Industry
Energy and utilities
Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
Read more
Attack technique
Exploit Public-Facing Application
Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network.
In short
Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. The weakness can be a software bug, a temporary glitch or a misconfiguration. It is an Initial Access technique.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Initial Access · Step 3 Of 15 In The Attack Chain
- MITRE IDT1190ATT&CK technique
- Detection4ways to spot itWatch server processes · Check outbound connections
- Defences4ways to stop itPatch and scan regularly · Expose only what is needed
How it works
Any system that accepts connections from the Internet can be a target. Websites and web servers are common, but so are databases, services such as SMB or SSH, and the management interfaces of network devices.
The attacker sends input that the system does not handle safely, or finds a service that was exposed by mistake. If this works, they get a first foothold without needing a stolen password or a phishing email.
If the application runs in the cloud or in a container, the break-in can reach the underlying instance or container, and from there cloud interfaces or weak access policies. Edge appliances are also targeted, because they often cannot run strong host-based defenses. Joint advisory AA26-293A says SafePay actors exploited Veeam and SonicWall flaws on internet-exposed systems with automated scripts.
A real example
Procedure examples listed by MITRE ATT&CK:
- BOLDMOVE is associated with exploitation of CVE-2022-49475 in a network device operating system.
- COATHANGER is installed after exploitation of a vulnerable firewall device.
- Qilin has been delivered through exploitation of exposed applications and interfaces, including remote desktop services.
- Siloscape runs after the attacker gains initial access to a Windows container using a known vulnerability.
- SoreFang can gain access by exploiting a vulnerability in an SSL VPN product that allows malicious update binaries to be placed and delivered.
A current example of the kind of flaw this technique uses is PHP2Shell, two critical flaws in PHP itself, reported as remote code execution in October 2026. A 2026 example is an upload-handling flaw in Rails: how a crafted upload can write server files.
Network device operating systems are a common target. CISA lists the UniFi OS access control flaw CVE-2026-34908 as exploited.
CVE-2026-123488 shows the pattern directly: an unauthenticated SQL injection in Craft CMS's element search endpoint reaches administrator access.
Who uses it
- Ransomware group BianLian BianLian is a ransomware and data extortion group that the FBI, CISA and Australia's ACSC say is likely based in Russia. Active · Since 2022 · Developer and deployer group with Russia-based affiliates
- Ransomware group Black Basta ransomware group Black Basta is a ransomware as a service operation, first identified in April 2022. Since 2022 · Ransomware as a service
- Ransomware group Cl0p Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505. Active · Since 2019 · Ransomware as a service, and data theft campaigns (per the advisory)
- Ransomware group DarkSide DarkSide was a ransomware as a service group that CISA and the FBI named in advisory AA21-131A, first published May 11, 2021, after an attack on a U.S. Inactive · Since 2020 · Ransomware as a service
- Ransomware group Hive Hive was a ransomware as a service operation active from June 2021. Disrupted · Since 2021 · Ransomware as a service
- Ransomware group LockBit LockBit is a ransomware as a service operation first seen in January 2020. Disrupted · Since 2020 · Ransomware as a service
- Ransomware group Medusa Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Active · Since 2021 · Ransomware as a service (closed group until at least early 2023)
- Ransomware group Nefilim Ransomware: Profile, Tactics and the Stryzhak Case Nefilim was a ransomware-as-a-service operation that stole data, encrypted networks and threatened to publish what it took. Inactive · Since 2020 · Ransomware as a service with double extortion; affiliate Stryzhak agreed to pay the administrators 20% of ransom proceeds (per the US Department of Justice)
- Ransomware group Qilin Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. Active · Since 2022 · Ransomware as a service
- Ransomware group RansomHub RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service
- Ransomware group SafePay Ransomware Group SafePay is a ransomware group that the FBI, CISA and partners say has been highly active since August 2024. Active · Since 2024 · Data theft and encryption, then a threat to publish the data on a leak site (per advisory AA26-293A)
- Ransomware group The Gentlemen Ransomware Group The Gentlemen is a ransomware-as-a-service operation. Active · Since 2025 · Ransomware as a service with double extortion; affiliates keep 90% of each ransom (per Unit 42, Sophos and Check Point)
