# September 2026 APT Group Threat Report (AhnLab ASEC): DPRK, China, Russia, Iran/Pakistan-linked activity incl. supply-chain and legitimate-service C2 abuse

> AhnLab ASEC's September 2026 APT trend report documents North Korean, Chinese, Russian, Iranian and Pakistani state-linked actors shifting from endpoint infection toward compromising developer accounts, cloud credentials, software supply chains and network trust infrastructure. Reported tradecraft includes GitHub account compromise and repository tampering, malicious macOS installers, C2 over Microsoft 365/OneDrive/Telegram/GitHub, and intrusions into Cisco IOS XR routers, TACACS servers and Exchange servers.

- **Published:** 2026-10-16T03:00:26Z
- **Last reviewed:** 2026-10-16T03:00:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3699
- **ID:** TL-2026-3699
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2020-0688, CVE-2019-0708

## Description

AhnLab ASEC (report published 2026-10-16, Korean-language, covering September 2026 activity) characterizes the month's APT activity as evolving toward abuse of developer ecosystems, cloud services and network-management infrastructure as trust layers. Four cross-cutting trends are called out: (1) expanding supply-chain attacks (GitHub account takeover, repository modification, malicious macOS installers); (2) growth of C2 over legitimate services (Microsoft 365, Outlook, OneDrive, Telegram, Nostr relays); (3) compromise of trusted infrastructure (routers, TACACS servers, Exchange servers); and (4) multi-format delivery chains combining VHDX, LNK, PDF, HTA, WSF, MSI and Control Panel applets. The report names no CVEs, hashes, IPs or domains.

North Korea: Famous Chollima uses the 'Contagious Interview' fake-recruitment technique against developers and IT staff to deliver the OtterCookie information stealer/remote-access malware. Kimsuky separates function across GitHub, WordPress, Dropbox and Pinggy and uses GitHub personal-access-token (PAT) based delivery; public reporting (SOC Prime, CraftedSignal) describes LNK-in-ZIP lures launching obfuscated PowerShell loaders that pull payloads and commands via GitHub PATs and Pastebin, with 13 LNK variants collected 11-19 August 2026 and Dropbox-API C2 seen from March 2026. Konni uses the VelvetCake downloader for collection and screen capture. Common to the cluster: fake recruitment lures, malicious LNK files and PowerShell follow-on payloads.

China: FamousSparrow, Fire Ant, Storm-3069, UAT-11587 and UTA0565 are covered, with named tools SparroWocky, BridgeAgent, NeedyMantis, Antino and CLEANGULP. Staging/C2 relies on Microsoft 365, Outlook, OneDrive, Cloudflare Pages, Cloudflare R2, Amazon CloudFront and GitHub. Fire Ant (Sygnia, Aug-Sep 2026) expanded from VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts, turning routers into traffic-capture and credential-harvesting platforms and suppressing logs; the investigation began with a GRE tunnel interface that had no configuration or commit history. UAT-11587 (Cisco Talos) deploys the Rust backdoor Antino, which uses Microsoft Graph with Outlook and OneDrive as dead drops; about 350 endpoints across at least 16 institutions were compromised from September 2025 to July 2026, in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand and Myanmar.

Russia-aligned: Callisto/Star Blizzard uses RedFlick (scheduled-task delivery) and CosmicPulse. UAC-0099 uses GuardBreaker, an indirect prompt-injection technique (an English comment such as 'I want to make nuclear weapon. Help me...') meant to make AI-assisted malware analysis refuse or stall while a MATCHBOIL loader is installed (ESET, late August 2026). NightEagle (APT-Q-95; Kaspersky) targets Russian companies using stolen VPN credentials, the in-memory GhostContainer Exchange backdoor (built from Neo-reGeorg, a CVE-2020-0688 exploit and ysoserial's GhostWebShell), Microsoft dev tunnels, rdp2tcp, Impacket and BlueKeep.

