Sectoral impact

The technology and critical infrastructure sectors remain the preferred targets for APT groups, according to our analysis.

Telecom leads with 47.0% of sector-attributed volume, reflecting nation-state actors’ strategic interest in communications infrastructure for signals intelligence collection, subscriber data harvesting, and potential disruption capabilities.

The transportation & shipping sector’s 21.4% share is heavily influenced by a surge during the first quarter of 2026, which made this sector one of the main targets of APT actors. Government sector detections (20.6%) demonstrate consistent, sustained attention for all six months.

Use of MITRE techniques remained relatively stable, with System Information Discovery, Ingress Tool Transfer, and Web Protocols consistently ranking in the top positions. This stability indicates mature operational procedures across APT groups.

Implications

The assessment delineates a mature APT landscape characterized by standardized toolsets, persistent innovation, and a calculated alignment with strategic intelligence mandates. Mitigating these advanced threats requires deploying multi-tiered defensive frameworks capable of addressing both specialized malware and the exploitation of legitimate system processes.

Developing a mature security posture requires a strategic transition from legacy signature-based alerting to behavioral and contextual detection methodologies. This mandate requires the institutionalization of comprehensive activity baselining, rigorous least-privilege protocols, and the logical segmentation of administrative domains. Continuous proactive hunting for the exploitation of native system utilities—specifically PowerShell, WMI, and PsExec—complemented by the stringent auditing of privileged accounts, remains paramount. Ultimately, synchronized collaboration across SOC, IT, and threat intelligence functions is vital to identify nuanced anomalies, such as atypical command-line execution or lateral movement leveraging legitimate credentials.

Overview

Over the last six months and as part of a larger trend (over the previous 12 months), the C2 Intelligence Matrix: 2026 provides a comprehensive technical analysis of the radical transformation in command-and-control (C2) methodologies. It serves as a strategic roadmap for security operations centers (SOCs) and threat hunters to navigate a landscape where traditional perimeter defenses are increasingly bypassed by decentralized, "post-malware" strategies. By synthesizing data from real-world telemetry and the evolution of adversary tradecraft, it bridges the gap between theoretical vulnerability and active exploitation in the 2026 threat environment.

Key Takeaway

In 2026, the primary threat vector shifted from "hiding" traffic to "blending" and "blinding," as attackers leverage legitimate blockchain infrastructure and AI-driven polymorphism to render traditional signature-based and behavioral detections obsolete.

• ClickFix: Social engineering-driven execution

C2 Intelligence Matrix: 2026

Between October 2025 and March 2026, Trellix observed an evolution of C2 techniques marked by a shift from centralized, dedicated infrastructure to decentralized, "post-malware" and blockchain-based strategies.

This matrix categorizes the heavy hitters during this period, separating specialized Red Team frameworks from the aggressive "commodity" tools often favored by initial access brokers (IABs).

Deep dive: The 2026 technical tradecraft

Below is a detailed list of the groundbreaking techniques that emerged and became standard during the October 2025 to March 2026 timeframe.

1. EtherHiding (Blockchain-as-a-C2)

Emerging as one of the most resilient techniques during this time period, EtherHiding weaponizes Web3 technology. Instead of a server, attackers use the Binance Smart Chain (BSC) or Ethereum to host their C2 instructions.

• Decentralized resolver: Malware uses eth_call (read-only requests) to query a smart contract. The contract returns a pointer or an encrypted payload. Because it's a read-only request, it leaves no transaction history on the chain.

• The three-tier contract architecture:

  • Level 1 (anchor): A static contract address hardcoded in the malware.

  • Level 2 (router): A switchboard contract that points to the actual payload.

  • Level 3 (payload): A payload that holds the encrypted command or the next stage of the malware.

  • If a payload is flagged, the attacker simply updates the pointer in Level 2 to a new Level 3 contract, keeping the infection alive without re-infecting the victim.

2. AI-driven polymorphism & adaptive beaconing

C2 frameworks have integrated generative AI to automate evasion.

• AI-generated traffic profiles: Rather than simple "jitter" (random timing), AI models analyze a network's normal traffic (e.g., a specific company's Slack or Teams usage) and generate C2 beacons that perfectly mimic the specific organization’s metadata. 

• Code metamorphism: AI "predator swarms" rewrite their own loader code every 15 minutes to ensure that file hashes never repeat, rendering static signature-based detection useless.

