May 2026

In Q1 2026, ESET MDR telemetry showed how adversaries still hide in plain sight by abusing legitimate tools_built-in admin utilities (LOLBins), off-the-shelf remote monitoring and management (RMM) tools for persistence, Impacket for lateral movement, while also deploying EDR killer, tools to disable security protections before executing ransomware.

The Shai-Hulud 2.0 supply-chain attack continued to pop up in our MDR data. As before, many intrusions began with the exploitation of older vulnerabilities such as Log4Shell, but newcomers made their mark in our telemetry too. The most notable examples were React2Shell, and a former zero-day now tracked as CVE-2025-61882 in Oracle E-Business Suite. We observed no incidents in the ESET MDR dataset where generative AI played a significant role.

While ESET MDR customers are covered by our proactive, comprehensive protection, we publish this quarterly report to raise awareness and help others strengthen their security posture. To broaden the scope of the material, the Penetration Testing Advisory section highlights some of the most common mistakes seen in organizations assessed by ESET Services, with this edition focusing on mismanaged credentials.