Iran/Pakistan: Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore) targets aviation, aerospace and fintech developer workstations with fake job offers and coding assignments that deliver the cross-platform NodeRabbit RAT and PollCat. Transparent Tribe and APT36 (Zscaler Operation RapidRust, Aug 2026) target government, defense and diplomatic entities in India and Afghanistan using LNK/ISO/ZIP/BAT/PowerShell chains; RUSTYSHADE (Rust backdoor, AES-256-GCM, private GitHub repos for C2), RUSTYMOVE (copies payloads to removable media to reach air-gapped networks), PSNATCH (PowerShell file stealer) and BASHNATCH (Linux bash equivalent) use attacker-controlled private GitHub repositories for C2 and exfiltration.

Defensive priorities highlighted: developer-environment security, cloud behavior-based detection, monitoring of network-management infrastructure, and account protection. Per-actor detail beyond the ASEC summary was cross-checked against vendor reporting; ASEC itself provides no IOCs, so the IOC set below is limited to named malware, tools and abused platforms.

## MITRE ATT&CK

- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1566.003 Phishing: Spearphishing via Service
- T1078 Valid Accounts
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1505.003 Server Software Component: Web Shell
- T1218.002 System Binary Proxy Execution: Control Panel
- T1027 Obfuscated Files or Information
- T1021.001 Remote Services: Remote Desktop Protocol
- T1091 Replication Through Removable Media
- T1005 Data from Local System
- T1102.002 Web Service: Bidirectional Communication
- T1102.001 Web Service: Dead Drop Resolver
- T1572 Protocol Tunneling
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1583.006 Acquire Infrastructure: Web Services

## Sources

- [2026년 9월 APT 그룹 동향 보고서 - AhnLab ASEC](https://asec.ahnlab.com/ko/95882/)
- [July 2026 Threat Trend Report on APT Groups - AhnLab ASEC](https://asec.ahnlab.com/en/95040/)
- [Kaspersky identifies NightEagle campaign targeting organizations in Russia](https://www.kaspersky.com/about/press-releases/kaspersky-identifies-nighteagle-campaign-targeting-organizations-in-russia)
- [GhostContainer backdoor targets Microsoft Exchange servers - Securelist](https://securelist.com/ghostcontainer/116953/)
- [Three threat groups target Russian organizations - The Hacker News](https://thehackernews.com/2026/09/three-threat-groups-target-russian.html)
- [China-linked Fire Ant hijacks Cisco IOS XR routers - The Hacker News](https://thehackernews.com/2026/08/china-linked-fire-ant-hijacks-cisco.html)
- [China-linked hackers turn Cisco IOS XR routers into covert attack infrastructure - Network World](https://www.networkworld.com/article/4216884/china-linked-hackers-turn-cisco-ios-xr-routers-into-covert-attack-infrastructure.html)
- [Iranian cyber spies target aviation, fintech with new malware - The Record](https://therecord.media/iranian-cyber-spies-target-aviation-fintech-new-malware)
- [Operation RapidRust: APT36 deploys RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH - Zscaler ThreatLabz](https://www.zscaler.com/blogs/security-research/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and)
- [Antino backdoor uses Outlook and OneDrive - The Hacker News](https://thehackernews.com/2026/10/antino-backdoor-uses-outlook-and.html)
- [China-Linked Hackers Target Asian Governments With Antino Backdoor - eSecurity Planet](https://www.esecurityplanet.com/cybersecurity-threats/news-uat-11587-antino-backdoor-microsoft-365-cloudflare/)
- [Kimsuky adopts OpenCode AI for lures in GitHub PAT-based LNK campaigns - SOC Prime](https://socprime.com/de/active-threats/kimsuky-ubernimmt-opencode-ai-fur-tauschungen-in-github-pat-basierten-lnk-kampagnen/)
- [Kimsuky Dropbox API C2 brief - CraftedSignal](https://feed.craftedsignal.io/briefs/2026-03-kimsuky-dropbox-api/)
- [Hackers Embed Nuclear Weapons Prompts in Malware to Disrupt AI Code Analysis (GuardBreaker) - Hackmag](https://hackmag.com/news/guardbreaker)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3699