Statistics Report on Malware Targeting Windows Web Servers in Q2 2025

AhnLab Security Intelligence Center analyzed attacks on Windows web servers during Q2 2025 using their Smart Defense infrastructure. The study focused on poorly managed servers, categorizing attack types and malware strains. It revealed that multiple threat actors often target vulnerable servers simultaneously, exploiting unpatched systems or misconfigurations. Attackers typically use file upload vulnerabilities to deploy web shells and execute commands, but may also exploit framework or Web Application Server weaknesses. The analysis provides detailed statistics on the number of affected systems and the frequency of attacks, offering insights into the current threat landscape for Windows-based web servers.

• NanaZip 6.5 · DoSMediumVulnerability2026-08-18
• Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPotCampaign2026-10-22
• Plex vulnerabilities being exploited in the wild to drop a cryptominerMalware2026-10-19
• NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779ExploitedMalware2026-10-20
• "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesCampaign2026-10-21