- Ransomware group Vice Society Vice Society is an intrusion, exfiltration and extortion group that first appeared in summer 2021, per joint advisory AA22-249A (FBI, CISA and MS-ISAC, September 6, 2022). Since 2021 · Not stated in the advisory
Seen in incidents
- Incident COATHANGER malware on a Dutch Defence network, published February 2024 COATHANGER is advanced Chinese malware that the MIVD and AIVD found on an isolated Dutch Ministry of Defence research network. 2023 · Government and public sector
- Incident Emennet Pasargad hack-and-leak and information operations against Israel, 2020 to 2024 Emennet Pasargad is an Iranian group that the FBI says has run hack-and-leak and information operations, mainly against Israel, since at least 2020. May 2020 to October 2024 · Multiple sectors
- Incident ESXiArgs ransomware campaign against VMware ESXi servers In early February 2023 a ransomware campaign hit VMware ESXi servers that were exposed to the internet and not patched. February 2023 · Multiple sectors
- Incident Microsoft Exchange ProxyLogon mass exploitation, 2021 The Microsoft Exchange ProxyLogon attacks of early 2021 used four previously unknown flaws in on-premises Exchange Server to reach email servers around the world. March 2021 · Multiple sectors
- Incident MirrorFace campaigns against Japan, 2019 to 2025 On 8 January 2025 Japan's National Police Agency (NPA) and the National center of Incident readiness and Strategy for Cybersecurity (NISC) said that cyberattack campaigns against Japanese organizations since about 2019 were run by an actor called MirrorFace. 2019 to 2025 · Government and public sector
- Incident Salt Typhoon telecom intrusions From at least 2021, state-sponsored hackers linked to China broke into the networks of telecom companies in many countries. October 2024 · Telecommunications
- Incident SharePoint ToolShell attacks In July 2025, attackers exploited flaws in on-premises Microsoft SharePoint Server in an attack chain called ToolShell. July 2025 · Multiple sectors
- Incident UNC3886 campaign against Singapore’s telecommunications operators, 2025 In 2025 an advanced persistent threat actor called UNC3886 attacked all four of Singapore's major telecommunications operators. 2025 · Telecommunications
How to detect
-
Look for odd requests and error spikes
Unusual request patterns to a public endpoint, or a rise in server errors and firewall blocks, can be the first sign.
-
Watch server processes
A web server or application process that suddenly starts a shell, loads unexpected modules or writes new files is a strong warning.
-
Check outbound connections
A public-facing host or container that starts connecting to new outside addresses, or to the cloud metadata service, may be compromised.
-
Detection strategy MITRE lists
DET0080, Exploit Public-Facing Application, multi-signal correlation (request, error, post-exploit process and egress).
How to defend
-
Patch and scan regularly
Update exposed applications on a regular schedule, scan external systems for weaknesses, and fix critical ones quickly.
-
Expose only what is needed
Make sure every public service is meant to be public, and restrict access to anything that should be internal only.
-
Separate and contain
Place external servers in a DMZ or on separate hosting, isolate the application, and give service accounts only the access they need.
-
Filter traffic in and out
Use web application firewalls to limit exploit traffic, and restrict outbound traffic from public servers to limit what an attacker can do after a break-in.
Questions
What is Exploit Public-Facing Application?
It is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. The weakness can be a software bug, a temporary glitch or a misconfiguration. It is an Initial Access technique.
Which systems are targeted?
Websites and web servers are common, but so are databases, services such as SMB or SSH, and the management interfaces of network devices. Edge appliances are also targeted because they often cannot run strong host-based defenses.
How can defenders detect it?
Unusual request patterns to a public endpoint, or a rise in server errors and firewall blocks, can be the first sign. A web server process that suddenly starts a shell, or a public host that makes new outbound connections, is a strong warning.
How do I reduce the risk?
Patch exposed applications on a regular schedule, scan external systems and expose only what must be public. Place external servers in a DMZ, use web application firewalls and restrict outbound traffic from public servers.
In our research
- Storm-3358 and ARTEX: How a Financial-Sector Intrusion Campaign Works November 2026
- Barracuda ESG Pre-Auth RCE: How Two Flaws Chain to Root, and What to Patch November 2026
- OpenSSH Sshole (CVE-2026-123158): Update Musl Linux Hosts to 10.6p2 November 2026
- Apache Juneau 9.2.1: Eight 10.0 CVEs Compared by Who Can Actually Reach Them November 2026
- Storm-2603 ToolShell Intrusion: The Fileless Chain Inside w3wp.exe, Step by Step November 2026
- Zyxel GS1900 Patch Bypass: The June Fix Failed, Run the .3 Build November 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 150 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.