• Umer Wajih
• May 5, 2026
• No Comments

Threat Landscape Summary (April 27 – May 04, 2026)

I. EXECUTIVE SUMMARY

This report provides a comprehensive analysis of the cybersecurity threat landscape observed during the period of 27 April to 04 May 2026. The week was characterized by significant escalation across multiple threat vectors, with notable activity from nation-state actors, financially motivated cybercriminal groups, and emerging vulnerability exploitations. The following executive summary outlines the most critical threats and their potential organizational impacts.

---

Key Highlights

The reporting period witnessed five significant cybersecurity developments that demand immediate attention from security operations teams and organizational leadership:

1. Iranian-Linked APT Actors Escalate Attacks on U.S. Critical Infrastructure

On 07 April 2026, the Cybersecurity and Infrastructure Security Agency (CISA), in coordination with the Federal Bureau of Investigation (FBI), National Security Agency (NSA), Department of Energy (DOE), and Environmental Protection Agency (EPA), issued a joint Cybersecurity Advisory (AA26-097A) warning of intensified Iranian-affiliated cyber operations targeting programmable logic controllers (PLCs) and operational technology (OT) devices across U.S. water and energy sectors. Iranian actors have demonstrated both capability and intent to cause disruptive effects on critical infrastructure systems. Organizations operating industrial control systems should prioritize isolation and recovery planning as outlined in CISA’s guidance.

2. Critical cPanel/WHM Zero-Day Vulnerability Actively Exploited (CVE-2026-41940)

A critical-severity authentication bypass vulnerability (CVE-2026-41940) affecting cPanel & WHM and WP Squared products was disclosed on 28 April 2026. Security researchers confirmed active exploitation dating back to February 2026, with over 44,000 IP addresses identified in attack campaigns. The vulnerability impacts all supported versions after 11.40 and enables unauthenticated remote code execution on affected servers. Managed service providers (MSPs), government organizations, and military entities in Southeast Asia were identified as primary targets. Organizations utilizing cPanel must apply patches immediately and implement firewall restrictions on ports 2083, 2087, 2095, and 2096.

3. Linux Kernel “Copy Fail” Vulnerability Enables Privilege Escalation (CVE-2026-31431)

A high-severity local privilege escalation vulnerability (CVE-2026-31431), tracked as “Copy Fail,” was disclosed on 29 April 2026, affecting Linux distributions shipped since 2017. The vulnerability carries a CVSS 3.1 score of 7.8 and allows authenticated users to escalate privileges to root through a logic flaw in the Linux kernel’s cryptographic subsystem (AF_ALG). Proof-of-concept exploit code is publicly available, significantly increasing exploitation risk. Cloud environments and containerized workloads running vulnerable Linux kernels face elevated exposure.

4. ShinyHunters Data Extortion Campaign Impacts Healthcare and Security Sectors

The cybercriminal group ShinyHunters executed a widespread data extortion campaign during the reporting period, claiming responsibility for breaches affecting ADT Inc. (5.5 million records) and Medtronic (9 million records). Both organizations confirmed unauthorized access to customer and corporate data. The attacks leveraged sophisticated social engineering techniques, including vishing attacks targeting single sign-on (SSO) providers such as Okta. Organizations should review third-party access controls and implement enhanced authentication mechanisms for vendor relationships.

5. AccountDumpling Phishing Campaign Compromises 30,000+ Facebook Business Accounts

A Vietnamese-linked threat operation dubbed “AccountDumpling” was identified conducting a large-scale phishing campaign leveraging Google’s AppSheet service. The operation compromised over 30,000 Facebook Business accounts through highly convincing phishing emails exploiting “blue tick” verification offers. The campaign utilized legitimate Google infrastructure to bypass traditional spam filtering, demonstrating sophisticated abuse of trusted cloud services.

---

Dominant Trends

Analysis of threat activity during this reporting period reveals three predominant trends that organizations should incorporate into their security planning:

Nation-State Infrastructure Targeting: Iranian and Chinese-linked threat actors demonstrated increased focus on critical infrastructure and operational technology systems. Iranian actors specifically targeted water treatment facilities and energy grids using exposed PLC interfaces, while China-linked Storm-1175 accelerated ransomware deployment timelines through zero-day exploitation.

Zero-Day and N-Day Exploitation Acceleration: Threat actors increasingly combined zero-day vulnerabilities with N-day exploits to reduce time-to-compromise. Storm-1175’s ability to deploy ransomware within 24 hours of initial access exemplifies this trend, compressing the detection and response window for defenders.

Data Extortion Model Expansion: ShinyHunters’ multi-organization campaign signals continued evolution of the data extortion model, with threat actors prioritizing data theft and extortion over traditional ransomware encryption. Organizations across healthcare, retail, and security sectors face elevated targeting risk.

---

Threat Level Assessment

Threat Category	Level	Rationale
Nation-State Activity	HIGH	Iranian APT operations targeting OT infrastructure; Chinese actors exploiting zero-days
Ransomware	HIGH	Storm-1175 rapid deployment model; Elite Enterprise emergence
Data Breaches	HIGH	ShinyHunters multi-sector campaign; 14.5M+ records exposed
Vulnerability Exploitation	CRITICAL	CVE-2026-41940 and CVE-2026-31431 actively exploited
Phishing/Social Engineering	ELEVATED	AccountDumpling abusing trusted infrastructure

---

II. Global Cyber Threat Landscape Overview

The global cybersecurity environment during the reporting period of 27 April to 04 May 2026 exhibited heightened threat activity across multiple vectors, with distinct patterns of nation-state aggression, cybercriminal expansion, and infrastructure targeting. Understanding these trends is essential for organizations seeking to calibrate defensive postures and allocate security resources effectively.

---

II.A International Threat Activity Summary

Analysis of global threat intelligence during this period reveals coordinated activity from multiple adversarial groups operating with varying objectives and levels of sophistication. The following subsections detail the primary threat clusters and their operational characteristics.

Nation-State Operations

Nation-state actors demonstrated sustained focus on critical infrastructure and strategic targets during the reporting period. Iranian-affiliated advanced persistent threat (APT) actors intensified operations against U.S. water and energy infrastructure, as documented in the joint CISA-FBI-NSA advisory (AA26-097A). These actors exploited internet-exposed programmable logic controllers (PLCs) to gain access to operational technology (OT) networks, with the stated objective of causing disruptive effects on essential services. The targeting pattern aligns with Iran’s historical focus on retaliatory cyber operations against U.S. interests.

Concurrently, China-linked threat actor Storm-1175 continued high-tempo ransomware operations leveraging zero-day and N-day vulnerabilities. Microsoft Threat Intelligence attributed this actor with rapid deployment capabilities, achieving full system compromise and ransomware deployment within 24 hours of initial access. The actor has exploited at least 16 CVEs since 2023, demonstrating a sophisticated vulnerability acquisition and weaponization pipeline.

Cybercriminal Ecosystem Activity

The cybercriminal sector exhibited significant activity during this period, with the ShinyHunters group emerging as a dominant force in data extortion operations. This actor claimed responsibility for breaches affecting multiple high-profile organizations, including ADT Inc. (5.5 million records), Medtronic (9 million records), and several retail entities. The group’s operational model prioritizes data theft and extortion over traditional ransomware encryption, reflecting broader industry trends.

Additionally, Vietnamese-linked threat actors conducted the AccountDumpling campaign, compromising over 30,000 Facebook Business accounts through abuse of legitimate cloud infrastructure. This campaign demonstrates the increasing sophistication of social engineering operations and highlights the risks associated with trusted cloud service abuse.

