# Recorded Future H1 2026 Report: Actively Exploited CVEs Up 34%, Ransomware Adopts BYOVD and Post-Quantum Crypto

> Recorded Future's Insikt Group tracked 215 actively exploited CVEs in H1 2026 (up 34% from 161 in H1 2025), 82% network-accessible and 38% exploited within 7 days of disclosure. Ransomware operators Reynolds (embedded BYOVD via the NSecKrnl driver, CVE-2025-68947) and pe32s (ML-KEM post-quantum key encapsulation) introduced new evasion techniques, Interlock exploited the critical Cisco Secure Firewall Management Center deserialization flaw CVE-2026-20131 five weeks before disclosure, and NFC-relay Android malware (NGate, NFCShare) drove a 188% rise in contactless-payment fraud attacks.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2310
- **ID:** TL-2026-2310
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Interlock (China)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-4345, CVE-2021-26855, CVE-2026-20131, CVE-2025-68947, CVE-2023-27532

## Description

Recorded Future's Insikt Group H1 2026 Malware and Vulnerability Trends report documents 215 CVEs confirmed as actively exploited in the wild between January and June 2026, a 34% increase over the 161 identified in H1 2025 (roughly 7 new actively-exploited vulnerabilities per month). Of these, 176 (82%) were network-accessible and 146 (68%) were exploitable without prior authentication; 142 of those 146 combined both properties. 82 involved remote code execution, and 60 RCE flaws combined network access with no authentication requirement. Only 66 (31%) had a public proof-of-concept, yet 81 (38%) were exploited within 7 days of disclosure and 20 (9%) on the day of disclosure itself, underscoring how little PoC availability now gates real-world exploitation timelines; median time-to-exploitation was 31 days. Microsoft led affected vendors with 40 CVEs (43% YoY growth), followed by Red Hat (15), Cisco (13), Vercel (11), and Fortinet (9).

This report is used here to ground five specific, independently verified vulnerabilities Recorded Future ties to active exploitation: CVE-2021-26855 (the ProxyLogon Microsoft Exchange Server SSRF, exploited by the actor RF designates SHADOW-EARTH-053, added to CISA KEV in November 2021), CVE-2023-27532 (Veeam Backup & Replication credential-disclosure flaw, CWE-306, added to CISA KEV in August 2023 and repeatedly abused by ransomware affiliates including The Gentlemen to reach backup infrastructure), CVE-2025-68947 (NSecsoft NSecKrnl Windows driver, CWE-862 missing authorization, published January 2026 and weaponized by the Reynolds ransomware operation), CVE-2026-20131 (Cisco Secure Firewall Management Center insecure deserialization of a user-supplied Java byte stream, CWE-502, CVSS 3.1 10.0, disclosed March 4 2026 and added to CISA KEV March 19 2026 after Amazon disclosed the Interlock ransomware group had been exploiting it unauthenticated since January 26 2026 for root-level RCE), and CVE-2024-4345 (an unrestricted-file-upload flaw, CWE-434, in the Startklar Elementor Addons WordPress plugin, published May 2024) — which Recorded Future's report text attributes to invoice-themed AsyncRAT/XWorm phishing against German manufacturers, though NVD's own record for that identifier describes only the WordPress plugin upload flaw with no phishing or German-manufacturing nexus documented; that discrepancy between the RF report's narrative attribution and the CVE's independently verifiable NVD record is preserved here rather than resolved by assumption.

The report's headline evasion development is Reynolds ransomware embedding a bring-your-own-vulnerable-driver (BYOVD) component directly inside its payload rather than staging it separately: Reynolds drops the legitimately-signed but vulnerable NSecsoft 'NSecKrnl' driver, registers it as a Windows service, and abuses CVE-2025-68947 to send crafted IOCTL requests that terminate protected processes belonging to Microsoft Defender, CrowdStrike, Sophos, Symantec, ESET, and Avast before encryption begins — eliminating Reynolds' dependency on a vulnerable driver already present on the victim host. Independent analysis places this after an extended reconnaissance/lateral-movement phase following an initially side-loaded loader, with a GotoHTTP remote-access tool deployed post-encryption for negotiation. Separately, the pe32s ransomware operation (file extension .pe32s) has adopted post-quantum cryptography for its encryption key material, explicitly to reduce the odds that future cryptographic advances let victims decrypt without paying; this mirrors the broader 2026 trend of ransomware operators (e.g., the unrelated Kyber group) publicizing NIST-standardized ML-KEM/Kyber1024 key encapsulation in ransom notes for psychological leverage, whether or not it changes practical decryption resistance versus AES-256.

