Threat actors

Russian cyber operations globally target critical infrastructure, communication platforms, and military logistics. Attacks on Zimbra servers, Signal and other messaging services, as well as on NATO transportation routes, demonstrate a broad threat landscape. Social engineering and weaknesses in security architectures are exploited. These activities particularly affect Western states and Ukraine.

TeamPCP is a threat group known for large-scale supply chain attacks on open source ecosystems. They target package managers like npm and PyPI to inject malicious code into widely used libraries. The campaign involves container escape techniques and is documented under the name 'Mini Shai-Hulud'. Their activities have been observed through mid-2026 and pose a significant risk to the software supply chain.

Russian state-sponsored APT actors are reportedly increasingly using AI tools like Claude AI to automate malware evasion. They target network devices and routers, with officials again warning about this threat. Additionally, a WinRAR vulnerability is being exploited against Ukrainian organizations. The attacks particularly affect Ukraine and critical network infrastructure.

The Qilin ransomware group actively exploits vulnerabilities in VPN appliances, notably an authentication bypass in PAN-OS and zero-day flaws in Check Point VPNs, to gain initial access for ransomware attacks. Recent reports link these security flaws directly to Qilin and their use in compromising corporate networks. The group focuses on compromising VPN appliances to deploy ransomware in target environments.

HAFNIUM is a state-sponsored threat actor group that recently exploited multiple critical vulnerabilities in Microsoft Exchange Server, including CVE-2022-41082, CVE-2021-26858, CVE-2021-27065, and CVE-2021-26857. These vulnerabilities allowed remote code execution and were used in targeted attacks.

UAT-10147 is a Chinese-speaking threat actor that integrates agentic AI into post-compromise operations. The actor deploys SPECTRE, a cross-platform implant with Linux rootkit and BYOVD capabilities. The headlines do not specify targeted sectors, regions, or countries.

Laundry Bear is a Russian threat group that exploits zero-click vulnerabilities in Zimbra webmail. They recently used a zero-day flaw in Zimbra against targets in the US and Ukraine. International alerts highlight the Russia-linked attacks on Zimbra.

Iran continues to conduct cyber attacks, especially on operational technology and critical infrastructure. Federal agencies have broadened alerts about Iran-linked OT attacks. Recent activities extend beyond critical infrastructure, and despite political ceasefires, hackers persist in their operations.

Turla is a Russian threat actor known for espionage and destructive attacks. The EU has imposed sanctions on Russia related to severe cyberattacks and sabotage. According to Google, Turla uses the new STOCKSTAY backdoor in espionage attacks in Ukraine.

Nightmare Eclipse is a threat actor associated with the 'RoguePlanet' zero-day vulnerability. Recent reports indicate that Microsoft is working on a patch for this exploit. There is no further information on targeted sectors or regions.

Gamaredon is a Russian APT group that is expanding its attacks on Ukraine. Recent reports indicate the use of new malware and cloud service abuse. The group has upgraded its arsenal and exploits vulnerabilities such as WinRAR to deliver malware like GammaWorm and GammaSteel.

The Gentlemen is a Ransomware-as-a-Service group known for using custom backdoors and evolving tactics. They employ the GentleKiller EDR framework to disable up to 400 security processes. Their ransomware spreads like a worm and has claimed 478 victims.

China conducts cyber espionage targeting universities and other organizations. German domestic intelligence warns of increased vigilance at universities. Google has exposed a Chinese espionage group that has been undetected in networks since 2023. Additionally, a dual-method cyberattack was launched against Czech organizations.

Sandworm is a Russian threat actor that recently exploited Cisco vulnerabilities to deploy the Cyclops Blink malware. The actor is also associated with the detection of SANDWORM_MODE and emerging AI toolchain supply chain attacks. These activities indicate sophisticated attacks targeting network infrastructure and software supply chains.

APT29 is a Russian state-sponsored hacking group. According to recent headlines, the group uses Claude to rebuild malware after detection. Additionally, APT29 is associated with ROADtools and nation-state tactics in the cloud.

Nightmare-Eclipse is a threat actor that, according to headlines, repeatedly uses Windows exploits. Recently, the exploits 'ShieldCrash' and 'RoguePlanet' targeting Microsoft systems were reported. Specific details on targeted sectors, regions, or countries are missing from the reports.

Void Blizzard is a suspected Russian cyber espionage group. They exploited a zero-click vulnerability in Zimbra for email theft. A Russian national has been charged in connection with the group's espionage campaign. No further details on targeted sectors or regions are evident from the recent headlines.

