Recorded Future's H1 2026 malicious software and vulnerability trends research confirms what many of us have been seeing in incident response engagements over the past 18 months: adversaries have largely abandoned noisy, signature-able tooling in favor of abusing what defenders already trust. The report highlights three converging trends that should be reshaping your detection engineering backlog right now — abuse of legitimate remote access and administrative tooling, AI-accelerated attack development and social engineering, and deliberate targeting of developer environments as an entry point for supply chain compromise. Add to that the continued dominance of encryption-based extortion events and a maturing mobile threat ecosystem, and you have a clear picture: the modern intrusion often never touches a file your EDR considers malicious.
This post breaks down the defensive implications of each trend and provides actionable detection content your SOC can deploy today. No CVEs are associated with this report — the lesson here is behavioral, not patch-based. If your security posture still depends primarily on vulnerability scan results and signature detections, you are defending against the threat model of 2022.
Technical Analysis: The Four Threat Vectors That Matter
1. Abuse of Trusted Tools (Living Off the Land and RMM Abuse)
The most operationally significant trend in the H1 2026 data is the systematic abuse of legitimate software — commercial remote monitoring and management (RMM) platforms, built-in Windows utilities, and cloud-native administration tools — to execute attacks that blend into baseline enterprise activity. Ransomware affiliates and initial access brokers have standardized on this approach because it defeats application allowlisting gaps, bypasses many EDR behavioral models, and inherits the trust of signed binaries.
From a defender's perspective, the attack chain typically looks like this: initial access via phishing or exposed remote services, followed by silent installation of an unauthorized RMM agent (ScreenConnect, AnyDesk, TeamViewer, or lesser-known alternatives), persistence via the RMM's own service, and hands-on-keyboard activity conducted entirely through the RMM's legitimate tunnel. Exfiltration frequently rides the same channel. The encryption event — when ransomware is the endgame — is often executed via renamed legitimate utilities or scripts pushed through the RMM console itself.
Defensive implication: You cannot blocklist your way out of this. You need an authoritative inventory of approved remote access tools, and every other instance of this software class in your environment is a detection opportunity by definition.
2. AI-Accelerated Adversary Operations
The report documents adversaries using generative AI across the intrusion lifecycle: producing near-flawless multilingual phishing lures that defeat both user heuristics and some email security NLP models, generating polymorphic script variants that evade static detection, and accelerating vulnerability research against target environments. The practical effect for defenders is twofold — higher-quality social engineering at scale, and faster time-to-exploit after vulnerability disclosure.
Defensive implication: User-reporting-based phishing detection is degrading as lure quality improves. Your compensating controls are downstream: detect the post-click behaviors (credential entry on lookalike domains, OAuth consent abuse, anomalous session creation) rather than relying on catching the lure itself.
3. Developer Environments and Supply Chain Compromise
Adversaries are deliberately targeting developer workstations, CI/CD pipelines, and package ecosystems. The H1 2026 research tracks continued malicious package publishing to npm and PyPI, theft of developer credentials and tokens from endpoints, and abuse of build systems to inject malicious code into legitimate software. The developer workstation is now a tier-zero asset: it holds source code, signing keys, deployment credentials, cloud tokens, and SSH keys to production infrastructure.
Defensive implication: Treat developer endpoints and build infrastructure with the same control rigor as domain controllers. Monitor for package manager processes spawning unexpected child processes, unexpected network egress from build agents, and credential store access by non-standard processes.
4. Encryption-Based Incidents and Mobile Threats
Ransomware and data-extortion events remain the most destructive incident class by business impact, with the report noting continued evolution toward partial-encryption and intermittent-encryption techniques that improve speed and evade some behavioral engines. Mobile threats — particularly SMS-delivered phishing (smishing) and malicious sideloaded applications — are increasingly used as the initial access vector against executives and finance staff, then pivoted into corporate environments through token theft and MFA fatigue techniques.
Detection & Response
The detections below target the highest-fidelity behavioral indicators from these trends: unauthorized RMM deployment, suspicious package manager execution chains consistent with malicious dependency behavior, and mass file-modification patterns associated with encryption events. Deploy them with environment-specific tuning — particularly the RMM rule, which requires you to define your approved tool list first.
