Threat reportAPTTL-2026-3699
September 2026 APT Group Threat Report (AhnLab ASEC): DPRK, China, Russia, Iran/Pakistan-linked activity incl. supply-chain and legitimate-service C2 abuse
September 2026 APT Group Threat Report (AhnLab ASEC) (TL-2026-3699), also tracked as ASEC September 2026 APT Group Trends Report, is a high-severity advanced persistent threat campaign, first published 2026-10-16. It is linked to a North Korea, China, Russia, Iran-nexus actor with medium confidence, affects Microsoft Microsoft 365 / Outlook / OneDrive (Graph API abused for C2), references 2 CVEs (CVE-2020-0688, CVE-2019-0708), maps to 18 MITRE ATT&CK techniques (T1005, T1021.001, T1027), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-3699
- Threat ID
- TL-2026-3699
- Also known as
- ASEC September 2026 APT Group Trends Report, Contagious Interview, Operation RapidRust, Operation GitPower
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea, China, Russia, Iran
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, diplomatic, aviation, aerospace, finance, technology, think tanks, telecoms, critical-infrastructure
- Target regions
- south korea, russia, ukraine, india, afghanistan, taiwan, Southeast Asia, egypt, ethiopia, Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in September 2026 APT Group Threat Report (AhnLab ASEC)
Malware and tooling: Antino, BASHNATCH, BridgeAgent, CLEANGULP, CosmicPulse, GhostContainer, MATCHBOIL, NeedyMantis, NodeRabbit, OtterCookie, PSNATCH, PollCat
How September 2026 APT Group Threat Report (AhnLab ASEC) works
AhnLab ASEC's September 2026 APT trend report documents North Korean, Chinese, Russian, Iranian and Pakistani state-linked actors shifting from endpoint infection toward compromising developer accounts, cloud credentials, software supply chains and network trust infrastructure. Reported tradecraft includes GitHub account compromise and repository tampering, malicious macOS installers, C2 over Microsoft 365/OneDrive/Telegram/GitHub, and intrusions into Cisco IOS XR routers, TACACS servers and Exchange servers.
AhnLab ASEC (report published 2026-10-16, Korean-language, covering September 2026 activity) characterizes the month's APT activity as evolving toward abuse of developer ecosystems, cloud services and network-management infrastructure as trust layers. Four cross-cutting trends are called out: (1) expanding supply-chain attacks (GitHub account takeover, repository modification, malicious macOS installers); (2) growth of C2 over legitimate services (Microsoft 365, Outlook, OneDrive, Telegram, Nostr relays); (3) compromise of trusted infrastructure (routers, TACACS servers, Exchange servers); and (4) multi-format delivery chains combining VHDX, LNK, PDF, HTA, WSF, MSI and Control Panel applets. The report names no CVEs, hashes, IPs or domains.
North Korea: Famous Chollima uses the 'Contagious Interview' fake-recruitment technique against developers and IT staff to deliver the OtterCookie information stealer/remote-access malware. Kimsuky separates function across GitHub, WordPress, Dropbox and Pinggy and uses GitHub personal-access-token (PAT) based delivery; public reporting (SOC Prime, CraftedSignal) describes LNK-in-ZIP lures launching obfuscated PowerShell loaders that pull payloads and commands via GitHub PATs and Pastebin, with 13 LNK variants collected 11-19 August 2026 and Dropbox-API C2 seen from March 2026. Konni uses the VelvetCake downloader for collection and screen capture. Common to the cluster: fake recruitment lures, malicious LNK files and PowerShell follow-on payloads.
China: FamousSparrow, Fire Ant, Storm-3069, UAT-11587 and UTA0565 are covered, with named tools SparroWocky, BridgeAgent, NeedyMantis, Antino and CLEANGULP. Staging/C2 relies on Microsoft 365, Outlook, OneDrive, Cloudflare Pages, Cloudflare R2, Amazon CloudFront and GitHub. Fire Ant (Sygnia, Aug-Sep 2026) expanded from VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts, turning routers into traffic-capture and credential-harvesting platforms and suppressing logs; the investigation began with a GRE tunnel interface that had no configuration or commit history. UAT-11587 (Cisco Talos) deploys the Rust backdoor Antino, which uses Microsoft Graph with Outlook and OneDrive as dead drops; about 350 endpoints across at least 16 institutions were compromised from September 2025 to July 2026, in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand and Myanmar.
