# Halcyon ROC Q2 2026: Business-Hours Initial Access and Vulnerable Drivers Dominating Privilege Escalation

> Halcyon's Q2 2026 Ransomware Operations Center (ROC) report finds vulnerable drivers accounted for 84.1% of privilege escalation activity, with nearly half of detections involving drivers on Microsoft's recommended block list. Initial access skews to business hours (74.6%), and about 70% of the fastest-impact events (within 4 hours) involved data exfiltration.

- **Published:** 2026-10-28T21:32:47Z
- **Last reviewed:** 2026-10-28T21:32:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4674
- **ID:** TL-2026-4674
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 3 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This entry summarizes aggregate ransomware-operations telemetry published by Halcyon (author Kevin Gee) on 2026-10-28 for Q2 2026. It is a trend report, not a single vulnerability or campaign: the source names no CVEs, threat actors, specific drivers, malware families or network indicators, and none are asserted here.

Stage coverage and early stops: Halcyon monitors seven attack stages - initial access, enumeration, credential harvesting, lateral movement, data exfiltration, encryption and data destruction. Nearly 99% of alerts analyzed were caught in the earliest stages of the attack chain. Only 1.2% reached lateral movement, exfiltration, encryption or destruction, and 100% of those advanced-stage attacks were stopped before business impact.

Timing: Business hours account for 63.3% of all alerts, and initial access has the heaviest business-hours weighting at 74.6%. Alert volume peaks at 11:00 a.m. local time. Encryption typically occurs after business hours when staff log off. Defenders should therefore not assume that off-hours monitoring alone covers the early intrusion stages, and that daytime activity blends with normal user traffic.

Speed of data theft: Approximately 70% of the fastest-impact events (within 4 hours) involved data exfiltration attempts, consistent with double extortion (encryption plus data theft) remaining prevalent. The report notes that backup-only recovery strategies remain exposed to extortion based on stolen data.

Vulnerable drivers: Vulnerable drivers accounted for 84.1% of all privilege escalation activity. The median environment carried two vulnerable drivers and roughly 16.7% (about 1 in 6) carried six or more. Nearly half of detections involved drivers on Microsoft's recommended block list, and the report highlights pre-installed hardware drivers already present on endpoints as a notable risk. Microsoft documents that the vulnerable driver blocklist is enabled by default since the Windows 11 2022 update, is enforced when HVCI/memory integrity, Smart App Control or S mode is active (except Windows Server 2016), and is updated quarterly; its ASR rule 'Block abuse of exploited vulnerable signed drivers' stops writing a vulnerable signed driver to disk but does not stop a driver already present from loading.

Defensive takeaways: inventory kernel drivers and compare them with Microsoft's recommended driver block rules, enable HVCI and the vulnerable driver blocklist, apply App Control policies in audit mode before enforcement, staff daytime triage for initial-access and enumeration alerts, and prioritize detection of bulk data staging and exfiltration inside the first four hours of an intrusion.

## MITRE ATT&CK

- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1021 Remote Services
- T1485 Data Destruction

## Sources

- [What the ROC Saw in Q2 2026: Early Stops, Daytime Attacks, and Drivers Already on the Endpoint](https://www.halcyon.ai/blog/what-the-roc-saw-in-q2-2026-early-stops-daytime-attacks-and-drivers-already-on-the-endpoint)
- [Microsoft recommended driver block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules)
- [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/)
- [MITRE ATT&CK T1068 Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068/)
- [MITRE ATT&CK T1562.001 Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
- [Microsoft Security Intelligence Driver Submission](https://www.microsoft.com/wdsi/driversubmission)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4674