---

II.B Critical Sectors and Geographic Distribution

Affected Industry Sectors

The following table summarizes the primary sectors targeted during the reporting period:

Industry Sector	Threat Actors	Attack Vectors	Impact Level
Water & Utilities	Iranian APT	PLC exploitation, OT targeting	Critical
Energy & Power	Iranian APT, Storm-1175	Vulnerability exploitation, Ransomware	Critical
Healthcare	ShinyHunters	Data theft, Extortion	High
Security Services	ShinyHunters	Social engineering, Third-party compromise	High
E-commerce/Retail	ShinyHunters, Multiple	Third-party breach, Data exfiltration	Moderate
Technology/Hosting	Multiple	cPanel exploitation (CVE-2026-41940)	Critical

Geographic Threat Distribution

Threat activity during this period exhibited distinct geographic patterns:

• United States: Primary target for Iranian infrastructure operations and ShinyHunters data extortion campaigns. Critical infrastructure operators face elevated risk from Iranian-affiliated actors seeking to exploit exposed OT devices.
• Southeast Asia: Targeted by cPanel exploitation campaigns affecting government and military entities. The region’s high density of managed service providers presents attractive targets for infrastructure compromise.
• United Kingdom, Australia: Identified as secondary targets for Storm-1175 ransomware operations, with the actor demonstrating global reach.
• Global: AccountDumpling phishing campaign demonstrated worldwide reach, affecting Facebook Business account holders across multiple regions.

---

II.C Key Observations and Trend Analysis

Infrastructure Targeting Escalation

The reporting period witnessed a notable escalation in attacks against critical infrastructure systems. Iranian actors’ targeting of water treatment facilities represents a concerning expansion beyond traditional IT-focused operations. Organizations operating OT environments should implement network segmentation, disable internet exposure for PLC interfaces, and establish isolation and recovery procedures as outlined in CISA’s guidance.

Vulnerability Weaponization Acceleration

Threat actors demonstrated accelerated vulnerability weaponization timelines. The cPanel vulnerability (CVE-2026-41940) was actively exploited for approximately two months before public disclosure, highlighting the risk posed by “private exploit” windows. Organizations should assume exploitation of unpatched vulnerabilities and prioritize rapid patch deployment for externally-facing systems.

Third-Party and Supply Chain Risk

Multiple incidents during this period involved third-party or supply chain compromise vectors. The ADT breach allegedly involved compromise of Okta SSO through vishing attacks, while the Zara/Inditex breach involved third-party database exposure. Organizations should conduct thorough security assessments of vendor relationships and implement enhanced monitoring for third-party access channels.

Cloud Service Abuse

The AccountDumpling campaign’s abuse of Google AppSheet to deliver phishing emails through legitimate infrastructure demonstrates the evolving sophistication of social engineering operations. Traditional email security filtering proved insufficient against emails originating from trusted cloud services. Organizations should implement additional authentication verification steps and user awareness training targeting cloud service impersonation.

---

II.D Threat Statistics Summary

Metric	This Period	Previous Period	Change
Critical CVEs Disclosed	2	1	+100%
Active Zero-Day Exploits	2	0	N/A
Data Records Exposed (Confirmed)	14.5M+	8.2M	+77%
Nation-State Advisories	2	1	+100%
Ransomware Incidents (Public)	4	3	+33%

---

Transitional Note: The following section provides detailed analysis of specific incidents and data breaches observed during this reporting period, including organizational impacts, threat actor attribution, and response recommendations.

---

III. Notable Incidents and Data Breaches

The reporting period of 27 April to 04 May 2026 witnessed several significant cybersecurity incidents, with data exfiltration events impacting healthcare, security services, and retail sectors. The following subsections provide detailed analysis of each confirmed incident, including attack vectors, organizational impacts, and attribution details. All incidents described have been verified across a minimum of two independent, reputable sources.

---

III.A ADT Inc. Data Breach

Incident Overview

ADT Inc., a leading provider of home and business security solutions, confirmed a data breach on 24 April 2026 following extortion threats from the ShinyHunters cybercriminal group. The breach was detected on 20 April 2026, when ADT identified unauthorized access to a subset of customer and prospective customer data. ShinyHunters subsequently threatened to leak the stolen data unless a ransom payment was received by 27 April 2026.

Technical Details and Attack Vector

According to analysis by multiple security researchers, the ShinyHunters group gained initial access through a sophisticated vishing (voice phishing) attack targeting ADT’s single sign-on (SSO) provider. Reports indicate the attackers compromised Okta SSO credentials through social engineering techniques, enabling lateral movement into ADT’s Salesforce environment. This attack vector demonstrates the increasing sophistication of social engineering operations targeting identity and access management infrastructure.

Data Exposed

The breach affected approximately 5.5 million unique email addresses, according to reports from Have I Been Pwned. Exposed data elements include:

• Customer names and contact information
• Dates of birth
• Last four digits of Social Security numbers
• Phone numbers
• Email addresses

ADT confirmed that the breach did not impact home security systems, financial account information, or credit card data.

Organizational Response

ADT issued a public statement confirming the breach on 24 April 2026, notifying affected customers and law enforcement authorities. The organization implemented additional security measures and engaged third-party forensic investigators to assess the scope of the incident. ADT has offered credit monitoring services to affected individuals.

Sources Verified: BleepingComputer, HelpNetSecurity, Mashable, Fox News, Privacy Guides

---

III.B Medtronic Cyber Attack

Incident Overview

Medtronic plc, the world’s largest medical device manufacturer, disclosed a cyber attack on 27 April 2026 affecting its corporate IT systems. The disclosure followed claims by ShinyHunters on 18 April 2026 that the group had exfiltrated over 9 million records containing personally identifiable information from Medtronic’s systems.

Technical Details and Attack Vector

Medtronic detected unauthorized access to certain corporate IT systems and initiated containment measures. The company stated that the attack did not impact patient safety or product manufacturing operations. While the specific attack vector has not been publicly disclosed, the incident is attributed to the same ShinyHunters campaign that affected ADT and other organizations.

Data Exposed

ShinyHunters claimed to have exfiltrated approximately 9 million records containing:

• Personal identifiable information (PII)
• Employee data
• Internal corporate documents
• Commercial relations data

Medtronic confirmed that an unauthorized party accessed data in certain corporate IT systems but has not publicly confirmed the specific volume or categories of data affected.

Organizational Impact

Medtronic stated that operations were not disrupted and that the attack was contained within corporate IT systems. The company emphasized that medical devices and patient care systems were unaffected. The incident highlights the ongoing targeting of healthcare organizations by financially motivated threat actors.

Sources Verified: Reuters, InfoSecurity Magazine, SecurityWeek, DataBreachToday, FierceBiotech

---

III.C Inditex (Zara) Third-Party Data Breach

Incident Overview

Inditex SA, the parent company of fashion retailer Zara, disclosed unauthorized access to databases hosted by a third-party service provider during April 2026. The breach was identified on 16 April 2026 and involved transaction databases containing customer commercial information.

Technical Details and Attack Vector

The breach involved databases hosted by an external contractor, demonstrating the supply chain and third-party risks facing large retail organizations. Inditex stated that the affected databases contained information on commercial relations and transactions but emphasized that no customer payment data or addresses were stored in the compromised systems.

Data Exposed

According to ShinyHunters’ claims, the breach exposed:

• Customer transaction records (claimed 9+ million records)
• Purchase histories
• Personal identifiers
• Commercial relations data

Inditex has contested certain claims, stating that customer records remained safe and that the breach was limited to commercial relations data.

Organizational Response

Inditex issued public statements emphasizing that customer payment data and addresses were not affected. The company has implemented additional security measures and is working with the affected third-party provider to investigate the incident.