3. Living-off-the-land C2 (LOTL C2)

Starting in 2022 and maturing by 2025, attackers moved away from buying domains and instead began "borrowing" the reputation of legitimate cloud services.

• TryCloudflare & Ngrok tunneling: C2 traffic is tunneled through *.trycloudflare.com or *.ngrok.io. Since these are trusted developer tools, many firewalls allow the traffic by default.

• C2 via SaaS APIs: Malware now uses Microsoft Graph API, Discord Webhooks, or Telegram API to exfiltrate data. To a defender, the traffic appears to be an employee uploading a file to their corporate OneDrive or sending a chat message.

4. Security blinding (AMSI & ETW patching)

A significant shift between the 2024 and 2026 variants (such as Remcos v7.x and DCRat) is the proactive "blinding" of the operating system's built-in defenses.

• AMSI (antimalware scan Interface) patching: The malware overwrites the AmsiScanBuffer function in memory with a "return clean" instruction. This tells security monitoring tools that everything it's seeing is safe, even if it's a known malicious script.

• ETW (event tracing for Windows) silencing: By patching EtwEventWrite, the malware prevents Windows from logging its activities. This effectively silences EDR tools that rely on system events to trigger alerts.

5. Protocol evolution (HTTP/3 (QUIC) & gRPC):

As network sensors improved at spotting TLS-encrypted TCP traffic, C2s like AdaptixC2 (2025) adopted newer protocols.

• QUIC (HTTP/3): Because QUIC is UDP(user datagram protocol)-based and encrypts connection metadata (like the SNI), it is significantly harder for legacy firewalls to inspect. It also allows for faster "zero-latency" check-ins.

• gRPC tunneling: Using Google's high-performance RPC (remote procedure call) framework allows C2 traffic to blend into the modern microservice architecture common in enterprise data centers.

6. Social engineering-driven execution (ClickFix)

In 2025, the delivery mechanism changed to bypass automated sandboxes.

• User-mediated execution: Instead of a self-running file, the malware shows a fake "browser error" or "CAPTCHA." It asks the user to copy a "fix" (malicious PowerShell) and run it manually via Win+R. Because the user performs the action, automated security tools often treat it as authorized administrator activity.

The period from October 2025 through March 2026 represents a structurally elevated ransomware threat environment. During this time, the Trellix Advanced Research Center observed 4,801 victim posts, and a steady average of 800 monthly posts from legitimate ransomware operators. Additionally, Trellix telemetry recorded over 2M ransomware-related detections across 76 unique campaigns throughout this window.

The ecosystem underwent significant structural reshuffling. Previously dominant groups, including RansomHub, LockBit3, BlackBasta, and Cactus, effectively vanished, likely due to law enforcement operations and internal disruptions.  It didn’t take long for a wave of new entrants, including Qilin, Sinobi, Nightspire, and LockBit5, to fill the void.

Simultaneously, the threat landscape grew more sophisticated as nation-state and criminal activity converged, evidenced by the Lazarus Group partnering with Medusa RaaS. Additionally, this period also saw AI-assisted malware development and the emergence of ClickFix, which is displacing traditional phishing as the dominant initial access vector.

Key findings

From October 2025 to March 30, 2026, the Trellix Advanced Research Center observed:

• Significant ransomware double-peak activity: Ransomware-related detections peaked at just over 1M during December–January; following a February lull, March 2026 saw a sharp 36.6% rebound.

• Primary execution and post-exploitation tools remain consistent: PowerShell appeared in 54.6% of detections and Cobalt Strike in 33.9%, confirming their continued centrality in ransomware kill chains.

• Near-universal evasion and impact techniques: Detections reflected standard pre-encryption kill-chain behavior at scale with Data Encrypted for Impact (T1486) appeared in 97.4% of detections, while Service Stop (T1489) and Disable or Modify Tools (T1562.001) appeared in 70.5% and 48.5%, respectively. 

• Widespread operational risk: Ransomware detections across industrials (1334 posts), Government/Administration (116 posts), and healthcare (287 posts) indicate the potential for broad operational disruption. 

• Nation-state healthcare threats: The Lazarus-Medusa partnership targeting U.S. organizations poses a threat to critical patient safety infrastructure.

• Extortion workflow automation: Leak Bazaar’s ML-powered monetization platform with ransomware negotiation support lowers the technical bar for new entrants.