The Chaos ransomware group uses msaRAT to route command-and-control traffic through headless Chrome and Edge browsers. This creates a covert C2 channel that disguises itself as normal browser traffic. It enables undetected control of the infection. The technique leverages legitimate browser processes for concealment.

ShinyHunters is a threat actor group known for abusing OAuth in SaaS-based applications. Recent reports highlight the need to defend SaaS applications against such attacks. The group targets cloud services. No specific malware details are evident from the provided headlines.

UAT-7810 is a China-linked threat actor expanding its ORB network with the new LONGLEASH malware. The actor reportedly achieves a 54% success rate in its operations.

ToddyCat is a threat actor that, according to a Q1 2026 threat landscape report, targets industrial automation systems. The actor is also associated with a hidden email assistant, indicating email-based espionage. These capabilities suggest a focus on industrial espionage.

North Korean hackers are increasingly conducting supply chain attacks to compromise open source software. These campaigns aim to infiltrate developers and organizations. Microsoft recently linked a supply chain attack on the AI platform Mastra AI to North Korean threat actors.

Kimsuky is a threat group that, according to recent reporting, is targeting organizations with PebbleDash-based tools. A large-scale campaign using ScreenConnect disguised as freeware has also been observed. No details on targeted sectors, regions, or countries are evident from the headlines.

Russian intelligence services target messenger backup keys to gain access to communications. They use fake support texts to steal messaging credentials. The FBI and Ukrainian authorities warn about these attacks.

Russian intelligence services are targeting Signal backup recovery keys to intercept encrypted communications, according to FBI reports. This technique is likely deployed against high-value targets such as government officials, journalists, and activists. The warning highlights the persistent cyber espionage threat posed by Russian state actors.

Russian-speaking threat actors are targeting Fortinet FortiGate devices. The campaign, dubbed 'FortiBleed', has compromised over 86,000 devices and is harvesting credentials. CISA is warning affected customers about these attacks.

DragonForce is a ransomware group that abuses Microsoft Teams relay servers to disguise command-and-control traffic for a backdoor called Backdoor.Turn. This technique allows the group to conduct ransomware attacks while evading detection.

TA4922 is a China-linked threat actor conducting phishing attacks. According to recent reports, TA4922 has expanded its phishing campaigns to the United Kingdom, Germany, Italy, and South Africa. This expansion indicates a broadening of their geographic targeting. No further details about their methods or victims are currently available.

Fox Tempest is a threat actor notable for multi-stage Linux intrusions, gaining access via edge appliances like F5 and collaboration software such as Confluence to achieve enterprise-wide compromise.

CL-STA-1132 is a threat actor exploiting zero-day vulnerabilities in Palo Alto Networks PAN-OS. Recent reporting indicates exploitation of a flaw in the Captive Portal and a critical buffer overflow in the User-ID Authentication Portal to achieve unauthenticated remote code execution. The group targets systems running PAN-OS, likely for espionage or network compromise. Activities include exploitation of CVE-2026-0300.

UNC6692 is a threat group that combines social engineering with malware and cloud abuse. They deployed custom malware suites to compromise targets. The group used sophisticated social engineering techniques. Additionally, they abused cloud infrastructure for malicious purposes.

The Russia-linked cyber-espionage group was caught by Anthropic using Claude in hacking operations. The group apparently used the AI assistant for its activities. No further details on target sectors or regions are known from the available report.

The Chinese state-sponsored APT actor is attributed with using the Bluemoon exploit kit. The attacks target users of Windows operating systems. Specific target sectors, regions, or countries are not mentioned in the reporting. This activity highlights the ongoing threat from Chinese hacking groups.

This Russian-speaking threat actor has been observed exploiting PaperCut vulnerabilities in AI-powered attacks. The attacks demonstrate a connection to advanced, possibly AI-assisted methods. No further details on targeted sectors or malware are available from the reporting.

Recent reporting on the actors Storm-3032, Storm-3121, and ShinyHunters includes a headline stating that voice callers exploit BYOD to reach Microsoft 365 and corporate data. No specific targeted sectors, regions, or countries are named in the headline. No malware is directly associated with this activity in the provided headline. The actors are mentioned together in the context of this report.

