# APT and Financial Attacks on Industrial Organizations in Q1 2026 (Kaspersky ICS CERT): Operation Neusploit (CVE-2026-21509/CVE-2026-21513), Poland Energy Wipers, TGR-STA-1030, MuddyWater, LockBit 5.0, Diesel Vortex

> Kaspersky ICS CERT's Q1 2026 report tracks APT and financially motivated activity against industrial organizations, including APT28 (Operation Neusploit), MuddyWater, TGR-STA-1030, Hydra Saiga, Void Manticore, LockBit 5.0 and Diesel Vortex. It covers exploitation of CVE-2026-21509, CVE-2026-21513 (MSHTML zero-day) and CVE-2025-53690, the December 2025 wiper attacks on Poland's energy sector, and cargo-theft-driven credential phishing in logistics.

- **Published:** 2026-10-31T15:46:37Z
- **Last reviewed:** 2026-10-31T15:46:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4910
- **ID:** TL-2026-4910
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT28
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21509, CVE-2026-21513, CVE-2025-53690, CVE-2025-4427, CVE-2025-4428, CVE-2025-53770, CVE-2024-2617

## Description

Kaspersky ICS CERT published its Q1 2026 review of APT and financial attacks on industrial organizations on 2026-05-21. The report aggregates activity from Kaspersky and third-party research (CERT Polska, ESET, Zscaler, Trend Micro, Unit 42, Cisco Talos, Check Point, Group-IB, F6, BI.ZONE, Positive Technologies) and highlights three trends: cyber-physical monetization of attacks on freight operators, cyberattacks that support military strike planning and effectiveness assessment, and a growing variety of Linux malware. Several threat actors are also reported to use LLMs in malware development (for example LampoRAT/CHAR emoji-laden debug strings, an LLM-likely PseudoSticky HTA file and the Handala PowerShell wiper).

Energy sector, Poland: coordinated destructive attacks took place on 2025-12-29 (announced 2026-01-13; CERT Polska report 2026-01-30). Targets were 30+ wind and solar farms, a private manufacturer and a CHP plant serving about 500,000 customers. Initial access was via internet-exposed FortiGate VPN devices without MFA. Administrative access to the FortiGate gave the attackers VPN account credentials with reach into all subnets. They also targeted M365 (Exchange, Teams, SharePoint) and showed interest in OT modernization and SCADA documentation. Wipers (DynoWiper, LazyWiper) were pushed by domain-wide PowerShell scripts from domain controllers. DynoWiper executed from C:\inetpub\pub\ and uses a three-phase file-wipe then reboot flow; ESET attributes it to Sandworm with medium confidence, while CERT Polska's infrastructure analysis overlaps with Static Tundra / Berserk Bear / Ghost Blizzard / Dragonfly. ICS devices (Hitachi Energy RTU560 and Relion relays, Moxa NPort, Mikronika RTUs/HMIs) were reached through default credentials; CVE-2024-2617 (RTU560 unsigned firmware updates) is cited.

Operation Neusploit (APT28 / Pawn Storm): in early February 2026 APT28 exploited CVE-2026-21509 (Office OLE mitigation bypass) within about 24 hours of disclosure and CVE-2026-21513 (MSHTML protection mechanism failure, a zero-day exploited about 11 days before the 2026-02-10 patch). Malicious RTF files fetched a dropper DLL from C2 infrastructure that applied geofencing and User-Agent checks. Variant 1 deployed MiniDoor, an Outlook VBA email stealer. Variant 2 used PixyNetLoader, which dropped a shellcode loader (EhStoreShell.dll) and a PNG carrying LSB-steganographic shellcode. A scheduled task then triggered COM hijacking to load Covenant Grunt, which used the Filen.io API as its C2 channel. Trend Micro tracks the same toolset as PRISMEX (PrismexSheet, PrismexDrop, PrismexLoader, PrismexStager) against the Ukrainian defense supply chain and NATO allies, and notes a destructive wiper component.