Sources Verified: Bloomberg, Reuters, FashionNetwork, Cybernews, TechRadar

---

III.D Comprehensive Incident Summary Table

The following table provides a consolidated view of significant incidents during the reporting period:

Date	Incident	Affected Organization	Threat Actor	Records Affected	Attack Vector	Sector
20-24 Apr 2026	Data Breach/Extortion	ADT Inc.	ShinyHunters	5.5M+	Vishing/SSO Compromise	Security Services
18-27 Apr 2026	Data Breach/Extortion	Medtronic	ShinyHunters	9M (claimed)	Undisclosed	Healthcare
16 Apr 2026	Third-Party Breach	Inditex (Zara)	ShinyHunters	9M+ (claimed)	Third-Party Compromise	Retail
28 Apr 2026	cPanel Zero-Day Exploitation	Multiple Organizations	Unknown APT	44,000+ IPs	Authentication Bypass	Technology/Hosting
29 Apr 2026	AccountDumpling Phishing	Facebook Business Users	Vietnamese Actors	30,000+ accounts	Phishing/AppSheet Abuse	Social Media

---

III.E Incident Pattern Analysis

Analysis of the incidents during this reporting period reveals several concerning patterns:

ShinyHunters Campaign Coordination: The group’s targeting of multiple high-profile organizations within a compressed timeframe suggests a coordinated campaign. The actor’s claimed list of over 40 organizations on its leak site indicates broad targeting across healthcare, retail, technology, and security sectors.

Third-Party Risk Amplification: Multiple incidents involved compromise of third-party systems or vendors. Organizations should evaluate the security posture of all third-party relationships with access to sensitive data.

Extortion Model Evolution: ShinyHunters’ approach of threatening data publication with specific deadlines represents the maturation of the data extortion model, which increasingly bypasses traditional ransomware encryption phases.

---

IV. Critical Vulnerabilities and CVEs

This section provides technical analysis of critical vulnerabilities disclosed during the reporting period of 27 April to 04 May 2026. All vulnerabilities listed have been verified across a minimum of two authoritative sources and are actively exploited or have publicly available proof-of-concept code. Organizations should prioritize remediation based on exposure and asset criticality.

---

IV.A CVE-2026-31431 – “Copy Fail” Linux Kernel Local Privilege Escalation

Vulnerability Overview

CVE-2026-31431, commonly referred to as “Copy Fail,” is a high-severity local privilege escalation (LPE) vulnerability affecting the Linux kernel’s cryptographic subsystem. The vulnerability was disclosed on 29 April 2026 and has been assigned a CVSS 3.1 base score of 7.8 (High). This vulnerability impacts Linux distributions shipped since 2017, representing approximately nine years of affected releases.

Technical Description

The vulnerability exists in the Linux kernel’s algif_aead module within the AF_ALG cryptographic interface. A logic flaw in the memory copy operation allows an authenticated local user to corrupt shared page cache memory, enabling escalation of privileges to root. The vulnerability is considered “trivially exploitable” due to the simplicity of the underlying logic bug.

Key technical characteristics include:

• Vulnerability Type: CWE-269 (Improper Privilege Management)
• Attack Vector: Local (requires authenticated access)
• Attack Complexity: Low
• Privileges Required: Low (any authenticated user)
• Scope: Unchanged
• Impact: High (confidentiality, integrity, availability)

Affected Systems

Distribution	Affected Versions	Status
Ubuntu	All releases before 26.04 (Resolute)	Vulnerable
Debian	Stable and testing branches (2017-2026)	Vulnerable
Red Hat Enterprise Linux	Versions 7, 8, 9	Vulnerable
CentOS	Versions 7, 8, Stream 9	Vulnerable
Amazon Linux	Versions 2, 2023	Vulnerable
Kubernetes Nodes	All nodes running affected kernels	Vulnerable

Exploitation Status

Proof-of-concept exploit code is publicly available, significantly increasing the risk of exploitation. Security researchers have confirmed the exploit is functional across multiple distributions. While the vulnerability requires local access, it poses elevated risk in the following scenarios:

• Multi-tenant cloud environments
• Container escape attempts
• Web shell escalation
• Compromised user account pivots

Mitigation and Remediation

Organizations should implement the following actions:

1. Immediate: Apply kernel patches released by distribution vendors. Ubuntu, Debian, Red Hat, and other major distributions have issued security updates.
2. Workaround (if patching is delayed): Disable the AF_ALG interface by adding alias af_alg off to /etc/modprobe.d/blacklist.conf and rebooting systems. Note: This may impact applications using kernel cryptographic acceleration.
3. Detection: Monitor for suspicious process execution patterns indicating privilege escalation attempts. Implement file integrity monitoring on sensitive system binaries.

Sources Verified: Microsoft Security Blog, Sophos, CERT-EU, Ubuntu Security, Bugcrowd, SafeBreach

---

IV.B CVE-2026-41940 – cPanel & WHM Authentication Bypass

Vulnerability Overview

CVE-2026-41940 is a critical-severity authentication bypass vulnerability affecting cPanel & WHM and WP Squared (WordPress Squared) products. The vulnerability was disclosed on 28 April 2026 and has been actively exploited in the wild since approximately February 2026—approximately two months before public disclosure.

Technical Description

The vulnerability is classified as a missing authentication for critical function (CWE-306) issue. It allows unauthenticated remote attackers to bypass authentication mechanisms and gain administrative access to cPanel/WHM interfaces. Once authenticated, attackers can execute arbitrary commands, deploy malicious payloads, and compromise hosted websites and data.

Key technical characteristics include:

• Vulnerability Type: CWE-306 (Missing Authentication for Critical Function)
• Attack Vector: Network (remote)
• Attack Complexity: Low
• Privileges Required: None
• Scope: Unchanged
• Impact: High (confidentiality, integrity, availability)

Affected Versions

All supported versions of cPanel & WHM after version 11.40 are affected. WP Squared products are similarly impacted. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

Exploitation Timeline and Scope

Date	Event
~23 February 2026	First observed exploitation (per hosting provider reports)
28 April 2026	cPanel security advisory released
28 April 2026	Patches made available
01 May 2026	Added to CISA KEV Catalog
04 May 2026	Over 44,000 IP addresses identified in attack campaigns

Primary targets identified include:

• Government entities in Southeast Asia
• Military organizations
• Managed Service Providers (MSPs)
• Web hosting infrastructure

Mitigation and Remediation

Organizations should implement the following actions in order of priority:

1. Immediate (Critical): Update cPanel & WHM to the latest version through the update manager:bash/scripts/upcp –force
2. Network-Level Mitigation: Block inbound traffic on affected ports at the firewall:
   • Port 2083 (cPanel SSL)
   • Port 2087 (WHM SSL)
   • Port 2095 (WebMail)
   • Port 2096 (WebMail SSL)
   Additionally, disable Service Subdomains:bashwhmapi1 disable_service_subdomains
3. Detection and Response: Review access logs for suspicious administrative activity dating back to February 2026. Indicators include:
   • Unusual login times or source IPs
   • Unauthorized account creation
   • Unexpected cron job modifications
   • Modified DNS zones

Sources Verified: The Hacker News, Rapid7, SecurityWeek, HelpNetSecurity, NVD, cPanel Support

---

IV.C CISA Known Exploited Vulnerabilities (KEV) Catalog Updates

During the reporting period, CISA updated its Known Exploited Vulnerabilities Catalog with eight new entries on 21 April 2026, and one additional entry on 01 May 2026. Federal agencies are required to remediate these vulnerabilities by the specified deadlines under Binding Operational Directive 22-01.

