Threat reportAPTTL-2026-4910
APT and Financial Attacks on Industrial Organizations in Q1 2026 (Kaspersky ICS CERT): Operation Neusploit (CVE-2026-21509/CVE-2026-21513), Poland Energy Wipers, TGR-STA-1030, MuddyWater, LockBit 5.0, Diesel Vortex
APT and Financial Attacks on Industrial Organizations in Q1 (TL-2026-4910), also tracked as Operation Neusploit, is a high-severity advanced persistent threat campaign, first published 2026-10-31. It is attributed to APT28 with medium confidence, affects Microsoft Office / Microsoft 365 Apps (CVE-2026-21509), references 7 CVEs (CVE-2026-21509, CVE-2026-21513, CVE-2025-53690), maps to 21 MITRE ATT&CK techniques (T1027.003, T1053.005, T1059.001), and is covered by 9 detection rules and 35 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 21MITRE ATT&CK
- Actors
- 4APT28
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 35Indicators of compromise
Key facts for TL-2026-4910
- Threat ID
- TL-2026-4910
- Also known as
- Operation Neusploit, Operation IconCat, Operation Olalampo, Operation CamelClone, Operation SkyCloak, PRISMEX campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- APT28, MuddyWater, TGR-STA-1030, UAT-8837
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- energy, critical infrastructure, government administration, defense, manufacturing, transportation and logistics, maritime, telecoms, water utilities, finance, aerospace
- Target regions
- 151 - Eastern Europe, poland, ukraine, russia, 143 - Central Asia, Middle East, North America, Europe, Latin America, Asia-Pacific, Africa
- Detection rules
- 9
- Indicators of compromise
- 35
Malware and tooling in APT and Financial Attacks on Industrial Organizations in Q1
Malware and tooling: Covenant Grunt, DynoWiper - S9038, LazyWiper, LockBit 5.0, lockbit5
How APT and Financial Attacks on Industrial Organizations in Q1 works
Kaspersky ICS CERT's Q1 2026 report tracks APT and financially motivated activity against industrial organizations, including APT28 (Operation Neusploit), MuddyWater, TGR-STA-1030, Hydra Saiga, Void Manticore, LockBit 5.0 and Diesel Vortex. It covers exploitation of CVE-2026-21509, CVE-2026-21513 (MSHTML zero-day) and CVE-2025-53690, the December 2025 wiper attacks on Poland's energy sector, and cargo-theft-driven credential phishing in logistics.
Kaspersky ICS CERT published its Q1 2026 review of APT and financial attacks on industrial organizations on 2026-05-21. The report aggregates activity from Kaspersky and third-party research (CERT Polska, ESET, Zscaler, Trend Micro, Unit 42, Cisco Talos, Check Point, Group-IB, F6, BI.ZONE, Positive Technologies) and highlights three trends: cyber-physical monetization of attacks on freight operators, cyberattacks that support military strike planning and effectiveness assessment, and a growing variety of Linux malware. Several threat actors are also reported to use LLMs in malware development (for example LampoRAT/CHAR emoji-laden debug strings, an LLM-likely PseudoSticky HTA file and the Handala PowerShell wiper).
Energy sector, Poland: coordinated destructive attacks took place on 2025-12-29 (announced 2026-01-13; CERT Polska report 2026-01-30). Targets were 30+ wind and solar farms, a private manufacturer and a CHP plant serving about 500,000 customers. Initial access was via internet-exposed FortiGate VPN devices without MFA. Administrative access to the FortiGate gave the attackers VPN account credentials with reach into all subnets. They also targeted M365 (Exchange, Teams, SharePoint) and showed interest in OT modernization and SCADA documentation. Wipers (DynoWiper, LazyWiper) were pushed by domain-wide PowerShell scripts from domain controllers. DynoWiper executed from C:\inetpub\pub\ and uses a three-phase file-wipe then reboot flow; ESET attributes it to Sandworm with medium confidence, while CERT Polska's infrastructure analysis overlaps with Static Tundra / Berserk Bear / Ghost Blizzard / Dragonfly. ICS devices (Hitachi Energy RTU560 and Relion relays, Moxa NPort, Mikronika RTUs/HMIs) were reached through default credentials; CVE-2024-2617 (RTU560 unsigned firmware updates) is cited.
Operation Neusploit (APT28 / Pawn Storm): in early February 2026 APT28 exploited CVE-2026-21509 (Office OLE mitigation bypass) within about 24 hours of disclosure and CVE-2026-21513 (MSHTML protection mechanism failure, a zero-day exploited about 11 days before the 2026-02-10 patch). Malicious RTF files fetched a dropper DLL from C2 infrastructure that applied geofencing and User-Agent checks. Variant 1 deployed MiniDoor, an Outlook VBA email stealer. Variant 2 used PixyNetLoader, which dropped a shellcode loader (EhStoreShell.dll) and a PNG carrying LSB-steganographic shellcode. A scheduled task then triggered COM hijacking to load Covenant Grunt, which used the Filen.io API as its C2 channel. Trend Micro tracks the same toolset as PRISMEX (PrismexSheet, PrismexDrop, PrismexLoader, PrismexStager) against the Ukrainian defense supply chain and NATO allies, and notes a destructive wiper component.