Sigma Rules
---
title: Unauthorized Remote Monitoring and Management Tool Execution
id: 3f8a2c1d-7b4e-4f91-a6d2-9c5e8b1a3f07
status: experimental
description: Detects execution or installation of remote monitoring and management tools frequently abused by ransomware affiliates and initial access brokers. Tune the approved-tools exclusion to your environment before deployment.
references:
- https://www.recordedfuture.com/research/h1-2026-malware-vulnerability-trends
- https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/02/15
tags:
- attack.command_and_control
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_rmm:
Image|endswith:
- '\ScreenConnect.ClientService.exe'
- '\AnyDesk.exe'
- '\TeamViewer.exe'
- '\TeamViewer_Service.exe'
- '\AteraAgent.exe'
- '\SplashtopStreamer.exe'
- '\dwagent.exe'
- '\rustdesk.exe'
- '\netop.exe'
- '\level.exe'
selection_suspicious_path:
Image|contains:
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
- '\Users\Public\'
- '\ProgramData\'
- 'C:\PerfLogs\'
condition: selection_rmm and selection_suspicious_path
falsepositives:
- Legitimate IT support activity via approved RMM tooling running from standard install paths
- Software deployment tools staging agents in ProgramData
level: high
---
title: Package Manager Spawning Script Execution or Network Child Process
id: 8b2e4f6a-1c3d-4e58-b9a7-2d6f0c4e8a19
status: experimental
description: Detects npm, pip, or similar package managers spawning shells, script interpreters, or download utilities — behavior consistent with malicious package install scripts (preinstall/postinstall hooks) observed in supply chain attacks against developer environments.
references:
- https://www.recordedfuture.com/research/h1-2026-malware-vulnerability-trends
- https://attack.mitre.org/techniques/T1195/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/15
tags:
- attack.initial_access
- attack.t1195.002
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\npm.exe'
- '\npm.cmd'
- '\node.exe'
- '\pip.exe'
- '\python.exe'
- '\yarn.exe'
- '\pnpm.exe'
selection_child:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\cmd.exe'
- '\curl.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate build scripts and postinstall hooks in mature internal packages
- Node-gyp native compilation workflows
level: medium
---
title: Mass File Modification Consistent with Encryption or Wiper Activity
id: 5d7c9e2b-3a1f-4b68-c4d3-8e2a6f1b9c04
status: experimental
description: Detects a single process renaming or modifying a high volume of files in a short window, a hallmark of ransomware encryption including intermittent/partial encryption techniques noted in current extortion campaigns.
references:
- https://www.recordedfuture.com/research/h1-2026-malware-vulnerability-trends
- https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/02/15
tags:
- attack.impact
- attack.t1486
logsource:
category: file_rename
product: windows
detection:
selection:
TargetFilename|endswith:
- '.docx'
- '.xlsx'
- '.pdf'
- '.pptx'
- '.bak'
- '.sql'
- '.vmdk'
- '.zip'
filter_known_backup:
Image|endswith:
- '\Veeam.Backup.Service.exe'
- '\sqlservr.exe'
- '\MsMpEng.exe'
condition: selection and not filter_known_backup
falsepositives:
- Bulk file management tools, archive utilities, and backup agents not yet in the filter list
level: high
KQL Hunt — Microsoft Sentinel / Defender
This query hunts for unauthorized RMM tooling across process execution and network telemetry, then pivots to correlate with subsequent lateral movement or mass file activity. It assumes your approved RMM list is maintained in a watchlist named ApprovedRMMTools; if you do not use watchlists, replace that join with an inline dynamic array.