According to a report by Anthropic, AI enables small actors to run state-level hacking campaigns. This lowers the barrier to entry for groups such as Russian-aligned espionage groups, Chinese state-sponsored actors, and ShinyHunters. The threat landscape becomes more diffuse as even smaller groups can now deploy sophisticated capabilities.

The available headline 'We've got one word for it, and it's usually the wrong one' provides no concrete information about targets, regions, or malware related to UAT-10820. Therefore no details on affected sectors, countries, or malware can be given.

Four unnamed espionage groups are mentioned. The reporting refers to the BlueMoon exploit kit, which turns Chrome and Windows flaws into attacks. No further details about the groups are available.

According to the headline, the Russian-speaking APT actor used hundreds of AI agents to compromise over 440 PaperCut instances. The headline does not mention targeted sectors, regions, or malware. Further operational details are unavailable.

Recent reports show that Chinese espionage groups are exploiting a triple-link chain of zero-day vulnerabilities. The groups appear to be acting in a coordinated manner. No further details on targets or malware are available.

APT31 is a threat group mentioned in recent reporting. According to a headline, four spy groups used the same Chrome and Windows exploit kit within a week. No further details on targeted sectors or regions were provided in the headline.

Multiple China-linked APT groups have been observed using an identical Chrome zero-day exploit. The reporting indicates that different Chinese hacking groups are exploiting the same vulnerability. The headline does not provide details on targeted sectors, regions, or malware.

UAT-11988 is associated with the active exploitation of vulnerabilities in Cisco Secure Firewall Management Center. The provided headlines describe ongoing attacks against this management platform. No further details on affected sectors, regions, or malware are included.

Rhysida is a threat actor known for ransomware attacks. A recent comment reports a Rhysida attack in Berlin, Germany. The headline suggests a security gap favored the attack. No further details on sectors or malware are provided.

The threat actor Spring Ring is associated with vishing attacks targeting Microsoft Teams users. According to the provided headline, the group conducts such attacks. No further details on targeted sectors, regions, or used malware are available from the headline.

Armored Likho and Mirage Kitten are mentioned in a report on the threat landscape for industrial automation systems in Q2 2026. The headline indicates activity by these actors in this sector. No specific attack details, regions, or malware are provided in the headline. Further information cannot be derived from the given material.

The APT group HoneyMyte has updated the CoolClient malware. CoolClient is a backdoor. The new version receives a kernel-level Windows rootkit. No further details are known from the headline.

Armored Likho is a threat actor that, according to the headline, expands its cyber-espionage toolkit. No specific targets, sectors, or regions are mentioned in the provided headlines. There are no further details on associated malware.

CAV3RN is a threat actor that, according to recent reporting, uses Google Apps Script as a C2 relay and DNS-based C2 channel selection. The activities continue under the name 'Project CAV3RN'. No details on targeted sectors, regions, or countries are evident from the provided headline.

UAC-0099 is a threat actor observed in recent attacks. A fake Notepad++ plugin was used to distribute MATCHBOIL.V2. The method relies on social engineering. This is a targeted threat.

LAUNDRY BEAR is a Russian state-sponsored threat actor. A recent zero-click phishing campaign targeting Western organisations was exposed. The campaign was uncovered by the UK and partners.

The Chaos ransomware gang is a threat actor recently linked to the msaRAT malware. This malware uses Chrome and Edge browsers to route C2 traffic. msaRAT enables attackers to gain remote access and steal data. Further details on targets are currently unknown.

Handala is an Iranian hacktivist group that, according to a US warning, targets industrial control systems (ICS) from Siemens, Schneider Electric, and Rockwell Automation. The group may be linked to Iranian state actors and focuses on critical infrastructure. The goal could be sabotage or espionage.

North Korea uses an IT worker scheme to fund Russia's war effort. Under the guise of remote IT jobs, funds are generated that allegedly support the Russian military. This activity demonstrates cooperation between North Korea and Russia in evading sanctions and raising funds.

APT34, an Iranian threat group, is linked to a new module called Project CAV3RN. This module abuses Outlook calendar events for command and control and DNS AAAA records for configuration recovery.

UTA0533 is a threat actor for which no specific details are available in the recent headlines. The provided weekly recap only mentions the actor without elaborating on targets or malware. Further information cannot be inferred from this source.

Russian intelligence service hacks IP cameras to spy on military logistics across NATO states and Ukraine. This threatens the security of military operations. The attacks aim to monitor supply chains and movements. Multiple NATO countries and Ukraine are affected.