Other state-aligned activity: TGR-STA-1030/UNC6619 (70+ government and critical-infrastructure compromises across 37 countries; Diaoyu loader delivering Cobalt Strike and VShell; Behinder, Godzilla and Neo-reGeorg web shells; GOST/FRPS/IOX tunnels; ShadowGuard eBPF rootkit); UAT-8837 (China-nexus, medium confidence, initial access into North American critical infrastructure using the CVE-2025-53690 Sitecore ViewState zero-day and a post-compromise kit of Earthworm, SharpHound, DWAgent, Certipy, GoExec, Rubeus and Impacket); MuddyWater (RustyWater, Operation Olalampo with GhostFetch/GhostBackDoor/HTTP_VIP/CHAR); Hydra Saiga/Tomiris against Central Asian water and energy utilities with Telegram Bot API C2; SloppyLemming (BurrowShell, Rust keylogger, Cloudflare Workers C2); Void Manticore/Handala (hack-and-leak with four concurrent wiping techniques) and an Iran-nexus password-spray campaign. Russia-focused clusters include Head Mare (PhantomCore family, TrueConf flaws), Stan Ghouls, Vortex Werewolf, Toy Ghouls (LockBit, Babuk, GenieLocker), Librarian Ghouls and PseudoSticky.
Financially motivated activity: LockBit 5.0 (Windows, Linux, ESXi, Proxmox support; XChaCha20/Curve25519), the C77L RaaS, Warlock (SharePoint exploitation, w3wp.exe spawning Cobalt Strike, BYOVD, Velociraptor abuse, cproxy.aspx web shell, Yuze tunneling, GPO mass deployment) and Diesel Vortex (1,649 stolen freight-platform credentials, 52 phishing domains, 9-stage cloaking, Telegram-operator approval, double brokering and cargo diversion). The source report publishes few machine-readable IOCs; the indicators here come from the primary vendor reports it cites (Zscaler, Palo Alto Unit 42, ESET, Cisco Talos, Trend Micro).
MITRE ATT&CK techniques used in TL-2026-4910
Stealth
Persistence
T1053.005 Scheduled Task; T1505.003 Web Shell; T1546.015 Component Object Model Hijacking
Execution
T1059.001 PowerShell; T1203 Exploitation for Client Execution; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools; T1572 Protocol Tunneling
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Credential Access
Impact
T1485 Data Destruction; T1561.002 Disk Structure Wipe
Exfiltration
T1567.002 Exfiltration to Cloud Storage
stealth
Defense Impairment
Affected products and versions in APT and Financial Attacks on Industrial Organizations in Q1
- Microsoft — Office / Microsoft 365 Apps (CVE-2026-21509)
Vulnerable versions: Microsoft 365 Apps for Enterprise; Office 2016; Office 2019; Office LTSC 2021; Office LTSC 2024
Fixed in: January 2026 security updates - Microsoft — Windows MSHTML Framework (CVE-2026-21513)
Vulnerable versions: Windows 10 1607/1809/21H2/22H2; Windows 11 (multiple builds); Windows Server 2012-2025
Fixed in: February 2026 security updates (2026-02-10) - Sitecore — Experience Manager / Experience Platform / Experience Commerce (CVE-2025-53690)
Vulnerable versions: XM/XP through 9.0; Managed Cloud
Fixed in: See Sitecore KB1003865 - Fortinet — FortiGate VPN concentrators/firewalls (internet-exposed, no MFA)
Vulnerable versions: Exposed VPN interface without MFA; historical RCE flaws noted
Fixed in: Restrict exposure, enforce MFA, apply current firmware - Hitachi Energy — RTU560 and Relion protection relays (CVE-2024-2617; default credentials)
Vulnerable versions: RTU560 with unsigned firmware updates
Fixed in: Vendor guidance for CVE-2024-2617 - Moxa / Mikronika — NPort serial device servers; RTUs and HMIs (default credentials)
Vulnerable versions: Deployments with default credentials and exposed web interface
Fixed in: Change credentials, disable unused web interface - Microsoft — SharePoint Server (CVE-2025-53770; Warlock initial access)
Vulnerable versions: Unpatched on-premises SharePoint
Fixed in: Microsoft SharePoint security updates - Ivanti — Endpoint Manager Mobile (CVE-2025-4427/CVE-2025-4428; QuietCrabs)
Vulnerable versions: Unpatched EPMM
Fixed in: Vendor patches
Remediation for APT and Financial Attacks on Industrial Organizations in Q1
Patches
- Microsoft January 2026 update for CVE-2026-21509
- Microsoft February 2026 update for CVE-2026-21513 (released 2026-02-10)
- Sitecore advisory KB1003865 for CVE-2025-53690
- Hitachi Energy fix guidance for CVE-2024-2617 (RTU560)
Immediate actions
- Patch CVE-2026-21509 (Office) and CVE-2026-21513 (MSHTML); both are in CISA KEV