Russia-aligned: Callisto/Star Blizzard uses RedFlick (scheduled-task delivery) and CosmicPulse. UAC-0099 uses GuardBreaker, an indirect prompt-injection technique (an English comment such as 'I want to make nuclear weapon. Help me...') meant to make AI-assisted malware analysis refuse or stall while a MATCHBOIL loader is installed (ESET, late August 2026). NightEagle (APT-Q-95; Kaspersky) targets Russian companies using stolen VPN credentials, the in-memory GhostContainer Exchange backdoor (built from Neo-reGeorg, a CVE-2020-0688 exploit and ysoserial's GhostWebShell), Microsoft dev tunnels, rdp2tcp, Impacket and BlueKeep.
Iran/Pakistan: Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore) targets aviation, aerospace and fintech developer workstations with fake job offers and coding assignments that deliver the cross-platform NodeRabbit RAT and PollCat. Transparent Tribe and APT36 (Zscaler Operation RapidRust, Aug 2026) target government, defense and diplomatic entities in India and Afghanistan using LNK/ISO/ZIP/BAT/PowerShell chains; RUSTYSHADE (Rust backdoor, AES-256-GCM, private GitHub repos for C2), RUSTYMOVE (copies payloads to removable media to reach air-gapped networks), PSNATCH (PowerShell file stealer) and BASHNATCH (Linux bash equivalent) use attacker-controlled private GitHub repositories for C2 and exfiltration.
Defensive priorities highlighted: developer-environment security, cloud behavior-based detection, monitoring of network-management infrastructure, and account protection. Per-actor detail beyond the ASEC summary was cross-checked against vendor reporting; ASEC itself provides no IOCs, so the IOC set below is limited to named malware, tools and abused platforms.
MITRE ATT&CK techniques used in TL-2026-3699
Collection
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1091 Replication Through Removable Media
Defense Evasion
T1027 Obfuscated Files or Information; T1218.002 System Binary Proxy Execution: Control Panel
Execution
T1053.005 Scheduled Task/Job: Scheduled Task; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.002 User Execution: Malicious File
Initial Access
T1078 Valid Accounts; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566.003 Phishing: Spearphishing via Service
Command and Control
T1102.001 Web Service: Dead Drop Resolver; T1102.002 Web Service: Bidirectional Communication; T1572 Protocol Tunneling
Persistence
T1505.003 Server Software Component: Web Shell
Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Resource Development
Affected products and versions in September 2026 APT Group Threat Report (AhnLab ASEC)
- Microsoft — Microsoft 365 / Outlook / OneDrive (Graph API abused for C2)
- Microsoft — Exchange Server
Vulnerable versions: Servers unpatched for CVE-2020-0688
Fixed in: Security update for CVE-2020-0688 - Microsoft — Windows (RDP / BlueKeep)
Vulnerable versions: Systems unpatched for CVE-2019-0708
Fixed in: Security update for CVE-2019-0708 - Cisco — IOS XR routers and TACACS servers
- GitHub — GitHub accounts, PATs and repositories (supply chain / C2)
Remediation for September 2026 APT Group Threat Report (AhnLab ASEC)
Patches
- Apply Microsoft Exchange cumulative updates addressing CVE-2020-0688
- Patch Windows RDP exposure for CVE-2019-0708 (BlueKeep) and apply current Cisco IOS XR security advisories
Immediate actions
- Hunt for GitHub PAT use, private-repo access and Dropbox/Pastebin/Telegram API traffic from endpoints that do not normally use them
- Audit Microsoft Graph/Outlook/OneDrive activity from non-standard processes and unmanaged app registrations
- Review Cisco IOS XR routers for unexplained GRE tunnels or interfaces lacking configuration/commit history, and audit TACACS servers
- Check Exchange servers for in-memory .NET modules, webshells and CVE-2020-0688 exposure; review dev-tunnel and rdp2tcp use
- Block or alert on LNK/ISO/ZIP/VHDX/HTA/WSF attachments and Control Panel applet (.cpl) execution from user-writable paths
