ATTACK METHOD
Exploiting Vulnerabilities — The Top Way In
How attackers exploit software flaws: web shells, zero-days, and edge devices (VPNs). Mechanisms, Japanese incident data, and the latest global threat reports.
In 2026, vulnerability exploitation became the world's leading initial access vector. Verizon's DBIR 2026 attributes 31% of all breaches to it, overtaking stolen credentials (last year's number one). Most striking: exploitation of edge devices such as VPNs and firewalls jumped from about 3% to 22% — the days to weeks around a patch release now decide the outcome.
Japan shows the same pattern. Trend Micro's research team reports a growing domestic chain of known web-application vulnerabilities leading to web shells, privilege escalation, lateral movement, and database access. The Chinese-made AI "ARTEX", allegedly used in the autumn 2026 attacks against roughly 80 Japanese companies, likewise relied on industry-targeted automated scanning paired with vulnerability exploitation.
The point is not a "new kind of attack" — it is known, fixable holes being exploited. Most incidents involve vulnerabilities that already had patches available, so patching speed and an inventory of internet-facing assets beat every other control.
The numbers
31%
Vulnerability exploitation as the #1 initial access vector worldwide (DBIR 2026)
3%→22%
Surge in VPN / edge device exploitation (DBIR 2026)
+42%
Growth in zero-days exploited pre-disclosure (CrowdStrike GTR 2026)
Techniques explained
Web shell deployment
After breaking in, the attacker plants a small script that runs arbitrary commands over the web. Disguised as an ordinary file, it serves as a long-term foothold between the initial intrusion and the eventual data theft. A wave of Japanese incidents this year discovered web shells post-intrusion.
Zero-day exploitation
Attacks on holes with no patch yet released. CrowdStrike's GTR 2026 reports a 42% year-over-year increase in zero-days exploited before disclosure. In practice, though, most victims are hit through known but unpatched flaws — zero-days are the tip of the iceberg.
Edge device (VPN, appliance) vulnerabilities
Flaws in internet-exposed VPNs, firewalls, and load balancers. Compromising the very devices that guard the perimeter opens the internal network at a stroke. This is the pattern behind the VPN-borne intrusions jumping 3%→22% in DBIR 2026; a few days' delay in applying vendor fixes spreads the damage.
SQL injection
A classic that never dies: attacker input is executed as database commands. Countermeasures (parameterized queries) are well established, yet legacy systems and in-house tools still fall victim.
Privilege escalation & lateral movement
Attackers seize the admin rights the first foothold lacks — via misconfigurations or unpatched local flaws — then expand across servers and departments. This phase precedes almost every ransomware or large-scale theft; internal network segmentation is where containment pays off.
AI-driven scanning + manual exploitation
Unit 42 reported a Mandarin-speaking actor using AI (DeepSeek via the Hermes Agent framework) to auto-scan seven vulnerability classes, with humans exploiting only promising targets. Attack costs are falling: mid-sized companies are now targets too.
Attack flow (kill chain)
- Scan internet-facing services for vulnerabilities
- Exploit a known or zero-day flaw and plant a web shell
- Escalate privileges, move laterally, and reach the database
Targeted data: Customer databases behind public applications
Trends & discussion
Trend Micro's research in Japan shows a growing chain: known vulnerability → web shell → privilege escalation → database. Japan's autumn 2026 breach wave was not exotic — it was the world-standard playbook executed at scale.
Priorities are clear: (1) inventory internet-facing assets, (2) patch edge devices and public applications first, (3) build assuming compromise (least privilege, segmentation). Fixing everything instantly is unrealistic; triage by exposure.
Countermeasures
For individuals & small businesses
- Individuals have little to patch directly — but if a service notifies you of unauthorized access, change that password immediately (and stop reusing it)
- Check for firmware updates on home internet devices such as routers and NAS units
For organizations (IT)
- Run a comprehensive inventory of internet-facing assets (domains, IPs, services) quarterly
- Set SLOs for edge devices and public apps (e.g. patch within 7 days of release) and visualize misses
- Beyond WAF/IPS, add web shell detection (suspicious POSTs and file drops) to log monitoring
- Segment internally so one intrusion cannot fan out company-wide (least privilege included)
Step-by-step guidance by protection level is in the guide →
Exploitation of vulnerabilities incidents we collected (39, by impact)
| Company / organization | Disclosed | Scale | Severity |
|---|---|---|---|
| Helpfeel（Gyazo） | September 15, 2026 | 23,620,000 records | SS |
| Eストアー(ショップサーブ) | October 15, 2026 | 23,356,000 people | SS |
| アドベンチャー（スカイチケット） | October 9, 2026 | 14,640,000 records | SSS |
| KDDI(ISP事業者向けメール基盤) | June 22, 2026 | 12,231,954 people | SSS |
| ムラウチドットコム | September 14, 2026 | 7,710,000 records | S |
| ホワイトエッセンス（予約・基幹システム） | October 4, 2026 | 1,050,000 accounts | S |
| LEAN BODY | September 14, 2026 | 440,000 accounts | A |
| ユーザベース（NewsPicks） | October 7, 2026 | 362,000 records | A |
| 加賀ソルネット（アカデミコナビ） | August 16, 2026 | 166,000 people | A |
| タカラトミー（デュエマサポートアプリ） | July 27, 2026 | 155,000 people | A |
| 日本医科大学武蔵小杉病院 | February 26, 2026 | 130,000 people | A |
| Fivot（IDARE） | October 12, 2026 | 129,659 people | A |
All 27 remaining incidents in the database →
Related attack methods
Attack Methods & Trends (Verizon DBIR 2026, CrowdStrike GTR 2026, NPA / Kyodo, Palo Alto Networks Unit 42, and others). For individual incidents, see the source links on each incident page.