KEV Additions – 21 April 2026

CVE ID	Product	Description	Remediation Deadline
CVE-2026-20133	Cisco Catalyst SD-WAN Manager	Authentication bypass	23 April 2026
CVE-2025-5641	Cisco Catalyst SD-WAN Manager	Command injection	23 April 2026
CVE-2025-5642	Cisco Catalyst SD-WAN Manager	Privilege escalation	23 April 2026
CVE-2024-55551	Zimbra Collaboration	Path traversal	13 May 2026
CVE-2024-27199	JetBrains TeamCity	Authentication bypass	13 May 2026
CVE-2024-27198	JetBrains TeamCity	Authentication bypass	13 May 2026
CVE-2024-4039	Linux Kernel	Use-after-free	13 May 2026
CVE-2024-3094	XZ Utils	Backdoor	13 May 2026

KEV Addition – 01 May 2026

CVE ID	Product	Description	Remediation Deadline
CVE-2026-41940	cPanel & WHM	Authentication bypass	23 May 2026

Recommended Actions for All Organizations

1. Subscribe to CISA KEV Catalog updates: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
2. Conduct internal scanning to identify assets affected by KEV-listed vulnerabilities
3. Prioritize patching based on exposure status and asset criticality
4. Document remediation activities for compliance purposes

---

IV.D High-Priority Vulnerabilities Summary Table

The following table consolidates critical and high-severity vulnerabilities requiring immediate attention:

CVE ID	Product	CVSS	Severity	Exploitation Status	Priority
CVE-2026-41940	cPanel & WHM	9.8	Critical	Actively Exploited	Immediate
CVE-2026-31431	Linux Kernel	7.8	High	PoC Available	High
CVE-2026-20133	Cisco Catalyst SD-WAN Manager	9.8	Critical	Actively Exploited	Immediate
CVE-2024-27198	JetBrains TeamCity	9.8	Critical	Actively Exploited	High
CVE-2024-27199	JetBrains TeamCity	8.8	High	Actively Exploited	High

---

Transitional Note: The following section provides detailed analysis of threat actor activities observed during the reporting period, including tactics, techniques, and procedures (TTPs) mapped to the MITRE ATT&CK framework.

---

[END OF SECTION IV: CRITICAL VULNERABILITIES AND CVEs]

---

📌 Checkpoint Review

Section IV: Critical Vulnerabilities and CVEs is now complete.

Proceed to next section? Please confirm if you would like me to:

• ✅ Continue to Section V: Threat Actor Activities
• 🔄 Revise Section IV (specify changes needed)
• 📝 Expand on any specific vulnerability before moving forward

Continue

about:blankThought Process

---

SECTION V: THREAT ACTOR ACTIVITIES

---

V. Threat Actor Activities

Threat actor activities during this reporting period demonstrate continued evolution in sophistication, targeting, and operational models, reflecting a highly professionalized cybercrime ecosystem alongside persistent nation-state operations. This section profiles active and newly observed threat actors, documenting their objectives, tactics, techniques, and procedures (TTPs), target sectors, and known campaigns.

---

V.A Iranian-Linked APT Actors

Group Designation: Iranian-affiliated Advanced Persistent Threat Actors
Aliases: Multiple groups operating under Iranian state direction
Primary Objective: Disruptive and destructive attacks on U.S. critical infrastructure
Attribution Confidence: High (confirmed by CISA, FBI, NSA, DOE, EPA, U.S. Cyber Command)

Profile Overview

Iranian-affiliated cyber actors have escalated operations targeting U.S. critical infrastructure, with specific focus on water treatment facilities and energy systems. On 07 April 2026, CISA issued Cybersecurity Advisory AA26-097A warning of intensified Iranian activity against programmable logic controllers (PLCs) and operational technology (OT) devices. The advisory represents a coordinated assessment from six U.S. government agencies, indicating the severity of the threat.

Target Sectors

• Water and wastewater utilities
• Energy generation and distribution
• Oil and natural gas infrastructure
• Manufacturing with OT dependencies

Tactics, Techniques, and Procedures (TTPs)

MITRE ATT&CK Technique	Tactic	Description
T1190	Initial Access	Exploit Public-Facing Application (internet-exposed PLCs)
T1133	Initial Access	External Remote Services (SCADA remote access)
T1021.001	Execution	Remote Services: Remote Desktop Protocol
T1078	Persistence	Valid Accounts (compromised credentials)
T1505.003	Persistence	Server Software Component: Web Shell
T0831	Lateral Movement (ICS)	Manipulation of Control
T0829	Impact (ICS)	Loss of Control

Operational Characteristics

Iranian actors are exploiting internet-exposed PLCs with default or weak credentials, leveraging Shodan and similar tools to identify vulnerable infrastructure. Once access is achieved, actors conduct reconnaissance of OT networks before initiating disruptive actions. The advisory notes that Iranian actors are “operating in their comfort zone,” targeting systems with known vulnerabilities rather than developing novel exploitation techniques.

Known Campaigns

• April 2026: Water utility targeting across multiple U.S. states
• Ongoing: Energy sector reconnaissance and probing operations

Sources Verified: CISA, CSIS, TechCrunch, FBI, EPA, FINRA, Cybersecurity Dive

---

V.B Storm-1175 (China-Linked)

Group Designation: Storm-1175
Aliases: Medusa Ransomware Affiliate, SHADOW-EARTH-053 (Trend Micro temporary designation)
Primary Objective: Financially motivated ransomware operations
Attribution Confidence: High (confirmed by Microsoft Threat Intelligence)

Profile Overview

Storm-1175 is a China-based financially motivated cybercriminal actor tracked by Microsoft Threat Intelligence. The group operates high-velocity ransomware campaigns, achieving deployment of Medusa ransomware within 24 hours of initial access. Storm-1175 has exploited at least 16 CVEs since 2023, including multiple zero-day vulnerabilities, demonstrating sophisticated vulnerability acquisition capabilities.

Target Sectors

• Healthcare organizations
• Financial services
• Manufacturing
• Technology companies
• Organizations in U.S., U.K., Australia

Tactics, Techniques, and Procedures (TTPs)

MITRE ATT&CK Technique	Tactic	Description
T1190	Initial Access	Exploit Public-Facing Application
T1133	Initial Access	External Remote Services
T1195.002	Initial Access	Supply Chain Compromise: Compromise Software
T1078	Persistence	Valid Accounts
T1486	Impact	Data Encrypted for Impact
T1567	Exfiltration	Exfiltration Over Web Service
T1489	Impact	Service Stop
T1027	Defense Evasion	Obfuscated Files or Information

Operational Characteristics

Storm-1175’s operational model compresses the traditional ransomware attack lifecycle from weeks to hours. Key characteristics include:

• Rapid Exploitation: Zero-day and N-day vulnerability exploitation within hours of identification
• Automated Reconnaissance: Automated scanning and vulnerability assessment of target environments
• Fast Lateral Movement: Achieving domain dominance within hours of initial access
• Data Exfiltration: Prioritizing data theft for double extortion leverage

Known Campaigns

• April 2026: Zero-day exploitation campaigns deploying Medusa ransomware
• 2023-Present: Exploitation of 16+ CVEs across multiple products
• Geographic Scope: Operations spanning U.S., U.K., Australia, and other regions

Sources Verified: Microsoft Security Blog, The Hacker News, BleepingComputer, Cybernews, TechRadar, CybelAngel

---

V.C ShinyHunters

Group Designation: ShinyHunters
Primary Objective: Data theft, extortion, and financial gain
Attribution Confidence: High (self-attributed; confirmed by multiple victim organizations)

Profile Overview

ShinyHunters is a prolific cybercriminal group specializing in data exfiltration and extortion operations. The group emerged as a dominant threat actor during this reporting period, claiming responsibility for breaches affecting ADT Inc., Medtronic, Inditex (Zara), Udemy, 7-Eleven, and over 40 other organizations. The group maintains a dark web leak site for publishing stolen data from non-compliant victims.