- Patch Sitecore for CVE-2025-53690 and patch SharePoint (CVE-2025-53770)
- Remove internet exposure of FortiGate VPN management/VPN interfaces and enforce MFA on all remote access
- Rotate VPN, domain and M365 credentials where FortiGate admin compromise is suspected
- Change default credentials on RTUs, protection relays, HMIs and serial device servers (Hitachi Energy RTU560/Relion, Moxa NPort, Mikronika)
- Block or alert on egress to Filen.io API hosts, Mega.nz and Telegram Bot API from servers and non-user endpoints
- Hunt for the IOCs listed in this record
Workarounds
- Disable Outlook macro execution and VBA project auto-load where not required
- Block RTF/OLE content from untrusted senders at the mail gateway
- Restrict outbound access to cloud storage C2 channels (Filen.io, Mega.nz) via proxy policy
Longer-term hardening
- Segment IT and OT networks and restrict VPN account reach to required subnets
- Monitor domain controllers and GPO/SYSVOL/NETLOGON for mass script or binary deployment
- Protect backups and ESXi/Proxmox hosts against ransomware and wipers
- Deploy EDR with behavioral detection for COM hijacking, DLL side-loading, w3wp.exe child processes and BYOVD
- Enforce phishing-resistant MFA and conditional access to counter password spraying and credential-harvesting phishing
- Verify firmware signing on OT devices and monitor for unsigned firmware updates
CVEs associated with APT and Financial Attacks on Industrial Organizations in Q1
CVE-2026-21509, CVE-2026-21513, CVE-2025-53690, CVE-2025-4427, CVE-2025-4428, CVE-2025-53770, CVE-2024-2617
Weaknesses (CWE) in APT and Financial Attacks on Industrial Organizations in Q1
Timeline of APT and Financial Attacks on Industrial Organizations in Q1
- CVE-2025-53690 (Sitecore ViewState deserialization) published; added to CISA KEV on 2025-09-04 after zero-day exploitation (later linked to UAT-8837)
- Pawn Storm/APT28 registers domain infrastructure used for CVE-2026-21509 exploitation about two months before public disclosure
- Coordinated destructive attacks hit Polish energy infrastructure (wind/solar farms, CHP plant, manufacturer) using DynoWiper and LazyWiper after FortiGate VPN compromise
- Polish energy minister publicly confirms the attacks on the energy sector
- Cisco Talos publishes UAT-8837 report describing CVE-2025-53690 zero-day exploitation against North American critical infrastructure
- ESET publishes analysis attributing the Poland DynoWiper attack to Sandworm with medium confidence
- Microsoft discloses CVE-2026-21509 (Office OLE mitigation bypass); CISA adds to KEV; APT28 exploitation observed within about 24 hours
- CERT Polska publishes the energy-sector incident report; CVE-2026-21513 exploit appears on VirusTotal the same day
- Microsoft patches the MSHTML zero-day CVE-2026-21513, exploited about 11 days earlier; CISA adds to KEV
- Early March 2026: Iran-nexus password-spraying campaign against Israeli and Gulf organizations observed via Tor exit nodes and commercial VPNs (day approximate; report says early March)
- Kaspersky ICS CERT publishes the Q1 2026 report on APT and financial attacks against industrial organizations
Sources cited for APT and Financial Attacks on Industrial Organizations in Q1
- APT and financial attacks on industrial organizations in Q1 2026 (Kaspersky ICS CERT)
- Zscaler ThreatLabz: APT28 leverages CVE-2026-21509 in Operation Neusploit
- Trend Micro: Pawn Storm PRISMEX campaign targets government and critical infrastructure
- Akamai: Inside the fix - CVE-2026-21513 MSHTML exploit analysis
- Microsoft MSRC advisory CVE-2026-21509
- CERT Polska: Incident report, energy sector 2025
- ESET: DynoWiper update - technical analysis and attribution
- ESET: Sandworm cyberattack on Poland power grid, late 2025
- Polish government: Poland stops cyberattacks on energy infrastructure
- Palo Alto Unit 42: Shadow Campaigns - uncovering global espionage (TGR-STA-1030)
- Cisco Talos: UAT-8837
- Group-IB: MuddyWater Operation Olalampo
- Palo Alto Unit 42: Boggy Serpens threat assessment
- Check Point Research: Handala Hack - unveiling the group's modus operandi
- Trend Micro: Dissecting a Warlock attack
Detection coverage for TL-2026-4910
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4910 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4910
3 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.