ATT&CK Technique · Initial Access
T1190 Exploit Public-Facing ApplicationMapped by 11 reports, 48 detection rules and 7 tracked actors on The Hunters Ledger. Technique page on attack.mitre.org.
← All techniques and the coverage heatmap
Reports
Each report maps this technique in its own ATT&CK table, at the confidence the report states. The link opens that table.
Report
AdvancedRouterScanner
Detection rules
Rules whose ATT&CK coverage line names this technique, by detection page. The link opens the page's coverage table.
Detection rules
Gotenberg CVE-2026-42589 Mass Exploitation and CryptominingGotenberg ExifTool Metadata Key CVE-2026-42589 Injection Attempt (SIGMA, Detection); ExifTool Invoked With Condition Option Executing Shell Commands (SIGMA, Detection); Gotenberg Metadata-Write Endpoint Anomalous Latency (Possible CVE-2026-42589) (SIGMA, Hunting); Gotenberg ExifTool Metadata Key Injection over HTTP (CVE-2026-42589) (SURICATA, Detection)
Detection rules
Carrier Credential Harvesting Through a Customer's RouterWSMA_CVE_2023_20198_DoubleEncode_Exfil (YARA, Detection); WebLogic_CVE_2024_21182_OpaqueReference_JNDI (YARA, Detection); GeoServer_CVE_2024_36401_ValueReference_Exec (YARA, Detection); PublicTool_CVE_2023_21839_WebLogic_GoExploit (YARA, Hunting); Cisco IOS-XE Double-Encoded WSMA Path Bypass (Operator Fingerprint) (SURICATA, Detection); GENERIC-CVE-2023-20198 Cisco IOS-XE WebUI Auth-Bypass URI (SURICATA, Detection); GENERIC-CVE-2023-20198 Cisco IOS-XE Forged Bare-Hex Authorization Token (SURICATA, Detection); WebLogic T3/IIOP JNDI OpaqueReference Injection (SURICATA, Detection); Malicious LDAP-JNDI Callback Response (SURICATA, Detection); GeoServer OGC-Filter RCE via valueReference exec() (SURICATA, Detection)
Detection rules
The Middle Tier: A Non-APT Operator's Reach Into Four Southeast Asian GovernmentsZimbra Web Shell Decoy Banner (webshell_zimbra_security_monitor_jsp) (YARA, Detection); GIF89a-Polyglot PHP Web Shell (webshell_gif89a_php_polyglot) (YARA, Detection); Ivanti Connect Secure Auth-Bypass Path Traversal to System Information (SIGMA, Detection); Exchange ProxyLogon SSRF Cookie Header on Autodiscover (SIGMA, Detection); Tableau Server Vizportal SSRF via getViewThumbnail or fetchBinary (SIGMA, Detection); GenAI Chatbot API SSRF to Cloud Instance Metadata Service (SIGMA, Detection); Moodle Managefiles Plugin Local File Inclusion Attempt (SIGMA, Detection); Zimbra JSP Web Shell Dropped via Amavis Cpio Path Traversal (SIGMA, Detection); Ivanti Connect Secure CVE-2023-46805 Auth-Bypass Path Traversal (SURICATA, Detection); Ivanti Connect Secure CVE-2024-21887 Command Injection via cac/status (SURICATA, Detection); Exchange ProxyLogon CVE-2021-26855 SSRF Cookie Header on Autodiscover (SURICATA, Detection)
Detection rules
GOCLOUD Multi-Service CryptojackingGOCLOUD_BatchExploit_Dispatcher (YARA, Detection); GOCLOUD_OmniHunter_v4_Orchestrator (YARA, Detection)
Detection rules
Enough to Be Dangerous: The Mechanics of an LLM-Assisted Intrusion CampaignLogback FileAppender Arbitrary File Write to JSP (YARA, Detection); SnakeYAML Deserialization Gadget (CVE-2022-1471 Family) (YARA, Detection); XXE-to-SSRF Internal/Cloud-Metadata Probe (YARA, Detection); Logback insertFromJNDI RCE (CVE-2021-42550) (YARA, Hunting); Manufactured Log-Data Harvesting via Jolokia Logger Manipulation Then Actuator Logfile Read (Correlation) (SIGMA, Detection); LDAP Anonymous BindRequest to a Non-Standard Directory Port (SURICATA, Detection); SnakeYAML Gadget Chain in HTTP Request Body (SURICATA, Detection); XXE Entity Declaration Targeting Cloud Metadata in Upload (SURICATA, Detection); Gopher-Scheme SSRF Protocol Smuggling in HTTP URI (SURICATA, Detection); Gopher-Scheme SSRF Protocol Smuggling in HTTP Request Body (SURICATA, Detection); SSRF-to-Redis CONFIG/BGSAVE Command Sequence via HTTP (SURICATA, Detection); Eureka Apps-Delta Response Containing XStream Gadget Markers (Flowbits Pair) (SURICATA, Detection)
Detection rules
Rovodev AI-Co-Authored Mirai Variant + Matrix C2 (87.106.143.220)ELF IoT Arch-Tagged Filename Execution on Linux Server: Naku/Pandora Mirai Family (SIGMA, Detection); Naku Binary Fetch URI Pattern: Historical Aruba Distribution Convention (SURICATA, Hunting); Naku Binary Fetch URI Pattern: Historical Aruba Backup Distribution Convention (SURICATA, Hunting)
Detection rules
CVE-2026-41940 cPanel Harvester Toolkit (216.126.227.49)CVE-2026-41940 Proxy-Subdomain Admin Path Access Attempt (SIGMA, Hunting); CVE-2026-41940 Expired-Session Token Marker in Query String (SIGMA, Hunting); CVE-2026-41940 Successful Auth-Bypass Response Confirmation (SIGMA, Hunting); CVE-2026-41940 Raw CRLF/Null-Byte Injection in Authorization Header (SURICATA, Detection)
Detection rules
From Webshells to The CloudSuspicious File Manager / phpMyAdmin Access (SIGMA, Hunting)
Tracked actors
Designations whose reports map this technique.
- UTA-2026-005: Chaos ransomware builder user with a private five-stage crypter
- UTA-2026-011: Financially motivated operator weaponising a cPanel authentication bypass with a custom harvesting toolkit
- UTA-2026-014: DDoS-for-hire operator running an AI co-authored C2 framework over a Pandora-Mirai botnet
- UTA-2026-018: Hands-on-keyboard operator exploiting four Southeast Asian governments with a bespoke edge-device toolkit
- UTA-2026-019: Grey-market personal-data harvester running scores of LLM-assisted attack scripts against Chinese consumer platforms
- UTA-2026-020: Self-branded commodity cryptojacking operator mass-exploiting exposed Chinese enterprise software
- UTA-2026-023: Telecom-focused operator reaching a carrier's credential plane through a customer's managed router
ATT&CK v19.2. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique names are MITRE's and link to MITRE's own pages. The mapping on each linked page is this publication's reading of its own evidence.