September 2026 Threat Trend Report on APT Groups
Purpose and Scope
APT cases disclosed in September 2026 demonstrate that attacks have evolved to exploit the developer ecosystem, cloud services, and network management infrastructure as trust layers. Legitimate software installers, GitHub repositories, Microsoft 365, OneDrive, Telegram, Nostr, routers, and authentication servers were all included in the attack chain.
Key Trends
- Supply chain attacks have expanded. GitHub account compromises, repository tampering, exploitation of VS Code projects, disguised Terraform configuration files, and the distribution of malicious macOS installers were observed.
- C2 (Command and Control) communication leveraging legitimate services has increased. Microsoft 365, Outlook, OneDrive, Telegram, the GitHub API, WebSocket, Nostr Relay, and the Microsoft Graph API were used as stealthy communication channels.
- Compromises of trusted infrastructure have increased. Cases were identified where routers, TACACS authentication servers, Linux management hosts, and Microsoft Exchange servers were directly targeted.
- Chrome and Windows zero-day vulnerabilities and multi-stage infection chains were exploited. VHDX, LNK, PDF, HTA, WSF, MSI, and Control Panel applets were combined.
Status of Major APT Groups by Region
North Korea
Famous Chollima, Kimsuky, and Konni primarily targeted developers and IT professionals. Tactics such as fake job postings, technical interviews, coding assignments, malicious LNK files, GitHub PAT-based delivery, and follow-up PowerShell payloads were repeatedly employed. Famous Chollima’s “Contagious Interview” relied on OtterCookie (malware with Information Theft and remote access capabilities), while PolinRider focused on propagation using compromised GitHub accounts and repositories. Kimsuky separated and utilized GitHub, WordPress, Dropbox, and Pinggy based on their specific functions, while Konni used VelvetCake (a downloader) to collect information and take screenshots.
China
FamousSparrow, Fire Ant, Storm-3069, UAT-11587, and UTA0565 actively exploited trusted infrastructure and legitimate Services. SparroWocky, BridgeAgent, NeedyMantis, Antino, and CLEANGULP emerged, and Microsoft 365, Outlook, OneDrive, Cloudflare Pages, Cloudflare R2, Amazon CloudFront, and GitHub were used for C2 and staging. Fire Ant compromised Cisco IOS XR routers and TACACS servers, while UAT-11587’s Antino used Outlook and OneDrive as dead-drop C2 channels.
Russia
Callisto (Star Blizzard), UAC-0099, and NightEagle have escalated their activities. Callisto deployed CosmicPulse using RedFlick (a scheduled task-based delivery technique), while UAC-0099 attempted to disrupt AI analysis using GuardBreaker (an LLM-based obfuscation technique). NightEagle combined GhostContainer (an Exchange backdoor) with Microsoft dev tunnels, rdp2tcp, Impacket, and BlueKeep to infiltrate corporate environments in Russia.
Iran and Pakistan
Mirage Kitten used NodeRabbit and PollCat to target developer workstations in the aviation, aerospace, and fintech sectors. Transparent Tribe and APT36 exploited LNK, ISO, ZIP, BAT, PowerShell, and GitHub-based C2 to attack government, defense, and diplomatic organizations. APT36 exploited GitHub private repositories and removable storage devices using RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH.
Conclusion
This month’s APT activity demonstrates a shift in focus from infecting end-user devices to compromising developer accounts, cloud credentials, supply chains, and network trust infrastructure. Existing security controls alone make it difficult to detect C2 commands embedded within legitimate services, the exploitation of development workflows, and breaches of trusted infrastructure. Therefore, developer environments, cloud behavior-based detection, monitoring of network management infrastructure, and account protection are identified as priority response areas.
