Q1 2026 malware statistics report for Windows web servers
April 14, 2026, 9:20 a.m.
Description
Analysis of Windows web server attacks during Q1 2026 reveals that Internet Information Services (IIS) and Apache Tomcat servers face persistent threats through web shell exploitation. The Larva-26001 threat actor has been targeting domestic IIS servers for several years, deploying privilege escalation tools including JuicyPotato, BadPotato, and exploiting CVE-2019-1458. Following privilege escalation, attackers utilize port-forwarding tools like HTran and PortTranC to redirect traffic to RDP port 3389, enabling remote control of compromised systems. Attack vectors include file upload vulnerabilities, Web Framework-WAS vulnerabilities, and unpatched RCE services. Additional malicious activities involve deployment of backdoors, CoinMiners, and proxy tools for internal network compromise.
Tags
Date
- Created: April 14, 2026, 8:53 a.m.
- Published: April 14, 2026, 8:53 a.m.
- Modified: April 14, 2026, 9:20 a.m.
Indicators
- aa0db29e00c33ba522540485b545ca0da7d2a7e8186f54a8a4dabd9438884c1d