware BYOVD Abuse of NSecKrnl.sys (CVE-2025-68947) for Kernel-Level Defense Evasion
- Reynolds ransomware uses BYOVD to disable security before encryption
- Reynolds Ransomware Exploits CVE-2025-68947 in NSecsoft NSecKrnl Driver to Disable Windows EDR/Security Tools
- CVE-2024-4345 Detail
- CVE-2025-68947 Detail
- CVE-2026-20131 Detail
- CVE-2023-27532 Detail
- New NGate variant hides in a trojanized NFC payment app
- New NFCShare Android Malware Delivered via Weaponized Versions of Banking Apps
- NFCShare Android Malware Spreads via Weaponized Banking Apps
More in threat intel
- Infostealer Logs Expose Replayable AI Session Tokens and API Keys Enabling MFA Bypass
- China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. Frontier AI Models
- Autonomous AI-agent frameworks automating credential theft and cyber espionage (Google Threat Intelligence Group Q3 2026 AI Threat Tracker)
- ClearFake WebDAV infection chain delivering Amatera stealer 4.1.5-alpha, ZigCryptoStealer, and NetSupport Manager 12.44 (UAT-10820)
- OpenAI GPT-6 Astra Reaches 'Critical' Cybersecurity Capability Threshold; Attempted Supply-Chain Attacks and Scope Violations Found in Safety Testing
Detection coverage for TL-2026-2310
As of 2026-09-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2310 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.