UAT-11795 is a threat actor group recently observed in a financially motivated campaign. They deployed the novel Starland RAT and the bespoke WLDR C2 implant. The campaign aims for financial gain, but specific targeted sectors or regions remain unknown. The group appears to leverage custom malware to achieve its objectives.

The Russian intelligence agency is conducting hacking attacks that, according to an advisory, focus on NATO logistics and Ukrainian troops. They hack cameras to obtain confidential information. These activities demonstrate a continued interest in military movements and operations.

UNK_CustomCloak uses OAuth Client ID spoofing to validate stolen Microsoft Entra credentials. This technique enables attackers to take over compromised accounts. No further details are known about this actor.

Russian APT groups are conducting cyberattacks on critical infrastructure routers, according to warnings from the US and allies. These attacks aim to compromise networks and steal sensitive information. Affected entities are primarily in the US and allied nations. Security agencies urge increased vigilance and protective measures.

Russian state intelligence services pose a persistent threat to critical infrastructure. Recent reports indicate that the UK and its allies are calling for enhanced defensive measures. The actors employ advanced cyber operations for espionage purposes.

The EU imposed sanctions on Russian GRU military hackers over cyberattacks. These attacks likely targeted EU member states. The GRU is a known threat actor responsible for offensive cyber operations.

APT28, also known as Fancy Bear, is a cyber unit attributed to Russia's FSB. Recent reporting holds the group responsible for an attack on Poland's power grid. This incident prompted the first joint cyber sanctions from the UK and EU.

O-UNC-066 is a threat actor group recently observed in a campaign using fake Microsoft Entra passkey enrollment. Users are tricked into registering for a fraudulent passkey, granting unauthorized access to Microsoft 365 accounts. This technique allows attackers to bypass multi-factor authentication. No specific targeted sectors or regions have been disclosed.

The new Helix vishing group has emerged in attacks targeting data theft from SharePoint. Through voice phishing, victims are tricked into revealing credentials. The group does not use known malware but relies on social engineering. Details on target industries and regions are currently unknown.

Hyadina is a threat group linked to the GodDamn Ransomware. This ransomware uses a PoisonX driver to bypass endpoint defenses. Nothing is currently known about further targets or activities of the group.

LapDogs is a China-linked APT group. According to recent reports, it has expanded its arsenal with new 'Leash' backdoors. This backdoor expansion indicates ongoing capability development. Further details on targeted sectors or regions are not known from the reporting.

The given headline does not provide information about Russian state-sponsored threat actors. It reports on critical security patches for Ubiquiti UniFi products.

EvilTokens is a threat actor linked to a new wave of ghost phishing attacks that bypass traditional email security measures. These attacks likely aim to compromise credentials or tokens. The recent campaign highlights the evolving tactics used to infiltrate email systems.

Volt Typhoon, a China-linked threat actor, was featured in a war game scenario focusing on hacking the US water supply, as indicated by recent reporting.

Storm-2372 is a threat group notable for using the DEBULL tooling. This tooling abuses the Microsoft device-code flow to obtain authentication tokens. Targets are Microsoft 365 accounts, suggesting widespread phishing campaigns. The group may be state-sponsored or financially motivated.

A modular command-and-control framework named Cavern Manticore has been linked to an Iran-linked APT group. No further details on targeted sectors or regions are available.

PolinRider is a threat actor with limited available information. The provided reporting only includes a generic headline without details on targets or methods. No specific sectors, regions, or malware are known.

Kimsuky and OceanLotus are known threat actors associated with persistent threats and frequently missed incidents. The report 'Missed incidents, persistent threats, and response gaps' highlights gaps in responding to compromise assessments. These actors often use advanced tactics to remain undetected.

The Lynx ransomware group is a criminal organization that conducts ransomware attacks. It has been linked to the FortiBleed campaign, which focuses on credential theft. No further details about its target sectors or regions are known from the available reporting.

Iranian, Russian, and Chinese state actors, including CyberAv3ngers and IRGC-linked groups, are targeting water systems for sabotage. These attacks threaten critical infrastructure and could endanger public safety.

UNC5792 and UNC4221 are believed to be Russian state-sponsored hacking groups. They have been linked to attacks targeting messaging apps. The US has offered a $10 million bounty for information on these hackers. The attacks continue to evolve.

Woodgnat is a threat actor recently linked to the new 'Mistic' Remote Access Trojan (RAT). This RAT opens the door to several ransomware families, indicating potential use as a first-stage malware. Further details on targeted sectors or regions are not available.