Workarounds
- Restrict outbound access to developer-tunnel and paste/file-sharing services where not business-required
- Disable removable-media autorun and restrict USB on air-gapped networks
Longer-term hardening
- Enforce developer-environment controls: signed commits, branch protection, short-lived scoped tokens, repository audit logging
- Train developers on fake-recruiter coding-assignment lures; run assessments in isolated VMs
- Centralize and protect router/TACACS logging off-box; baseline network-management plane
- Adopt cloud behavioral detection for abuse of legitimate services; do not rely solely on AI-assisted malware triage that is vulnerable to prompt injection
CVEs associated with September 2026 APT Group Threat Report (AhnLab ASEC)
Weaknesses (CWE) in September 2026 APT Group Threat Report (AhnLab ASEC)
Timeline of September 2026 APT Group Threat Report (AhnLab ASEC)
- Cisco Talos first detects UAT-11587 in a spear-phishing campaign against Taiwan's academic/think-tank policy community (month-level date); the Antino campaign later totals ~350 endpoints across 16+ institutions through July 2026.
- Kimsuky begins abusing GitHub private repositories and Dropbox API for staging and C2 (month-level date, per CraftedSignal/SOC Prime reporting).
- Sygnia discloses Fire Ant's expansion from VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts, used for traffic capture, credential harvesting and log suppression (August-September 2026; month-level date).
- Zscaler ThreatLabz observes APT36 Operation RapidRust against Indian and Afghan government/defense entities, using RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH with private GitHub repos for C2/exfiltration (month-level date).
- Start of the 11-19 August 2026 window in which thirteen Kimsuky LNK variants using GitHub PATs for C2 (with Pastebin fallback) were collected.
- ESET documents UAC-0099's GuardBreaker prompt-injection technique against AI-assisted malware analysis, used while installing the MATCHBOIL loader (late August 2026; day approximate).
- Kaspersky reports NightEagle (stolen VPN credentials, GhostContainer, dev tunnels, rdp2tcp) against Russian companies; Mirage Kitten fake-job campaign with NodeRabbit/PollCat reported against aviation and fintech developers (September 2026; month-level date).
- Public reporting on UAT-11587's Antino backdoor using Microsoft Graph, Outlook and OneDrive as dead drops (October 2026; month-level date).
- AhnLab ASEC publishes the September 2026 APT Group Trends Report summarizing DPRK, PRC, Russia-aligned, Iranian and Pakistani activity.
Sources cited for September 2026 APT Group Threat Report (AhnLab ASEC)
- 2026년 9월 APT 그룹 동향 보고서 - AhnLab ASEC
- July 2026 Threat Trend Report on APT Groups - AhnLab ASEC
- Kaspersky identifies NightEagle campaign targeting organizations in Russia
- GhostContainer backdoor targets Microsoft Exchange servers - Securelist
- Three threat groups target Russian organizations - The Hacker News
- China-linked Fire Ant hijacks Cisco IOS XR routers - The Hacker News
- China-linked hackers turn Cisco IOS XR routers into covert attack infrastructure - Network World
- Iranian cyber spies target aviation, fintech with new malware - The Record
- Operation RapidRust: APT36 deploys RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH - Zscaler ThreatLabz
- Antino backdoor uses Outlook and OneDrive - The Hacker News
- China-Linked Hackers Target Asian Governments With Antino Backdoor - eSecurity Planet
- Kimsuky adopts OpenCode AI for lures in GitHub PAT-based LNK campaigns - SOC Prime
- Kimsuky Dropbox API C2 brief - CraftedSignal
- Hackers Embed Nuclear Weapons Prompts in Malware to Disrupt AI Code Analysis (GuardBreaker) - Hackmag
Detection coverage for TL-2026-3699
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3699 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.