Ransomware group activity

Between October 2025 and March 2026, the ransomware landscape underwent a structural reset. Once dominant groups, including RansomHub, LockBit3, BlackBasta, and Cactus, disappeared, most likely due to law enforcement pressure and internal turmoil. However, this void was short-lived; a wave of new groups—including Sinobi, Nightspire, and LockBit5—filled the gap, illustrating the resilience and adaptability of the cybercriminal underground.

New ransomware groups emerge

The emergence of several high-output groups that transitioned from non-existent to major market players almost overnight. Groups include Sinobi with a 4.4% share of the total ransomware activity, followed closely by Devman2 at 4.1% and The Gentleman at 2.8%. 

This rapid scaling is potentially symptomatic of a broader trend: the continued lowering of the Ransomware-as-a-Service (RaaS) barrier to entry. During the Q4 2025 - Q1 2026 period, over 15 groups posted 10 or more victims despite having no meaningful prior-period presence. This influx is fueled by leaked builder tools and commoditized infrastructure, allowing fledgling threat actors to launch high-impact campaigns with minimal technical overhead.

Groups dramatically escalating threat activity

In the wake of leading ransomware groups collapsing, several newer groups significantly increased their ransomware activity. After a slow start following its debut on October 28, 2025, Nightspare nearly doubled its output compared to the mid-2025 period, surging to become the third-most-active group by March 2026. Similarly, Everest also nearly doubled its output between the Q2/Q3 2025 and the Q4 2025/Q1 2026 period.

The LockBit evolution 

Following the decline of LockBit 3, which accounted for a mere 0.58% of ransomware activity between April to September 2025, the group's newer iteration, LockBit5, saw its activity volume surge nearly fivefold during the Q4 2025 to Q1 2026 period. Although this relaunch gained significant momentum in December 2025 and peaked in January 2026, its activity began to decline toward the end of the first quarter.

Qilin’s continued dominance

While other segments of the landscape experienced volatility, Qilin remains the ransomware leader. The organization expanded its operational footprint, growing from 13.45% of total ransomware activity in mid-2025 to 17.2% during the Q4 2025 to Q1 2026 period.

Affected sectors

The industrial sector's continued dominance remains a primary focus of ransomware activity, accounting for 37.9% of all attacks across all identified sectors between Q4 2025 and Q1 2026. This sustained targeting suggests that threat actors continue to prioritize industrial organizations because of their heavy reliance on operational technology (OT) and their low tolerance for downtime. These factors create a high-pressure environment in which ransom payments are more likely, and the cost of recovery is disproportionately high. 

• Consumer Services as a supply chain risk: Holding steady at 17.8% of attacks across all identified sectors, consumer services—including MSPs, staffing firms, and facilities—remains a critical vector for supply chain attacks that can cascade to numerous downstream clients.

• Financial services targeting: Although financial sector attacks dropped slightly to 7.7% of all identified sectors, the industry continues to face sophisticated threats from groups like Clop and Akira, who leverage high-value data for double-extortion tactics.

• Healthcare high-stakes vulnerability: Representing 8.1% of total ransomware activity, healthcare remains a persistent, high-risk target, where operational disruptions directly endanger patient safety and critical care delivery.

• Technology sector's appeal: Attacks on the technology sector (9.7%) increase slightly over the last two quarters, indicating that the industry remains an attractive target for groups seeking to exfiltrate valuable intellectual property.

• Government sector persistence: Accounting for 116 posts, government entities continue to be targeted despite limited ransom-payment capacity, suggesting that data exfiltration and geopolitical disruption serve as the primary motivators for these campaigns.

Geographic distribution

The United States remains the dominant ransomware target by a substantial margin, accounting for 1,912 victim posts (55.4%). That is nearly double the combined total of the next four countries, including Canada ( 5.0%), United Kingdom (3.5%), Germany (3.2%), and France (2.3%).  

From a detection standpoint Trellix telemetry revealed that the U.S. received the most ransomware detections (27.66% of total detections), followed by Spain (16.56%) South Korea ( 10.66%), India (8.91%), and Türkiye (8.44%). Additionally,  ATLAS Campaign intelligence identified the U.S. (16 campaigns), UK (9), Germany (7), Brazil (6), and Canada (6) as the most campaign-targeted nations..