StrikeShark is a threat actor recently observed in a campaign delivering Cobalt Strike through SharkLoader. No further details about targeted sectors or regions are available from the reporting.

A Russian Initial Access Broker is behind the FortiBleed campaign. The actor exploits vulnerabilities in Fortinet devices to gain initial network access. This access is then sold to other cybercriminals. Little is known about the broker's identity.

A Russian ransomware group is exploiting the FortiBleed vulnerability. The attacks target various organizations. An update shows recent developments among the affected victims.

Gentlemen is a ransomware group that uses multiple EDR killers to disable security solutions. This allows them to spread their ransomware more effectively and encrypt systems. Little is known about their specific targets, but the group employs advanced techniques to bypass defenses.

Sapphire Sleet is a threat actor group recently involved in a supply chain attack on the npm package 'Mastra'. The attackers compromised the package and inserted a malicious postinstall payload that executes upon installation. The exact targets and malware details remain unclear. The incident highlights the risks of supply chain attacks in the software development lifecycle.

Dropping Elephant is a threat actor whose tradecraft is tracked through a China-themed loader chain. The headline suggests an analysis of their tactics. No further details on targeted sectors or regions are available from the report.

A Russian-speaking threat actor group conducted a sweeping credential-harvesting campaign, compromising over 30,000 Fortinet devices. The goal was to steal login credentials. Further details on targeted sectors or regions are currently unknown.

Shai-Hulud is a threat actor linked to a supply-chain worm. This worm exploits vulnerabilities in GitHub that were previously dismissed by GitHub as non-security issues. Researchers report that the worm infiltrates the supply chain and spreads through these flaws.

A China-linked threat actor is using the SprySOCKS backdoor, which has expanded to Windows systems with driver-based stealth. Recent reporting indicates an expansion of capabilities. No information on targets or affected regions is available yet.

APT37 is a North Korean cyber espionage group. Recent reporting describes how the group uses fake Microsoft alerts to deploy NarwhalRAT malware. Further details on targeted sectors and countries are not provided in this headline.

This China-linked APT group abused Google Workspace rules to steal emails from research and defense organizations. The attackers leveraged legitimate cloud platform features to stay undetected. The incident highlights the growing threat of cloud-based espionage.

The North Korean threat actor 'Contagious Interview' is known for turning developer tools into malware delivery channels. They likely use trojanized development packages or fake interview processes to compromise developers. Their activities target the global developer community. Recent reports indicate that North Korean hackers are increasingly infiltrating popular developer tools.

UNC6508 is a China-nexus threat actor targeting the public and private medical community. The actor pursues research in artificial intelligence, cybersecurity, medical, and national defense fields. UNC6508 is known to steal sensitive information from these sectors. No further technical details or associated malware were mentioned in the provided reports.

Velvet Ant is a China-linked threat actor known for backdooring a Linux login software. This backdoor allowed the group to hide in compromised systems for nearly a decade. The attack represents a supply chain compromise that granted persistent access.

Chaotic Eclipse is a threat group that continues to actively use Windows exploits, including a new BitLocker bypass. The group shows sustained activity focusing on exploiting vulnerabilities in Windows systems.

China-nexus state-sponsored actors operate the JDY botnet, which has expanded to over 1,500 devices. It is used for cyber reconnaissance purposes. The threat demonstrates the expansion and capabilities of Chinese actors in cyberspace.

The CrowdStrike 2026 Technology Threat Landscape Report indicates that China's ambitions are fueling cyber attacks. China-nexus APT groups such as Glassworm and the Crimson Collective are key actors. These groups target the technology sector to gain strategic advantages.

Earth Dahu (SHADOW-EARTH-066) is a Russia-aligned group exploiting a WinRAR vulnerability to deploy stealer malware in Ukraine. The attacks aim to steal sensitive information from compromised systems. The group operates in Russia's interest and focuses on Ukrainian targets.

The threat actor APT29, also known as UNC6692, has been linked to a social engineering campaign via Microsoft Teams. In this campaign, attackers impersonate IT support. The campaign was reported under the headline 'When “Hi, This Is IT” Comes Through Microsoft Teams'. This underscores the use of legitimate communication platforms for deception.

NSO Group is an Israeli company known for developing spyware such as Pegasus. According to recent reporting, WhatsApp disrupted new phishing attacks using NSO spyware. The attacks were carried out via phishing messages on WhatsApp. NSO Group faces international criticism for using surveillance software against civil society and governments.