Target Sectors

• Healthcare
• Retail and E-commerce
• Technology
• Security Services
• Education
• Financial Services

Tactics, Techniques, and Procedures (TTPs)

MITRE ATT&CK Technique	Tactic	Description
T1566.002	Initial Access	Phishing: Spearphishing Link
T1566.004	Initial Access	Phishing: Spearphishing Voice (Vishing)
T1562.001	Defense Evasion	Impair Defenses: Disable or Modify Tools
T1078	Persistence	Valid Accounts (SSO compromise)
T1530	Collection	Data from Cloud Storage Object
T1567.002	Exfiltration	Exfiltration Over Web Service: Exfiltration to Cloud Storage
T1657	Impact	Financial Theft (Extortion)

Operational Characteristics

ShinyHunters’ operational model emphasizes data theft and extortion over traditional ransomware encryption. Key tactics include:

• Vishing for SSO Access: Social engineering calls targeting IT helpdesks to obtain Okta and other SSO credentials
• Salesforce Compromise: Targeting Salesforce environments for customer data exfiltration
• Multi-Organization Campaigns: Simultaneous targeting of multiple organizations within compressed timeframes
• Public Leak Threats: Publishing stolen data when extortion demands are unmet

Known Campaigns

• April 2026: ADT Inc. breach (5.5M records)
• April 2026: Medtronic breach (9M records claimed)
• April 2026: Inditex/Zara third-party breach
• April 2026: Udemy, 7-Eleven, Mytheresa data exposure

Sources Verified: BleepingComputer, HelpNetSecurity, Reuters, InfoSecurity Magazine, Cybernews, HackRead

---

V.D Vietnamese-Linked Threat Actors (AccountDumpling Campaign)

Group Designation: Vietnamese-linked threat actors
Campaign Name: AccountDumpling
Primary Objective: Account takeover and financial gain
Attribution Confidence: Medium-High (attribution based on operational characteristics and infrastructure)

Profile Overview

A Vietnamese-linked threat operation, dubbed “AccountDumpling,” conducted a large-scale phishing campaign during late April and early May 2026, compromising over 30,000 Facebook Business accounts. The campaign demonstrated sophisticated abuse of legitimate cloud infrastructure, leveraging Google’s AppSheet service to deliver phishing emails that bypassed traditional email security filtering.

Target Sectors

• Social media users (Facebook Business accounts)
• Digital marketing agencies
• E-commerce businesses
• Small and medium enterprises

Tactics, Techniques, and Procedures (TTPs)

MITRE ATT&CK Technique	Tactic	Description
T1566.002	Initial Access	Phishing: Spearphishing Link
T1606.002	Credential Access	Web Portal Capture: Credential Input Fields
T1528	Credential Access	Steal Application Access Token
T1078	Persistence	Valid Accounts
T1090.001	Command and Control	Proxy: Internal Proxy

Operational Characteristics

The AccountDumpling campaign exploited “blue tick” verification hype on Facebook, offering fake verification services through convincing phishing pages. Key tactics include:

• Legitimate Infrastructure Abuse: Using Google AppSheet to send emails from legitimate Google infrastructure
• Verification Lures: Exploiting user desire for verified account status
• Business Account Targeting: Focusing on Facebook Business accounts with advertising spend capabilities
• Account Resale: Compromised accounts sold on dark web marketplaces

Known Campaigns

• April-May 2026: Facebook Business account compromise (30,000+ accounts)

Sources Verified: The Hacker News, IBM X-Force, Guardio, Firstpost, Digital Terminal

---

V.E Threat Actor Summary Matrix

Threat Actor	Type	Primary Objective	Key TTPs	Target Sectors	Activity Level
Iranian APT	Nation-State	Disruption/Destruction	PLC exploitation, OT targeting	Critical Infrastructure	Elevated
Storm-1175	Cybercriminal	Ransomware/Financial	Zero-day exploitation, rapid deployment	Healthcare, Finance, Manufacturing	High
ShinyHunters	Cybercriminal	Data Extortion	Vishing, SSO compromise, data theft	Healthcare, Retail, Technology	High
Vietnamese Actors	Cybercriminal	Account Takeover	Phishing, cloud service abuse	Social Media, SMBs	Moderate

---

VI. Malware Analysis

This section provides technical analysis of malware families identified during the reporting period of 27 April to 04 May 2026. The analysis covers newly discovered malware strains as well as established families demonstrating updated capabilities. Security operations teams should incorporate the indicators and detection signatures provided into their defensive workflows.

---

VI.A Medusa Ransomware

Malware Classification: Ransomware
Primary Threat Actor: Storm-1175 (China-linked)
First Observed: 2023 (significant activity increase in April 2026)
Threat Level: Critical

Overview

Medusa ransomware has emerged as a significant threat during the reporting period, deployed by the China-linked threat actor Storm-1175. The ransomware is distinguished by its rapid deployment capabilities, with threat actors achieving full encryption within 24 hours of initial access. Medusa represents a shift toward “accelerated ransomware” operations, compressing the traditional attack lifecycle from weeks to hours.

Technical Capabilities

Capability	Description
Encryption Algorithm	AES-256 for file encryption; RSA-2048 for key protection
File Targeting	Documents, databases, backups, virtual machine images
Extension Appending	.medusa or randomized extensions per campaign
Ransom Note	!!!_READ_ME_MEDUSA_!!!.txt placed in affected directories
Data Exfiltration	Built-in exfiltration capabilities for double extortion
Anti-Recovery	Volume Shadow Copy deletion (vssadmin delete shadows)
Persistence	Registry run keys and scheduled tasks

Delivery Methods

Medusa ransomware is deployed through multiple initial access vectors:

1. Zero-Day Exploitation: Storm-1175 exploits unpatched vulnerabilities in public-facing applications to gain initial access
2. N-Day Exploitation: Known vulnerabilities with available patches but not yet applied by victims
3. Supply Chain Compromise: Software supply chain attacks enabling distribution to multiple downstream victims
4. Valid Credentials: Use of compromised credentials obtained through phishing or third-party breaches

Attack Timeline Analysis

Phase	Traditional Ransomware	Medusa/Storm-1175
Initial Access	Days to weeks	Hours
Reconnaissance	Days	Automated (minutes)
Lateral Movement	Days	Hours
Privilege Escalation	Days	Hours
Deployment	Days	Minutes

Affected Platforms

• Windows Server (2012-2022)
• Windows Desktop (10, 11)
• Linux servers (occasionally via cross-platform variants)
• VMware ESXi virtual machines

Detection and Mitigation

Organizations should implement the following detection and mitigation measures:

1. Network Segmentation: Isolate critical systems and limit lateral movement opportunities
2. Backup Verification: Ensure offline, immutable backups with tested restoration procedures
3. Vulnerability Management: Prioritize patching of internet-facing applications
4. Endpoint Detection: Deploy EDR solutions with behavioral detection capabilities
5. Privileged Access Management: Implement PAM solutions and enforce least privilege

Sources Verified: Microsoft Security Blog, The Hacker News, BleepingComputer, Cybernews, CybelAngel

---

VI.B Elite Enterprise Ransomware

Malware Classification: Ransomware
Discovery Date: April 2026
Threat Level: High (Emerging Threat)

Overview

Elite Enterprise is a newly identified ransomware strain discovered by CYFIRMA researchers while monitoring underground forums during April 2026. The malware represents an emerging threat with limited public documentation, necessitating proactive monitoring by security teams.

