Threat reportThreat IntelligenceTL-2026-4674
Halcyon ROC Q2 2026: Business-Hours Initial Access and Vulnerable Drivers Dominating Privilege Escalation
Halcyon ROC Q2 2026 (TL-2026-4674), also tracked as Halcyon ROC Q2 2026 Quarterly Ransomware Operations Report, is a medium-severity tracked intrusion set, first published 2026-10-28. It has no confirmed attribution, affects Microsoft Windows endpoints with vulnerable kernel drivers installed, maps to 4 MITRE ATT&CK techniques (T1003, T1021, T1485), and is covered by 9 detection rules and 3 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 3Indicators of compromise
Key facts for TL-2026-4674
- Threat ID
- TL-2026-4674
- Also known as
- Halcyon ROC Q2 2026 Quarterly Ransomware Operations Report
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 3
How Halcyon ROC Q2 2026 works
Halcyon's Q2 2026 Ransomware Operations Center (ROC) report finds vulnerable drivers accounted for 84.1% of privilege escalation activity, with nearly half of detections involving drivers on Microsoft's recommended block list. Initial access skews to business hours (74.6%), and about 70% of the fastest-impact events (within 4 hours) involved data exfiltration.
This entry summarizes aggregate ransomware-operations telemetry published by Halcyon (author Kevin Gee) on 2026-10-28 for Q2 2026. It is a trend report, not a single vulnerability or campaign: the source names no CVEs, threat actors, specific drivers, malware families or network indicators, and none are asserted here.
Stage coverage and early stops: Halcyon monitors seven attack stages - initial access, enumeration, credential harvesting, lateral movement, data exfiltration, encryption and data destruction. Nearly 99% of alerts analyzed were caught in the earliest stages of the attack chain. Only 1.2% reached lateral movement, exfiltration, encryption or destruction, and 100% of those advanced-stage attacks were stopped before business impact.
Timing: Business hours account for 63.3% of all alerts, and initial access has the heaviest business-hours weighting at 74.6%. Alert volume peaks at 11:00 a.m. local time. Encryption typically occurs after business hours when staff log off. Defenders should therefore not assume that off-hours monitoring alone covers the early intrusion stages, and that daytime activity blends with normal user traffic.
Speed of data theft: Approximately 70% of the fastest-impact events (within 4 hours) involved data exfiltration attempts, consistent with double extortion (encryption plus data theft) remaining prevalent. The report notes that backup-only recovery strategies remain exposed to extortion based on stolen data.
Vulnerable drivers: Vulnerable drivers accounted for 84.1% of all privilege escalation activity. The median environment carried two vulnerable drivers and roughly 16.7% (about 1 in 6) carried six or more. Nearly half of detections involved drivers on Microsoft's recommended block list, and the report highlights pre-installed hardware drivers already present on endpoints as a notable risk. Microsoft documents that the vulnerable driver blocklist is enabled by default since the Windows 11 2022 update, is enforced when HVCI/memory integrity, Smart App Control or S mode is active (except Windows Server 2016), and is updated quarterly; its ASR rule 'Block abuse of exploited vulnerable signed drivers' stops writing a vulnerable signed driver to disk but does not stop a driver already present from loading.
Defensive takeaways: inventory kernel drivers and compare them with Microsoft's recommended driver block rules, enable HVCI and the vulnerable driver blocklist, apply App Control policies in audit mode before enforcement, staff daytime triage for initial-access and enumeration alerts, and prioritize detection of bulk data staging and exfiltration inside the first four hours of an intrusion.
MITRE ATT&CK techniques used in TL-2026-4674
Credential Access
Lateral Movement
Impact
defense-impairment
Affected products and versions in Halcyon ROC Q2 2026
- Microsoft — Windows endpoints with vulnerable kernel drivers installed
Vulnerable versions: Systems carrying drivers on Microsoft's recommended driver block list
Fixed in: Vulnerable driver blocklist enforced (HVCI, Smart App Control, S mode or App Control policy) or driver updated to a fixed version
Remediation for Halcyon ROC Q2 2026
Patches
- Update drivers to vendor-fixed versions, then request blocklist rule updates via the Microsoft Security Intelligence portal where applicable
Immediate actions
- Enable the Microsoft vulnerable driver blocklist and confirm it is active (CodeIntegrity Operational log event 3099 shows the applied policy)
- Enable the Attack Surface Reduction rule 'Block abuse of exploited vulnerable signed drivers'
- Inventory loaded kernel drivers and compare against Microsoft's recommended driver block rules
- Staff alert triage during business hours, when 74.6% of initial access and the 11:00 a.m. alert peak occur
Workarounds
- On systems where HVCI cannot be enabled, block the recommended driver list within an existing App Control for Business policy
Longer-term hardening
- Enable HVCI (memory integrity) fleet-wide; it enforces the vulnerable driver blocklist on supported Windows versions
- Deploy the recommended driver blocklist through App Control for Business, validating in audit mode before enforcement
- Remove or update unneeded pre-installed hardware drivers, including the six-plus driver outliers
- Monitor for bulk data staging and exfiltration within the first 4 hours of an intrusion
- Do not rely on backup-only recovery; plan for double-extortion data theft
Timeline of Halcyon ROC Q2 2026
- Microsoft announces the Vulnerable and Malicious Driver Reporting Center to improve kernel security and feed the driver blocklist
- Start of the Q2 2026 period covered by Halcyon's ROC telemetry (calendar quarter)
- Microsoft's recommended driver block rules documentation carries a 2026-05-01 revision date
- End of the Q2 2026 period covered by Halcyon's ROC telemetry (calendar quarter)
- Microsoft's recommended driver block rules page last updated
- Halcyon publishes the Q2 2026 ROC findings: vulnerable drivers account for 84.1% of privilege escalation activity and 74.6% of initial access occurs during business hours
Sources cited for Halcyon ROC Q2 2026
- What the ROC Saw in Q2 2026: Early Stops, Daytime Attacks, and Drivers Already on the Endpoint
- Microsoft recommended driver block rules
- Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center
- MITRE ATT&CK T1068 Exploitation for Privilege Escalation
- MITRE ATT&CK T1562.001 Impair Defenses: Disable or Modify Tools
- Microsoft Security Intelligence Driver Submission
Detection coverage for TL-2026-4674
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4674 across Splunk SPL, Microsoft KQL and Sigma, covering 3 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.