On the mobile front, the report documents an 87% YoY rise in NFC-based Android attacks in H2 2025 accelerating to 188% growth January-April 2026, led by two distinct malware families independently confirmed by ESET and other researchers: NFCShare, distributed via bank-impersonation phishing (first Deutsche Bank, later pivoting in May 2026 to Intesa Sanpaolo, CaixaBank, Banca Sella, Nexi, and other European banking brands) that presents a fake card-verification screen to harvest the card PIN and relays NFC-derived payment-card data to a WebSocket C2 endpoint; and NGate, whose April 2026 variant trojanizes the legitimate HandyPay NFC-relay app (rather than the previously-abused NFCGate tool) to forward stolen card data to an attacker device for real-time ATM cash-out or POS fraud, with victim PINs exfiltrated separately over HTTP to a dedicated C2 server. The report also flags nascent AI-operator-assisted mobile malware (PromptSpy using Gemini to keep a malicious app pinned in the recent-apps list; PixRevolution targeting Brazil's PIX payment system with human-or-AI operator-in-the-loop screen monitoring) as early (AIM3 level 1-3) automation rather than fully autonomous operation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1543.003 Windows Service
- T1505.003 Web Shell
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1417.002 GUI Input Capture
- T1437 Application Layer Protocol

## Sources

- [H1 2026 Malware and Vulnerability Trends](https://www.recordedfuture.com/research/h1-2026-malware-vulnerability-trends)
- [CVE-2026-20131: Cisco Secure Firewall RCE Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-20131/)
- [Cisco FMC flaw was exploited by Interlock weeks before patch was available](https://www.helpnetsecurity.com/2026/03/20/cisco-fmc-interlock-ransomware-cve-2026-20131/)
- [Cisco Vulnerability CVE-2026-20131 Exploited by Interlock](https://www.esentire.com/security-advisories/cisco-vulnerability-cve-2026-20131-exploited-by-interlock)
- [Reynolds Ransomware: BYOVD Evasion & NSecKrnl Abuse](https://brandefense.io/blog/reynolds-ransomware-byovd-nseckrnl/)
- [Reynolds Ransomware BYOVD Abuse of NSecKrnl.sys (CVE-2025-68947) for Kernel-Level Defense Evasion](https://gurucul.com/blog/reynolds-ransomware-byovd-abuse-of-nseckrnl-sys-cve-2025-68947-for-kernel-level-defense-evasion/)
- [Reynolds ransomware uses BYOVD to disable security before encryption](https://securityaffairs.com/187869/security/reynolds-ransomware-uses-byovd-to-disable-security-before-encryption.html)
- [Reynolds Ransomware Exploits CVE-2025-68947 in NSecsoft NSecKrnl Driver to Disable Windows EDR/Security Tools](https://www.rescana.com/post/reynolds-ransomware-exploits-cve-2025-68947-in-nsecsoft-nseckrnl-driver-to-disable-windows-edr-secur/)
- [CVE-2024-4345 Detail](https://nvd.nist.gov/vuln/detail/cve-2024-4345)
- [CVE-2025-68947 Detail](https://nvd.nist.gov/vuln/detail/cve-2025-68947)
- [CVE-2026-20131 Detail](https://nvd.nist.gov/vuln/detail/cve-2026-20131)
- [CVE-2023-27532 Detail](https://nvd.nist.gov/vuln/detail/cve-2023-27532)
- [New NGate variant hides in a trojanized NFC payment app](https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/)
- [New NFCShare Android Malware Delivered via Weaponized Versions of Banking Apps](https://cybersecuritynews.com/new-nfcshare-android-malware-delivered-via-weaponized-versions/)
- [NFCShare Android Malware Spreads via Weaponized Banking Apps](https://gbhackers.com/nfcshare-android-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2310