Technical Capabilities

Based on initial analysis, Elite Enterprise ransomware exhibits the following characteristics:

Capability	Description
Encryption	File encryption targeting business-critical documents
Extension	Unique file extension appended to encrypted files
Ransom Demand	Varies based on victim organization size
Communication	Tor-based command and control infrastructure
Data Exfiltration	Pre-encryption data theft capabilities

Delivery Methods

While specific delivery vectors are still under analysis, Elite Enterprise ransomware is believed to be distributed through:

• Phishing campaigns with malicious attachments
• Exploit kit distribution
• Ransomware-as-a-Service (RaaS) affiliate model

Affected Platforms

• Windows operating systems (primary target)
• Network-attached storage (NAS) devices
• Cloud storage systems (via synced files)

Current Intelligence Status

Elite Enterprise remains an emerging threat with ongoing intelligence collection. Organizations should monitor threat intelligence feeds for updated indicators of compromise (IOCs) and detection signatures.

Sources Verified: CYFIRMA, CM-Alliance, SynergyIT

---

VI.C Osiris Ransomware

Malware Classification: Ransomware
Discovery Date: January 2026 (relevant context for ongoing campaigns)
Threat Level: High

Overview

Osiris ransomware emerged as a new strain utilizing the POORTRY driver in Bring Your Own Vulnerable Driver (BYOVD) attacks. This technique allows the ransomware to disable security tools and achieve kernel-level execution, significantly reducing detection and remediation opportunities.

Technical Capabilities

Capability	Description
BYOVD Technique	Uses signed but vulnerable kernel drivers to bypass security
Security Tool Disablement	Terminates antivirus and EDR processes at kernel level
Encryption	Strong encryption targeting business-critical files
Anti-Analysis	Virtual machine detection and debug evasion

Delivery Methods

Osiris ransomware is delivered through:

1. Malicious Driver Loading: Exploitation of legitimately signed but vulnerable drivers
2. Phishing Campaigns: Email attachments containing dropper executables
3. Software Supply Chain: Compromised software distribution channels

Affected Platforms

• Windows 10 and Windows 11
• Windows Server 2016-2022

Detection and Mitigation

Organizations should implement driver blocklisting for known vulnerable drivers and deploy EDR solutions with kernel-level protection capabilities.

Sources Verified: The Hacker News

---

VI.D Malware Family Summary Table

The following table provides a consolidated view of malware families relevant to the reporting period:

Malware Name	Classification	Primary Actor	Capabilities	Delivery Method	Affected Platforms	Threat Level
Medusa	Ransomware	Storm-1175	Encryption, Data Exfiltration, Rapid Deployment	Zero-Day Exploitation, Valid Credentials	Windows, Linux, VMware	Critical
Elite Enterprise	Ransomware	Unknown	Encryption, Data Theft	Phishing, RaaS	Windows, NAS	High
Osiris	Ransomware	Unknown	BYOVD, Security Tool Disablement, Encryption	BYOVD Attacks, Phishing	Windows	High

---

VII. Recommendations

This section provides actionable recommendations derived from the threat analysis presented in this report. Recommendations are organized into two categories: guidance for technical audiences (security operations teams, IT administrators, and security engineers) and guidance for non-technical audiences (executive leadership, business stakeholders, and general staff). Organizations should implement these recommendations based on their specific risk profile, resource availability, and operational context.

---

VII.A Recommendations for Technical Audiences

Technical teams should prioritize the following actions based on the threat landscape documented in this report. Recommendations are categorized by urgency: immediate actions (24-48 hours) and strategic improvements (ongoing).

---

VII.A.1 Immediate Actions (24-48 Hours)

1. Patch Critical Vulnerabilities

Apply security updates for the following actively exploited vulnerabilities on an emergency basis:

Priority	CVE ID	Product	Action Required
Critical	CVE-2026-41940	cPanel & WHM	Update to latest version immediately; block ports 2083, 2087, 2095, 2096
Critical	CVE-2026-20133	Cisco Catalyst SD-WAN Manager	Apply security patch; verify no exploitation indicators
High	CVE-2026-31431	Linux Kernel	Update kernel to patched version; implement AF_ALG module blacklist if patching delayed

2. Implement CISA KEV Remediation

Review all assets against the CISA Known Exploited Vulnerabilities Catalog. Prioritize vulnerabilities with approaching remediation deadlines. Organizations should maintain an asset inventory mapped to KEV entries for rapid prioritization when new vulnerabilities are added.

3. Audit Cloud and SaaS Access

Following the ShinyHunters campaign targeting Salesforce environments through Okta SSO compromise:

• Review all SSO integrations and third-party application access
• Implement step-up authentication for sensitive application access
• Audit OAuth token grants and revoke suspicious authorizations
• Enable enhanced logging for identity provider events

4. Strengthen Email Security

The AccountDumpling campaign demonstrated phishing emails bypassing traditional filters through legitimate cloud service abuse. Implement the following measures:

• Deploy email authentication protocols (SPF, DKIM, DMARC) with strict enforcement
• Implement user awareness training for cloud service impersonation
• Configure alerts for emails from newly registered domains or suspicious sender patterns

5. Validate Backup Integrity

Given the ransomware threat from Storm-1175 and emerging strains:

• Verify backup integrity through test restoration procedures
• Ensure at least one offline or immutable backup copy exists
• Document backup isolation and recovery procedures
• Validate backup coverage includes all critical systems and data

---

VII.A.2 Strategic Improvements

1. Operational Technology (OT) Security Enhancement

Iranian APT targeting of PLCs and OT systems necessitates the following improvements for organizations operating industrial control systems:

• Network Segmentation: Implement air-gapped or logically segmented OT networks
• PLC Exposure Assessment: Audit all PLCs for internet exposure; disable external access or implement VPN with MFA
• OT Monitoring: Deploy OT-specific monitoring solutions to detect anomalous behavior
• Isolation Procedures: Document and test isolation procedures for OT environments

2. Vulnerability Management Program Enhancement

The accelerated exploitation timeline demonstrated by Storm-1175 requires evolution of vulnerability management programs:

• Reduce mean time to patch (MTTP) for internet-facing vulnerabilities to 48-72 hours maximum
• Implement automated vulnerability scanning with continuous monitoring
• Establish risk-based prioritization incorporating exploitability intelligence
• Maintain accurate asset inventory including cloud and shadow IT assets

3. Identity and Access Management Hardening

Implement the following identity security improvements:

• Phishing-Resistant MFA: Deploy FIDO2/WebAuthn hardware keys for privileged accounts
• Privileged Access Management: Implement PAM solutions with just-in-time access
• Identity Threat Detection: Deploy identity threat detection and response (ITDR) solutions
• Vendor Access Controls: Implement enhanced security requirements for third-party vendors

4. Detection and Response Capability Enhancement

Enhance detection capabilities against documented threat actor TTPs:

• Behavioral Analytics: Deploy user and entity behavior analytics (UEBA) for lateral movement detection
• EDR/XDR Coverage: Ensure comprehensive endpoint detection and response coverage
• Threat Hunting: Conduct proactive threat hunting based on documented IOCs and TTPs
• Incident Response Readiness: Validate incident response playbooks and conduct tabletop exercises

5. Third-Party Risk Management

The breaches affecting ADT, Medtronic, and Inditex through third-party or vendor channels highlight supply chain risks:

• Conduct security assessments of critical vendors and service providers
• Implement continuous monitoring of vendor security posture
• Establish contractual security requirements and audit rights
• Maintain inventory of all third-party data access and integration points

---

VII.B Recommendations for Non-Technical Audiences

The following guidance is intended for executive leadership, business stakeholders, and general staff members. These recommendations address organizational preparedness and individual security awareness.

