# Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiled

> Cyble Research tracked 261 distinct threat actor profiles active in H1 2026 (118 nation-state APT groups, 75 ransomware groups, 34 hacktivist collectives, 31 cybercriminal groups, 3 extortion-only groups) and named five of the most active: BlueNoroff/APT38 (North Korea), UNC6508 (China), Volt Typhoon (China), Desert Falcons/APT-C-23 (Palestine), and SideCopy (Pakistan). Cross-referencing each named actor against MITRE ATT&CK, CISA, Google Threat Intelligence Group, and vendor research fills in the malware, infrastructure, exploited CVEs, and ATT&CK techniques the original vendor report did not itemize.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1721
- **ID:** TL-2026-1721
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** APT38 (North Korea, China, Palestine, Pakistan)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-27997, CVE-2024-39717, CVE-2023-38831, CVE-2022-40684

## Description

Cyble's H1 2026 threat-actor landscape report profiles the composition of 261 tracked adversary groups and calls out five as the most operationally active during the period, each with a distinct nexus, targeting set, and tradecraft.

BlueNoroff (APT38/Lazarus subgroup, North Korea) ran a Web3/cryptocurrency-focused social-engineering campaign beginning January 23, 2026: a manipulated Calendly invite posing as a legal/consulting contact led victims to a typosquatted Zoom or Microsoft Teams meeting link. A fake 'SDK update' prompt triggered a ClickFix-style clipboard-hijack that ran fileless PowerShell, deployed a UAC-bypass DLL, disabled Microsoft Defender, and ultimately harvested browser-stored credentials, Telegram sessions, and cryptocurrency wallet extension data, while covertly capturing webcam video via mediasoup WebRTC for deepfake material. The actor escalated from May 31 to July 14, 2026 with a structured, AI-assisted (GPT-4o-generated headshots) Zoom/Teams phishing kit, compromising 100+ executives (45% CEO/founder) across 20+ countries, persisting up to 66 days per victim before detection.

UNC6508 (PRC-nexus espionage actor) compromised externally facing REDCap (Research Electronic Data Capture) research servers starting in September 2023, deploying custom INFINITERED malware — a three-part implant (upgrade-hijacking dropper, POST-login credential harvester, and a Cookie-triggered web-shell/SQL backdoor) — to persist inside North American academic, medical, and defense-research networks for over a year, through at least November 2025. The actor then abused Google Workspace and Microsoft 365 content-compliance / mail-forwarding rules (one named 'Patroit') to silently BCC-exfiltrate correspondence matching ~150 defense, AI, unmanned-systems, and medical-research keywords, routing access through a hijacked residential ASUS router and other U.S.-based proxies to obscure PRC attribution.

Volt Typhoon (PRC state-sponsored, aka Vanguard Panda/BRONZE SILHOUETTE/Insidious Taurus) continued long-term, living-off-the-land pre-positioning inside U.S. and allied critical-infrastructure IT networks (communications, energy, manufacturing, government, IT), some footholds persisting 5+ years. The group relies on LOLBins (certutil, PsExec, Impacket, WMI, Mimikatz) rather than custom malware, routes C2 through the KV Botnet of compromised SOHO routers, and has exploited edge-device zero-days for initial access, including CVE-2023-27997 (FortiOS/FortiProxy SSL-VPN heap overflow) and, from June through August 2024, CVE-2024-39717 in Versa Director SD-WAN management servers at MSPs/ISPs, deploying the custom VersaMem web shell to harvest downstream client credentials.

Desert Falcons (APT-C-23, aka Arid Viper/Mantis/Bearded Barbie, Palestine-nexus, active since at least 2014) targeted UAE, Israel, Jordan, and other MEA governments, aerospace/defense, and law-enforcement organizations using phishing-delivered Windows backdoors (Micropsia, KasperAgent) and mobile spyware (FrozenCell, Desert Scorpion, GnatSpy, AridSpy), often distributed through trojanized third-party Android app installs impersonating legitimate Palestinian apps.

SideCopy (Pakistan-nexus, active since at least 2019, operationally linked to/overlapping with Transparent Tribe/APT36) targeted Indian and Afghan government and defense entities via spearphishing and honeytrap lures, exploiting the WinRAR path-traversal zero-day CVE-2023-38831 to deploy a Linux variant of the open-source Ares RAT alongside AllaKore RAT, DRat, Action RAT, and Reverse RAT, with C2 infrastructure hosted primarily on Contabo GmbH (Germany) IP space and deliberately mimicking rival group SideWinder's infection chain to confuse attribution.

Cyble's original report provided no CVEs, malware names, or IOCs — this research fills that gap using MITRE ATT&CK group pages (G0082, G1008, G1017, G1028, G0134), CISA advisories, Google Threat Intelligence Group / Mandiant reporting, and vendor research (Arctic Wolf, Seqrite, Kaspersky Securelist, The Hacker News, Fortinet PSIRT).

## MITRE ATT&CK

- T1591.004 Identify Roles
- T1598.002 Spearphishing Attachment
- T1583.001 Domains
- T1584.001 Domains
- T1587.003 Digital Certificates
- T1608.001 Upload Malware
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1660 Phishing
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1106 Native API
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1047 Windows Management Instrumentation
- T1547.001 Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1505.003 Web Shell
- T1078 Valid Accounts
- T1548.002 Bypass User Account Control
- T1068 Exploitation for Privilege Escalation
- T1027.002 Software Packing
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1553.005 Mark-of-the-Web Bypass
- T1027.013 Encrypted/Encoded File
- T1564.001 Hidden Files and Directories
- T1218.005 Mshta
- T1685 Disable or Modify Tools
- T1110 Brute Force
- T1003.001 LSASS Memory
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518.001 Security Software Discovery
- T1016 System Network Configuration Discovery

## Sources

- [Most Active Threat Actors H1 2026 - Cyble](https://cyble.com/blog/most-active-threat-actors-h1-2026/)
- [PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a)
- [People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection (AA23-144A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a)
- [APT38, BlueNoroff - Group G0082](https://attack.mitre.org/groups/G0082/)
- [Volt Typhoon - Group G1017](https://attack.mitre.org/groups/G1017/)
- [SideCopy - Group G1008](https://attack.mitre.org/groups/G1008/)
- [APT-C-23, Desert Falcon - Group G1028](https://attack.mitre.org/groups/G1028/)
- [Transparent Tribe, APT36 - Group G0134](https://attack.mitre.org/groups/G0134/)
- [Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing AI, Cyber, Medical, and National Defense Research](https://cloud.google.com/blog/topics/threat-intelligence/prc-targets-us-medical-research)
- [BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery](https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html)
- [BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector](https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/)
- [SideCopy's Multi-platform Onslaught: Leveraging WinRAR Zero-Day and Linux Variant of Ares RAT](https://www.seqrite.com/blog/sidecopys-multi-platform-onslaught-leveraging-winrar-zero-day-and-linux-variant-of-ares-rat/)
- [The Desert Falcons Targeted Attacks](https://securelist.com/the-desert-falcons-targeted-attacks/68817/)
- [Versa Director zero-day exploited to compromise ISPs, MSPs (CVE-2024-39717)](https://www.helpnetsecurity.com/2024/08/27/cve-2024-39717-exploited/)
- [Analysis of CVE-2023-27997 and Clarifications on Volt Typhoon Campaign](https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1721