// Hunt: Unauthorized RMM execution and associated outbound C2-like sessions
let KnownRMMSigners = dynamic(["ScreenConnect", "AnyDesk", "TeamViewer", "Atera", "Splashtop", "DWService", "RustDesk", "NetSupport", "Level"]);
let RMMProcs =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName has_any (KnownRMMSigners)
or ProcessCommandLine has_any (KnownRMMSigners)
| where FolderPath has_any (@"\AppData\", @"\Users\Public\", @"\PerfLogs\", @"\Temp\")
| project DeviceName, TimeGenerated, FileName, FolderPath, ProcessCommandLine, AccountName, SHA256, ProcessId;
RMMProcs
| join kind=leftouter (
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| project DeviceName, TimeGenerated, InitiatingProcessId, RemoteIP, RemotePort, RemoteUrl
) on DeviceName, $left.ProcessId == $right.InitiatingProcessId
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteDestinations=make_set(RemoteIP, 20), Commands=make_set(ProcessCommandLine, 5)
by DeviceName, FileName, AccountName, SHA256
| extend Severity = iif(array_length(RemoteDestinations) > 0, "High — active outbound sessions", "Medium — process only")
| sort by FirstSeen asc
// Hunt: Malicious package install behavior on developer endpoints (Windows and Linux via Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("npm.exe", "npm.cmd", "node", "node.exe", "pip", "pip3", "python", "python3", "yarn", "pnpm")
| where FileName in~ ("powershell.exe", "pwsh", "cmd.exe", "curl", "curl.exe", "wget", "bash", "sh", "certutil.exe", "mshta.exe", "rundll32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| sort by TimeGenerated desc
Velociraptor VQL
Use this artifact to sweep your fleet for RMM binaries installed outside approved paths — a fast, high-signal forensic check after any intrusion where trusted-tool abuse is suspected, and a worthwhile quarterly proactive hunt.
-- Hunt: RMM and remote access binaries in non-standard install paths
-- Run across fleet; review hits against your approved software inventory
LET rmm_names <= '(?i)(screenconnect|anydesk|teamviewer|atera|splashtop|dwagent|rustdesk|netop|netsupport|level|pulseway|ninjarmm|kaseya|zohoassist)'
LET suspicious_roots <= '(?i)(users\\\\public|perflogs|appdata\\\\roaming|appdata\\\\local\\\\temp|programdata\\\\[^\\\\]*\\\\[^\\\\]*\.exe$)'
SELECT FullPath, Size, Mtime, Btime,
Authenticode.Authenticode AS Signed,
Authenticode.Subject AS Signer
FROM glob(globs='C:/Users/**.exe', accessor='ntfs')
WHERE FullPath =~ rmm_names
OR (FullPath =~ suspicious_roots AND Size > 1000000)
ORDER BY Mtime DESC
Verification and Hardening Script
The PowerShell below audits a Windows host for unauthorized remote access software (installed services, running processes, and common install locations) and checks whether LSA protection and attack surface reduction rules relevant to these threat classes are in place. Run it via your RMM or configuration management platform across the fleet, or interactively during IR triage.
# Security Arsenal — Trusted Tool Abuse & Ransomware Readiness Audit
# Run elevated. Review output before taking any remediation action.
$RMMNames = 'screenconnect','anydesk','teamviewer','atera','splashtop','dwagent','rustdesk','netop','netsupport','level','pulseway','ninjarmm','zohoassist'
$report = [ordered]@{}
# 1) Services matching known RMM tool names
$svcHits = Get-CimInstance Win32_Service | Where-Object {
$n = $_.Name + ' ' + $_.DisplayName + ' ' + $_.PathName
($RMMNames | ForEach-Object { $n -match $_ }) -contains $true
} | Select-Object Name, DisplayName, State, StartMode, PathName
$report['RMM_Services'] = $svcHits
# 2) Running processes matching RMM names outside Program Files
$procHits = Get-Process | Where-Object {
$_.Path -and (($RMMNames | ForEach-Object { $_.Path -match $_ }) -contains $true) -and
$_.Path -notmatch '^C:\\Program Files'
} | Select-Object Name, Id, Path
$report['RMM_Processes_NonStandardPath'] = $procHits
# 3) Recently created executables in high-risk staging directories
$stageDirs = @('C:\Users\Public','C:\PerfLogs',"$env:ProgramData")
$recentExe = foreach ($d in $stageDirs) {
if (Test-Path $d) {
Get-ChildItem $d -Recurse -Include *.exe -ErrorAction SilentlyContinue |
Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-14) } |
Select-Object FullName, CreationTime, Length
}
}
$report['Recent_EXE_Staging'] = $recentExe