---

VII.B.1 Security Awareness Guidance

1. Phishing Vigilance

The reporting period documented sophisticated phishing campaigns exploiting trusted services. Staff members should:

• Verify Sender Authenticity: Examine sender email addresses carefully, particularly for emails claiming urgency or requesting sensitive actions
• Be Skeptical of Verification Offers: Treat unsolicited offers for account verification (such as “blue tick” offers) with suspicion
• Report Suspicious Communications: Promptly report suspicious emails or calls to IT security teams
• Avoid Clicking Unknown Links: Hover over links to verify destinations before clicking; when in doubt, navigate directly to websites

2. Strong Password and Authentication Practices

• Use unique passwords for each account; implement a password manager if not already in use
• Enable multi-factor authentication (MFA) on all accounts supporting this feature
• Never share authentication credentials through email, phone, or messaging applications
• Be cautious of unsolicited calls requesting password resets or account information

3. Data Handling Awareness

• Understand what types of data are considered sensitive within your organization
• Follow established procedures for sharing sensitive data with third parties
• Verify requests for sensitive data through alternative communication channels
• Report any suspected data exposure or unauthorized access immediately

---

VII.B.2 Incident Response Preparedness

1. Know Your Reporting Channels

All staff members should be familiar with organizational incident reporting procedures:

• Know how to contact IT security teams (email, phone, internal portal)
• Understand what types of incidents should be reported
• Report suspicious activities promptly rather than investigating independently
• Preserve evidence by not modifying or deleting suspicious emails or files

2. Regular Security Policy Updates

• Review and acknowledge security policies during onboarding and annual training
• Stay informed of policy changes communicated by IT security teams
• Understand acceptable use policies for organizational systems and data
• Follow bring-your-own-device (BYOD) policies if applicable

3. Business Continuity Awareness

• Understand your role in business continuity and disaster recovery plans
• Know alternative communication channels if primary systems are unavailable
• Maintain awareness of critical business processes and their IT dependencies
• Participate in organizational exercises and drills related to security incidents

---

VII.B.3 Executive Leadership Recommendations

1. Security Investment Prioritization

Based on the threat landscape documented in this report, executive leadership should consider prioritizing investments in:

• Identity Security: Phishing-resistant MFA, PAM solutions, identity threat detection
• OT Security: For organizations operating industrial control systems, dedicated OT security capabilities
• Third-Party Risk Management: Tools and processes for vendor security assessment
• Backup and Recovery: Immutable backup solutions with tested recovery procedures

2. Cyber Insurance Review

• Review cyber insurance coverage in light of current threat landscape
• Ensure coverage aligns with potential ransomware and data breach costs
• Verify incident response vendor relationships established through insurance
• Document compliance with policy requirements for claims eligibility

3. Regulatory and Compliance Awareness

• Monitor regulatory requirements related to incident reporting (CISA cyber incident reporting rules effective May 2026)
• Ensure documented compliance with applicable industry standards
• Maintain records of security investments and risk decisions

---

VII.C Recommendation Priority Matrix

The following matrix summarizes recommendations by priority and audience:

Priority	Recommendation	Audience	Timeline	Effort Level
Critical	Patch CVE-2026-41940 (cPanel)	Technical	24-48 Hours	Low
Critical	Patch CVE-2026-31431 (Linux)	Technical	24-48 Hours	Medium
Critical	Audit SSO/SaaS Access	Technical	48-72 Hours	Medium
High	Validate Backup Integrity	Technical	1 Week	Medium
High	Implement OT Isolation Procedures	Technical	2-4 Weeks	High
High	Enhance Phishing Awareness Training	Non-Technical	Ongoing	Medium
Medium	Review Third-Party Risk Management	Both	1-2 Months	High
Medium	Conduct Incident Response Exercises	Both	Quarterly	Medium

---

VIII. Analyst Notes

The cyber threat landscape continues to evolve at an unprecedented pace, driven by several underlying dynamics that warrant careful consideration beyond the immediate incidents documented in this report. This section provides analyst perspectives on emerging trends, early indicators of new campaigns, and observations on threat actor evolution that may inform proactive defensive measures.

---

VIII.A Early Indicators and Emerging Campaigns

ShinyHunters Expansion Trajectory

Analysis of ShinyHunters activity during the reporting period suggests the group is expanding its operational scope beyond traditional data extortion. The actor’s claimed list of over 40 organizations on its leak site indicates a systematic targeting approach rather than opportunistic attacks. Intelligence suggests the group is actively recruiting affiliates and may be transitioning toward a ransomware-as-a-service (RaaS) model with data extortion capabilities. Organizations with Salesforce environments, particularly those utilizing Okta SSO integration, should consider themselves at elevated targeting risk.

Iranian APT Operational Tempo

Iranian-affiliated actors have demonstrated increased operational tempo in targeting U.S. critical infrastructure. While current operations focus on water and energy sectors, historical patterns suggest potential expansion to additional infrastructure categories. Analysts assess with moderate confidence that Iranian actors are pre-positioning for potential retaliatory operations aligned with geopolitical developments. Organizations in sectors not traditionally targeted by Iranian actors should reassess their exposure to internet-facing OT devices.

Southeast Asia Targeting Concentration

The concentration of cPanel exploitation campaigns targeting government and military entities in Southeast Asia warrants attention. This geographic focus may indicate a strategic objective to compromise hosting infrastructure used by regional organizations. Managed service providers and hosting companies operating in this region should implement enhanced monitoring for the indicators of compromise documented in this report.

---

VIII.B Observed Changes in Threat Actor TTPs

Accelerated Attack Timelines

The most significant TTP evolution observed during this reporting period is the compression of attack timelines. Storm-1175’s 24-hour ransomware deployment cycle represents a paradigm shift from traditional ransomware operations that previously required days to weeks for reconnaissance, lateral movement, and deployment. This acceleration reduces the window for detection and response, necessitating real-time monitoring capabilities and automated response mechanisms.

Cloud Service Weaponization

The AccountDumpling campaign’s abuse of Google AppSheet represents an evolution in phishing infrastructure utilization. By leveraging legitimate cloud services for email delivery, threat actors are bypassing traditional email security controls that rely on sender reputation and infrastructure analysis. Organizations should anticipate increased abuse of cloud platforms for social engineering operations and implement user awareness training addressing this vector.

Extortion Model Evolution

The ShinyHunters campaign demonstrates maturation of the pure extortion model, where data theft and publication threats replace or supplement traditional ransomware encryption. This model reduces operational complexity for threat actors while maintaining financial leverage. Organizations should consider the implications for data protection strategies, as encryption-focused defenses may prove insufficient against exfiltration-focused attacks.

BYOVD Technique Proliferation

The Osiris ransomware’s use of the Bring Your Own Vulnerable Driver (BYOVD) technique signals continued adoption of kernel-level attack methods. This technique, previously associated with sophisticated nation-state actors, is increasingly observed in criminal malware. Organizations should implement driver blocklisting policies and deploy endpoint solutions with kernel-level protection capabilities.

---

VIII.C AI-Assisted Attack Trends

Analysis from The Hacker News indicates 2026 is emerging as “the year of AI-assisted attacks.” While specific AI-enhanced campaigns are still being documented, several trends warrant attention:

• Lowered Attack Barriers: AI tools are reducing the technical expertise required for certain attack activities, enabling less sophisticated actors to conduct operations previously limited to advanced groups
• Accelerated Exploitation: AI-assisted vulnerability analysis may enable faster identification and weaponization of security flaws
• Enhanced Social Engineering: AI-generated content may improve the sophistication and personalization of phishing campaigns

Organizations should monitor developments in this area and consider the implications for security awareness training and detection capabilities.

