# AhnLab ASEC April 2026 APT Group Trend Report: State-Sponsored Espionage Campaigns (CVE-2026-32202, CVE-2025-20333/20362, CVE-2021-26855)

> AhnLab ASEC's April 2026 APT trend report tracks 15 state-sponsored groups across North Korea, China, Russia, Iran, and Pakistan conducting espionage and sabotage via supply-chain compromise, fake-job-interview social engineering, zero-click LNK/Windows Shell coercion, DLL sideloading, and DNS manipulation. Campaigns deliver InvisibleFerret, OtterCookie, BeaverTail, PlugX, ValleyRAT, ProSpy, DeskRAT, GoGra, FIRESTARTER, Cobalt Strike, VShell, and a ShadowGuard eBPF rootkit, leveraging CVE-2026-32202, CVE-2021-26855, and CVE-2025-20333/20362.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0745
- **ID:** TL-2026-0745
- **Severity:** HIGH (CVSS 9.9)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT28
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-32202, CVE-2021-26855, CVE-2025-20333, CVE-2025-20362

## Description

This report consolidates AhnLab ASEC's April 2026 tracking of 15 nation-state APT clusters and their active malware sets. NORTH KOREA: UNC1069 and Famous Chollima (Contagious Interview) ran software supply-chain attacks, publishing malicious packages across five open-source ecosystems (npm, PyPI, Go Modules, crates.io, Packagist) to steal developer credentials, browser data, password-manager contents, and cryptocurrency wallets; between April 6-9 2026 an npm cluster of obfuscated throwaway-account packages delivered OtterCookie infostealer variants exfiltrating to cloudflareinsights[.]vercel[.]app. VoidDokkaebi used fake job-interview social engineering to deliver DEV#POPPER, InvisibleFerret, OtterCookie, OmniStealer, and BeaverTail (merged BeaverTail/OtterCookie variants add keylogging and screenshot modules). CHINA: Mustang Panda deployed PlugX against European and Middle Eastern government/diplomatic targets using web-bug reconnaissance, OAuth redirect abuse, and fake Cloudflare Turnstile pages; Silver Fox delivered ValleyRAT to Japanese users via DLL side-loading of legitimate Dell/Waves MaxxAudio executables, lured with Rakuten billing invoices. RUSSIA: APT28 (Fancy Bear/Forest Blizzard) exploited the zero-click Windows Shell coercion flaw CVE-2026-32202 (an incomplete-patch successor to CVE-2026-21510) to harvest Net-NTLMv2 hashes via malicious LNK files that trigger automatic UNC/SMB authentication on folder browse, and manipulated SOHO router/network-equipment DNS settings; Sandworm (APT-C-13) used malicious LNK files in ZIP archives with nested Tor/SSH tunnels and onion-domain mappings for SMB/RDP/SSH. IRAN: Charming Kitten (APT35) exploited Exchange ProxyLogon CVE-2021-26855; OilRig (APT-C-49) hid C2 behind GitHub, Google Drive, and Telegram Bot using Excel macros; Bitter deployed the ProSpy Android spyware against Middle East civil-society and government targets. PAKISTAN: Transparent Tribe (APT36) ran Operation TrustTrap, large-scale domain spoofing impersonating government portals to deliver the Golang DeskRAT via weaponized .desktop files targeting BOSS Linux, with WebSocket C2 on port 8080. OTHER: Harvester used the GoGra Linux backdoor abusing Microsoft Graph API and Outlook mailboxes; TGR-STA-1030 used Cobalt Strike, VShell, and a ShadowGuard eBPF rootkit after phishing and public-vulnerability exploitation; UAT-4356 (ArcaneDoor) exploited Cisco Secure Firewall ASA/FTD n-days CVE-2025-20333 and CVE-2025-20362 to deploy the FIRESTARTER backdoor (LINA hook), LINE VIPER loader, and RayInitiator bootkit on Firepower FXOS devices, surviving firmware patches. Primary target sectors are security, energy, diplomacy, politics, advanced manufacturing, and aerospace.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1583.001 Domains
- T1585 Establish Accounts
- T1587.001 Malware
- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1566.001 Spearphishing Attachment
- T1566.003 Spearphishing via Service
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1543.002 Systemd Service
- T1053.003 Cron
- T1547 Boot or Logon Autostart Execution
- T1542.003 Bootkit
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1014 Rootkit
- T1187 Forced Authentication
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1056.001 Keylogging
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1572 Protocol Tunneling
- T1090.003 Multi-hop Proxy
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1499 Endpoint Denial of Service

## Sources

- [2026년 4월 APT 그룹 동향 보고서 (April 2026 APT Group Trend Report)](https://asec.ahnlab.com/ko/93743/)
- [A Shortcut to Coercion: Incomplete Patch of APT28's Zero-Day Leads to CVE-2026-32202](https://www.akamai.com/blog/security-research/incomplete-patch-apt28s-zero-day-cve-2026-32202)
- [Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202](https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html)
- [CISA orders feds to patch Windows flaw exploited as zero-day](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-flaw-exploited-in-zero-day-attacks/)
- [UAT-4356's Targeting of Cisco Firepower Devices (FIRESTARTER)](https://blog.talosintelligence.com/uat-4356-firestarter/)
- [Firestarter malware survives Cisco firewall updates, security patches](https://www.bleepingcomputer.com/news/security/firestarter-malware-survives-cisco-firewall-updates-security-patches/)
- [Contagious Interview: Malware delivered through fake developer job interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)
- [Tracking an OtterCookie Infostealer Campaign Across npm](https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm)
- [TransparentTribe Targets Indian Military Organisations With DeskRAT](https://blog.sekoia.io/transparenttribe-targets-indian-military-organisations-with-deskrat/)
- [NVD - CVE-2025-20333 (Cisco ASA/FTD VPN web server buffer overflow)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-20333)
- [NVD - CVE-2025-20362 (Cisco ASA/FTD missing authorization)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-20362)
- [NVD - CVE-2021-26855 (Exchange ProxyLogon SSRF RCE)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-26855)
- [NVD - CVE-2026-32202 (Windows Shell protection-mechanism failure)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-32202)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0745