# 4) LSA protection status (defense against credential theft post-compromise)
$lsa = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue
$report['LSA_Protected'] = ($null -ne $lsa -and $lsa.RunAsPPL -ge 1)
# 5) ASR rule state for ransomware-relevant rules (audit=2, block=1, off=0)
$asrKey = 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules'
$asrRules = @{
'd4f940ab-401b-4efc-aadc-ad5f3c50688a' = 'Block Office child processes'
'56a863a9-875e-4185-98a7-b882c64b5ce5' = 'Block abuse of exploited vulnerable signed drivers'
'c1db55ab-c21a-4637-bb3f-a12568109d35' = 'Ransomware protection (advanced)'
'e6db77e5-3df2-4cf1-b95a-636979351e5b' = 'Block persistence via WMI event subscription'
}
$asrState = foreach ($guid in $asrRules.Keys) {
$val = (Get-ItemProperty $asrKey -Name $guid -ErrorAction SilentlyContinue).$guid
[PSCustomObject]@{ Rule = $asrRules[$guid]; GUID = $guid; State = $(switch ($val) {1 {'Block'} 2 {'Audit'} 0 {'Off'} default {'Not Configured'}}) }
}
$report['ASR_Rules'] = $asrState
$report.GetEnumerator() | ForEach-Object {
Write-Host "\n=== $($_.Key) ===" -ForegroundColor Cyan
if ($_.Value) { $_.Value | Format-Table -AutoSize } else { Write-Host 'None found / not configured' }
}
Remediation and Hardening Guidance
1. Establish an approved remote access software inventory — this week. Enumerate every RMM and remote access tool legitimately used in your environment, document the expected install paths and signer certificates, and convert everything else into a detection. This single control converts the entire class of trusted-tool abuse from invisible to high-fidelity alert. Block execution of non-approved remote access tools via AppLocker or WDAC where operationally feasible.
2. Treat developer environments as tier-zero. Apply conditional access and phishing-resistant MFA (FIDO2/passkeys) to source control, CI/CD, package registries, and cloud consoles. Isolate build agents from production networks, restrict egress from CI runners to required endpoints only, and pin dependencies with lockfiles plus hash verification. Audit for long-lived personal access tokens and rotate them. Monitor package install scripts — preinstall/postinstall hooks executing shells are a primary supply chain payload delivery mechanism.
3. Compress your patch-and-mitigate cycle for internet-facing services. With AI accelerating adversary vulnerability research, the window between disclosure and exploitation continues to shrink. Prioritize edge devices, VPN concentrators, remote access infrastructure, and anything in the CISA Known Exploited Vulnerabilities catalog — track KEV additions weekly and treat them as remediation deadlines, not suggestions.
4. Harden against encryption events before they start. Enable LSA protection, deploy ASR rules (at minimum in audit mode, then promote), restrict lateral movement pathways (SMB/RDP/WinRM) between workstation segments, and verify that your backups are immutable and your restore process is tested — a restore that has never been rehearsed is a hope, not a control.
5. Extend phishing defense past the inbox. With AI-generated lures degrading user-based detection and mobile smishing targeting executives, implement lookalike-domain monitoring, OAuth consent policies that block unverified third-party app grants, and number-locking or equivalent controls on MFA to blunt token theft and MFA-fatigue pivots from mobile-compromised users.
6. Instrument behavioral detections, not just signatures. Deploy the Sigma and KQL content above, tune it against your approved-software inventory, and validate it in a tabletop or purple-team exercise. The adversaries described in the H1 2026 research are specifically counting on your detections being signature-oriented.
The Bottom Line
The defining characteristic of the H1 2026 threat landscape is trust exploitation — of your tools, your developers, and your users' judgment. None of these vectors are stopped by patching alone, and none of them reliably trigger traditional malware detection. The organizations that weather this era are the ones investing in behavioral detection engineering, rigorous software allowlisting with defined approved-tool inventories, and the unglamorous discipline of treating developer infrastructure as the crown jewels it actually is. Start with the RMM inventory. Everything else builds from there.
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.