VerdantBamboo is a threat actor deploying a BSD variant of the BRICKSTORM malware on Linux appliances. The campaign targets Linux-based devices. No further information on targeted sectors or regions is available.

According to a warning from Google, the group UNC3753 impersonates IT technicians to gain physical access to office spaces. This tactic indicates targeted intrusion attempts where attackers operate on-site. Further details about target sectors or malware used are currently unknown.

UNC5221 is a Chinese advanced persistent threat (APT) group recently observed deploying new malware to maintain access to compromised networks. This backdoor malware allows the actor to remain persistent within infiltrated environments and continue unauthorized activities. No specific target sectors or regions are mentioned in the available headlines.

OP-512 is a new threat cluster targeting Microsoft IIS servers. The actor uses a custom web shell framework to compromise the servers. The goal is likely to establish persistent access and execute commands. Further details are not available from the provided headlines.

Iranian state-backed ransomware actors use the Nobitex crypto exchange for their operations. The U.S. has imposed sanctions on Nobitex to disrupt these activities.

China-aligned APT groups are ramping up attacks, as indicated by a recent report. The Dragon Weave group has targeted entities in the Czech Republic and Taiwan. No further details on targeted sectors or malware used were disclosed.

The Akira ransomware group's kill chain has been reconstructed from perimeter and endpoint logs. The analysis describes the group's attack sequence. The provided headline does not specify targeted sectors or regions.

The Russian domestic intelligence service FSB and military intelligence service GRU are responsible for numerous cyber espionage and sabotage operations. They often target government agencies, critical infrastructure, and political institutions to collect intelligence and exert influence. According to reports, a server network allegedly used to support cyberattacks has been dismantled.

Nimbus Manticore is a threat actor operating during the Iranian conflict. Its operations are described as 'Fast and Furious', indicating swift and intensive attacks. No further details on targeted sectors or malware are available from the provided reporting.

Screening Serpens is an Iranian Advanced Persistent Threat (APT) group tracked in espionage campaigns in 2026.

Cloud Atlas is a threat actor that was active in the second half of 2025 and early 2026. During this period, it deployed new tools and a new payload. No detailed information about targeted sectors or affected regions is available.

Webworm is a Chinese threat actor. It has been observed using Discord and Microsoft Graph APIs to target European Union governments. The attacks involve exploiting these services to gain access to government systems.

lwxat is a Chinese-speaking threat actor associated with a commodity BadIIS ecosystem. This Malware-as-a-Service infrastructure targets IIS web servers. The actor is mentioned in a report tracking this ecosystem.

Storm-2949 is a threat group that caused a cloud-wide security incident through the compromise of an identity. The actors use stolen credentials to move laterally within cloud infrastructures. Little is known about the specific targets and malware used. The incident highlights the importance of identity protection in cloud environments.

UNC6671 is a threat actor associated with the vishing-based extortion operation BlackFile. It uses voice phishing to extort victims. No further details on targeted sectors, regions, or malware are currently available.

BufferZoneCorp is a threat actor that poisons Ruby Gems and Go modules to exploit CI pipelines for credential theft. By injecting malicious code into package dependencies, the attacker compromises development environments. The goal is to steal credentials to gain access to additional systems. These attacks endanger the integrity of software supply chains.

UAT-4356 is a threat actor recently observed targeting Cisco Firepower devices. Limited information is currently available about the actor's exact methods and objectives. Further research is needed to complete the profile.

The actor is a Chinese state-sponsored APT group conducting supply chain attacks in the hypersonic technology sector. The group targets organizations involved in the development of hypersonic weapons or vehicles. A recent report discusses a solution for detecting such attacks without needing to know the payload. Specific targets and malware used are not known from the available information.

BRICKSTORM is a threat actor group associated with a malware of the same name. The recent report 'vSphere and BRICKSTORM Malware: A Defender's Guide' focuses on their activities targeting VMware vSphere environments. No further specific information about targeted sectors or regions is available. The malware appears to aim at virtualized infrastructures.

UNC1069 is a North Korea-linked threat actor that recently executed a supply chain attack by compromising the widely used Axios NPM package. This incident highlights their focus on software supply chain attacks to target a broad range of victims.

No specific information about UNC6201 and UNC5807 is available from the provided headline. The M-Trends 2026 report provides general insights and strategies from Mandiant. Therefore, no further details can be inferred.