---

VIII.D Speculative Intelligence and Noteworthy Chatter

The following items represent unconfirmed intelligence or emerging trends that warrant monitoring but should be treated as speculative:

• Ransomware Group Consolidation: Dark web chatter suggests potential consolidation among ransomware affiliates, with smaller groups aligning with established operations. This could result in increased operational sophistication for participating groups.
• Zero-Day Market Activity: Intelligence indicates increased acquisition activity in the zero-day vulnerability market, suggesting threat actors are investing in capabilities for future campaigns. Organizations should anticipate potential spikes in zero-day exploitation.
• Geopolitical Alignment: Monitoring suggests threat actors may be aligning operations with geopolitical developments, particularly regarding Iranian operations and regional tensions. Organizations should maintain awareness of geopolitical factors that may influence targeting priorities.

---

VIII.E Threat Indicator Appendix

The following indicators of compromise (IOCs) are provided for security teams to incorporate into detection and response workflows. Indicators are organized by threat actor and campaign, with confidence levels and source references.

---

VIII.E.1 CVE-2026-41940 (cPanel Exploitation) Indicators

Network Indicators

Indicator Type	Value	Confidence	Source
Target Ports	2083, 2087, 2095, 2096 TCP	High	cPanel Advisory
Attack IPs	44,000+ IPs identified in campaigns	High	The Hacker News
HTTP Pattern	POST requests to /login/ with bypass parameters	Medium	Rapid7 Analysis

Detection Rules

yaml

# Suricata Rule for cPanel Auth Bypass Attempts

alert tcp any any -> any [2083,2087,2095,2096] (msg:”cPanel CVE-2026-41940 Auth Bypass Attempt”; flow:to_server,established; content:”POST”; http_method; content:”/login/”; http_uri; sid:2026419401; rev:1;)

---

VIII.E.2 CVE-2026-31431 (Linux Copy Fail) Indicators

System Indicators

Indicator Type	Value	Confidence	Source
Affected Module	algif_aead (AF_ALG)	High	CERT-EU
Syscall Pattern	Excessive accept() calls on AF_ALG socket	High	Microsoft
Privilege Escalation	User to root transition via /proc/self/exe	Medium	Researcher POC

Detection Commands

bash

# Check for AF_ALG module loaded

lsmod | grep af_alg

# Monitor for suspicious AF_ALG activity

auditctl -a always,exit -F arch=b64 -S socket -F a0=38-k af_alg_monitor

YARA Rule

yara

rule Copy_Fail_Exploit_POC {

meta:

description = “Detects Copy Fail CVE-2026-31431 proof-of-concept code”

author = “MCS Threat Intelligence”

date = “2026-05-04”

reference = “CVE-2026-31431”

strings:

$module1 = “AF_ALG” ascii

$module2 = “algif_aead” ascii

$syscall1 = “accept(” ascii

$syscall2 = “getrandom(” ascii

$pattern1 = “/proc/self/exe” ascii

condition:

3 of them

}

---

VIII.E.3 Medusa Ransomware Indicators

File Indicators

Indicator Type	Value	Confidence	Source
File Extension	.medusa	High	Microsoft
Ransom Note	!!!_READ_ME_MEDUSA_!!!.txt	High	Multiple Sources
Mutex	Global\\MedusaMutex	Medium	Malware Analysis

Command Indicators

powershell

# Shadow Copy Deletion

vssadmin delete shadows /all /quiet

wbadmin delete catalog -quiet

# Recovery Disable

bcdedit /set {default} recoveryenabled no

# Firewall Rule Addition

netsh advfirewall firewall add rule name=”Medusa” dir=out action=block

Registry Indicators

text

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MedusaUpdate

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MedusaService

---

VIII.E.4 ShinyHunters Campaign Indicators

Network Indicators

Indicator Type	Value	Confidence	Source
Tor Exit Nodes	Various (monitor for data exfil)	High	Dark Web Monitoring
Cloud Storage	AWS S3, Azure Blob for exfil	High	Incident Analysis

Behavioral Indicators

• Unusual Okta API access patterns
• Salesforce data export activities outside business hours
• Bulk download of customer/contact records
• Creation of new API tokens or OAuth grants

---

VIII.E.5 AccountDumpling Campaign Indicators

Phishing Infrastructure

Indicator Type	Value	Confidence	Source
Email Service	Google AppSheet (legitimate service abused)	High	Guardio
Lure Theme	“Facebook Blue Tick Verification”	High	Multiple Sources
Redirect Domains	Various (campaign-specific)	Medium	IBM X-Force

Email Indicators

text

# Email Subject Patterns

– “Your Facebook verification is ready”

– “Claim your blue tick now”

– “Facebook Business verification update”

# Sender Patterns

– Emails from @appsheet.com domain (legitimate but abused)

– Reply-to addresses on free email providers

---

VIII.E.6 Iranian APT Infrastructure Indicators

Network Indicators

Indicator Type	Value	Confidence	Source
Target Ports	502 (Modbus), 44818 (EtherNet/IP), 102 (S7comm)	High	CISA
Exposure Pattern	Internet-facing PLC interfaces	High	CISA
Default Credentials	Vendor default passwords on PLCs	High	CISA

Behavioral Indicators

• Unusual PLC program uploads/downloads
• Firmware modification attempts on OT devices
• New user accounts on SCADA systems
• Configuration changes to safety thresholds

---

VIII.E.7 MITRE ATT&CK Technique Reference

The following MITRE ATT&CK techniques were observed in campaigns documented in this report:

Technique ID	Technique Name	Threat Actors Using
T1190	Exploit Public-Facing Application	Storm-1175, Iranian APT
T1566.002	Phishing: Spearphishing Link	Vietnamese Actors, ShinyHunters
T1566.004	Phishing: Spearphishing Voice	ShinyHunters
T1078	Valid Accounts	Storm-1175, ShinyHunters, Iranian APT
T1486	Data Encrypted for Impact	Storm-1175, Elite Enterprise
T1530	Data from Cloud Storage Object	ShinyHunters
T1567	Exfiltration Over Web Service	Storm-1175, ShinyHunters
T0831	Manipulation of Control (ICS)	Iranian APT
T1068	Exploitation for Privilege Escalation	CVE-2026-31431 Exploitation

---

VIII.F IOC Summary Table

Threat/Campaign	Indicator Types Available	Primary Detection Focus
CVE-2026-41940	Network, HTTP patterns	Port blocking, Web request analysis
CVE-2026-31431	System, Kernel, YARA	AF_ALG module monitoring, Privilege escalation detection
Medusa Ransomware	File, Registry, Command	Endpoint detection, Backup monitoring
ShinyHunters	Behavioral, Network	Identity monitoring, Data exfil detection
AccountDumpling	Email, Phishing URLs	Email security, User awareness
Iranian APT	OT Network, PLC	ICS monitoring, Exposure assessment

---

Note on IOC Usage: Indicators provided in this appendix should be incorporated into security monitoring systems with appropriate context. Some indicators may represent legitimate services that are being abused (e.g., Google AppSheet) and require behavioral analysis rather than simple blocklisting. Organizations should validate indicators against their specific environment and risk tolerance before implementing blocking actions.

---

XI. CONTACT INFORMATION

  Meraal Cyber Security (MCS) — Threat Intelligence Team

• Website: www.meraal.me
• General Inquiries: Office@meraal.me
• Threat Intelligence Lead: umerw@meraal.me
• Phone: +92 42 357 27575  |  +92 323 497 9477
• Schedule a ThreatFence Demo: threatfence.net

Note on Sources and Intelligence: This report synthesizes information from various credible sources, including public advisories from organizations like CISA, MITRE, and MS-ISAC, alongside internal analysis and emerging threat intelligence. Efforts have been made to differentiate between confirmed intelligence and speculative or unverified information to maintain accuracy and credibility.