Q2 2026 Statistical Report on Malware Targeting Windows Web Servers

## Executive Summary ASEC's Q2 2026 analysis reports widespread attacks against poorly managed Windows IIS and Tomcat servers where adversaries used uploaded web shells to escalate privileges, perform internal reconnaissance, move laterally, and deploy tools including LockBit 3.0, remote-access/proxy tools and miners; the report includes MD5s, malicious URLs and IPs as IOCs and recommends patching, stronger access controls, and updating antivirus.