Other state-aligned activity: TGR-STA-1030/UNC6619 (70+ government and critical-infrastructure compromises across 37 countries; Diaoyu loader delivering Cobalt Strike and VShell; Behinder, Godzilla and Neo-reGeorg web shells; GOST/FRPS/IOX tunnels; ShadowGuard eBPF rootkit); UAT-8837 (China-nexus, medium confidence, initial access into North American critical infrastructure using the CVE-2025-53690 Sitecore ViewState zero-day and a post-compromise kit of Earthworm, SharpHound, DWAgent, Certipy, GoExec, Rubeus and Impacket); MuddyWater (RustyWater, Operation Olalampo with GhostFetch/GhostBackDoor/HTTP_VIP/CHAR); Hydra Saiga/Tomiris against Central Asian water and energy utilities with Telegram Bot API C2; SloppyLemming (BurrowShell, Rust keylogger, Cloudflare Workers C2); Void Manticore/Handala (hack-and-leak with four concurrent wiping techniques) and an Iran-nexus password-spray campaign. Russia-focused clusters include Head Mare (PhantomCore family, TrueConf flaws), Stan Ghouls, Vortex Werewolf, Toy Ghouls (LockBit, Babuk, GenieLocker), Librarian Ghouls and PseudoSticky.

Financially motivated activity: LockBit 5.0 (Windows, Linux, ESXi, Proxmox support; XChaCha20/Curve25519), the C77L RaaS, Warlock (SharePoint exploitation, w3wp.exe spawning Cobalt Strike, BYOVD, Velociraptor abuse, cproxy.aspx web shell, Yuze tunneling, GPO mass deployment) and Diesel Vortex (1,649 stolen freight-platform credentials, 52 phishing domains, 9-stage cloaking, Telegram-operator approval, double brokering and cargo diversion). The source report publishes few machine-readable IOCs; the indicators here come from the primary vendor reports it cites (Zscaler, Palo Alto Unit 42, ESET, Cisco Talos, Trend Micro).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1078 Valid Accounts
- T1133 External Remote Services
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1546.015 Component Object Model Hijacking
- T1574.001 DLL
- T1505.003 Web Shell
- T1027.003 Steganography
- T1685 Disable or Modify Tools
- T1110.003 Password Spraying
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1567.002 Exfiltration to Cloud Storage
- T1485 Data Destruction
- T1561.002 Disk Structure Wipe

## Sources

- [APT and financial attacks on industrial organizations in Q1 2026 (Kaspersky ICS CERT)](https://ics-cert.kaspersky.com/publications/reports/2026/05/21/apt-and-financial-attacks-on-industrial-organizations-in-q1-2026/)
- [Zscaler ThreatLabz: APT28 leverages CVE-2026-21509 in Operation Neusploit](https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit)
- [Trend Micro: Pawn Storm PRISMEX campaign targets government and critical infrastructure](https://www.trendmicro.com/en_gb/research/26/c/pawn-storm-targets-govt-infra.html)
- [Akamai: Inside the fix - CVE-2026-21513 MSHTML exploit analysis](https://www.akamai.com/blog/security-research/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis)
- [Microsoft MSRC advisory CVE-2026-21509](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509)
- [CERT Polska: Incident report, energy sector 2025](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/)
- [ESET: DynoWiper update - technical analysis and attribution](https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/)
- [ESET: Sandworm cyberattack on Poland power grid, late 2025](https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025)
- [Polish government: Poland stops cyberattacks on energy infrastructure](https://www.gov.pl/web/primeminister/poland-stops-cyberattacks-on-energy-infrastructure)
- [Palo Alto Unit 42: Shadow Campaigns - uncovering global espionage (TGR-STA-1030)](https://unit42.paloaltonetworks.com/shadow-campaigns-uncovering-global-espionage)
- [Cisco Talos: UAT-8837](https://blog.talosintelligence.com/uat-8837/)
- [Group-IB: MuddyWater Operation Olalampo](https://www.group-ib.com/blog/muddywater-operation-olalampo/)
- [Palo Alto Unit 42: Boggy Serpens threat assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/)
- [Check Point Research: Handala Hack - unveiling the group's modus operandi](https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/)
- [Trend Micro: Dissecting a Warlock attack](https://www.trendmicro.com/en_us/research/26/c/dissecting-a-warlock-attack.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4910