# ASEC June 2026 APT Trend Report: Nation-State Actors Pivot to Cloud/OAuth Abuse, MaaS, and Supply-Chain Compromise

> AhnLab ASEC's June 2026 APT trend digest tracks 20 nation-state groups (North Korea, China, Russia, Iran, India/Southeast Asia) converging on a shared modern playbook: OAuth token theft, abuse of legitimate cloud services (Google Drive, Dropbox, pCloud, Zoho WorkDrive, FILEN) for C2/delivery, npm and vendor-update supply-chain compromise, and adoption of criminal malware-as-a-service platforms such as CastleRAT.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1287
- **ID:** TL-2026-1287
- **Severity:** MEDIUM
- **Category:** CAMPAIGN
- **Status:** ACTIVE
- **Actor:** APT38 (North Korea, China, Russia, Iran)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21509

## Description

AhnLab Security Emergency response Center (ASEC) published a monthly APT trend report on 2026-07-14 covering June 2026 activity from 20 tracked nation-state groups. The report is a digest-level roundup rather than a single-incident advisory: it names threat actors, malware families, and TTP categories per region without providing raw IOCs, CVEs, or CVSS scores for the digest itself. Follow-on research against the individually cited campaigns (independently reported by Microsoft, Google/Mandiant, ESET, ThreatLabz/Zscaler, Trellix, and CISA) supplies the technical depth: North Korea's Sapphire Sleet compromised the @mastra npm organization on 2026-06-17, backdooring 140+ packages (combined 1.1M+ weekly downloads) via a typosquatted 'easy-day-js' dependency with an obfuscated postinstall dropper; APT37/ScarCruft deployed the Python-loader-based NarwhalRAT via fake Microsoft security-alert phishing; China-nexus FishMonger (tracked historically as Earth Lusca/Aquatic Panda/Bronze University/Charcoal Typhoon/RedHotel) ported the Linux SprySOCKS backdoor to Windows with a kernel-driver rootkit and UEFI bootkit indicators, while other China-nexus clusters (UNC6508 et al.) abused Zoho WorkDrive as C2 infrastructure and OAuth tokens for persistent access to victim government, diplomatic, medical-research, and energy-sector environments; Russia's APT28 (Fancy Bear) ran Operation Neusploit exploiting CVE-2026-21509 in Microsoft Office to deliver PixyNetLoader, which hides shellcode in PNG images via LSB steganography and achieves persistence through COM object hijacking, while Turla (Secret Blizzard) deployed the KAZUAR-derived .NET/WebSocket backdoor STOCKSTAY against Ukrainian government/military and Italian-diplomacy-themed targets; Iran's MuddyWater (tied to Iran's MOIS) was found operating at least two builds of the Russian-developed CastleRAT malware-as-a-service platform alongside a new JavaScript/Node.js implant, ChainShell, that resolves its C2 address from an Ethereum smart contract and communicates over AES-encrypted WebSockets, discovered via an open C2 directory listing containing Farsi comments and Israeli IP-range target lists (Ctrl-Alt-Intel, 2026-03-04); and Vietnam-aligned OceanLotus (APT32) ran a supply-chain compromise of the FireAnt MetaKit stock-investment platform's update server (Oct 2025-Mar 2026) to selectively deliver the SPECTRALVIPER backdoor to Vietnamese stock investors. Collectively the report documents a strategic shift away from bespoke malware-only operations toward abuse of legitimate developer and cloud infrastructure, criminal MaaS procurement, and supply-chain trust exploitation across all tracked regions.

## MITRE ATT&CK

- T1583.006 Web Services
- T1588.001 Malware
- T1608 Stage Capabilities
- T1195.002 Compromise Software Supply Chain
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1195.001 Compromise Software Dependencies and Development Tools
- T1199 Trusted Relationship
- T1190 Exploit Public-Facing Application
- T1059.001 PowerShell
- T1204.002 Malicious File
- T1546.015 Component Object Model Hijacking
- T1505 Server Software Component
- T1574.001 DLL
- T1027.003 Steganography
- T1014 Rootkit
- T1542.003 Bootkit
- T1140 Deobfuscate/Decode Files or Information
- T1528 Steal Application Access Token
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1560 Archive Collected Data
- T1005 Data from Local System
- T1102 Web Service
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [APT Group Threat Report - June 2026](https://asec.ahnlab.com/ko/94440/)
- [From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet](https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/)
- [145 Mastra npm Packages Compromised via Hijacked Contributor Account](https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html)
- [Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat](https://www.stepsecurity.io/blog/mastra-npm-packages-compromised-using-easy-day-js)
- [easy-day-js Supply Chain Attack Hits Mastra AI in npm](https://www.ox.security/blog/easy-day-js-supply-chain-attack-hits-mastra-ai-in-npm/)
- [Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware](https://thehackernews.com/2026/06/fake-microsoft-alerts-used-to-deploy.html)
- [China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth](https://thehackernews.com/2026/06/china-linked-sprysocks-backdoor-expands.html)
- [FishMonger's arsenal upgraded: SprySOCKS for Windows](https://www.welivesecurity.com/en/eset-research/fishmongers-arsenal-upgraded-sprysocks-windows/)
- [China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints](https://securityaffairs.com/193728/apt/china-linked-fishmonger-ports-sprysocks-to-windows-with-kernel-level-stealth-and-uefi-bootkit-hints.html)
- [Operation Neusploit: APT28 Weaponizes CVE-2026-21509](https://hivepro.com/threat-advisory/operation-neusploit-apt28-weaponizes-cve-2026-21509/)
- [APT28's Stealthy Multi-Stage Campaign Leveraging CVE-2026-21509 and Cloud C2 Infrastructure](https://www.trellix.com/blogs/research/apt28-stealthy-campaign-leveraging-cve-2026-21509-cloud-c2/)
- [Operation Neusploit: APT28 Uses CVE-2026-21509](https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit)
- [Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks](https://thehackernews.com/2026/06/google-details-turlas-new-stockstay.html)
- [The Latest Addition to Turla's Intelligence Gathering Apparatus](https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering)
- [Iranian Espionage Operations Linked To CastleRAT and ChainShell Malware Suite](https://cyberpress.org/iran-tied-to-castlerat/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1287