Regional patterns

• North America bears the greatest ransomware burden: Combined, the US and Canada received 2,084 posts (60.4% of all enriched records). This is likely driven by the concentration of high-value enterprise targets and the prevalence of cyber insurance, which may incentivize ransom payments.

• Western Europe remains heavily targeted: The UK, Germany, France, Italy, and Spain collectively account for ~14.2% of victim posts, with Germany and the UK also appearing prominently in campaign attribution data.

• APAC targeting is growing: South Korea (10.66% of detections), India (8.91% detections), and Malaysia (32 victim posts) indicate expanding ransomware operator interest in Asia-Pacific markets.

  
  
• Latin America is an active campaign theater: Brazil appeared in six documented campaigns. That is the highest LATAM representation, reflecting growing interest among ransomware operators in the region’s large enterprise base.

TTPs detected in ransomware activity

Key attack patterns

• ClickFix is the new initial access vector: Browser-based social engineering and malicious copy-and-paste that bypasses email security control (T1204.003) emerged as the dominant new initial access vector.  It replaces traditional phishing attachments across Interlock, Qilin, Velvet Tempest, and LeakNet campaigns. Underground forum activity on exploit.in confirms active development of ClickFix payloads for RMM staging, with actors sharing technical implementation guidance (mshta + JavaScript on the domain).

• Primary technical initial access method: Exploit public-facing application appearing in 32% of campaigns. SonicWall VPN (Akira), enterprise firewall zero-days (Interlock), Oracle E-Business Suite CVE-2025-61882 (Clop), and GoAnywhere MFT CVE-2025-10035 (Storm-1175) are the most exploited entry points.

• Credential harvesting is near-universal in post-exploitation: Mimikatz appeared in 11 campaigns, and DCSync was documented in Warlock’s attack chain. Valid Accounts (T1078) appeared in 32% of campaigns, confirming that stolen credentials, not just exploits, are a primary persistence mechanism.

• Double extortion is standard practice: Financial Theft (T1657) appeared in 24% of campaigns, characterized by the use of cloud-syncing tools like  RCLONE and Restic (INC Ransom) to steal data before encryption begins. The launch of Leak Bazaar, an ML-powered data monetization platform, signals a trend toward a corporate-style extortion workflow.

• Legitimate tool weaponization evasion strategy: Cloudflare Tunnel (8 campaigns), Velociraptor DFIR tool (Warlock, Storm-2603), SimpleHelp/ConnectWise/AnyDesk RMM tools, and Restic backup software were all systematically abused to live-off-the-land, blend ransomware activity into normal IT operations, and evade detection.

Strategic implications and recommendations

The ransomware landscape from October 2025 to March 2026 demands a fundamental reassessment of defensive priorities. Dominant legacy groups collapsed and were rapidly replaced by new, more sophisticated actors. This shift coincides with the convergence of nation-state and criminal interests.  Additionally,  attackers utilize AI tools and systematically weaponize legitimate IT management tools.  Combined, these factors indicate that traditional signature-based defenses and perimeter-focused strategies are increasingly insufficient. Organizations must assume ransomware operators have already adapted to common defensive measures and are actively developing novel evasion techniques.

The shift from traditional phishing to ClickFix (browser-based social engineering that bypasses email security controls) as a primary initial access vector requires immediate investment in user awareness training specifically targeting browser-based social engineering, alongside endpoint controls that prevent unauthorized script execution from browser contexts.

Key defensive priorities

• Implement zero-trust controls for RMM tools: Attackers systematically abused AnyDesk (16 campaigns), ConnectWise Control (10), and SimpleHelp to maintain persistent access and enable lateral movement. Establish an approved RMM tool inventory, block unauthorized endpoint remote access software, and require MFA for all remote access sessions.

• Prioritize VPN appliance patching: Implement VPN appliance patches immediately, especially for SonicWall, Fortinent, and Cisco GlobalProtect. Akira achieved full compromise-to-encryption in under one hour via SonicWall VPN exploitation. Underground forums show active recruitment of AD experts specifically for VPN-based initial access, and brute-forcing tools for these platforms are actively sold on exploit.in.

• Deploy behavioral detection for BYOVD (Bring Your Own Vulnerable Driver) attacks: Multiple campaigns, including CrazyHunter, DeadLock, Interlock, and Warlock, used vulnerable gaming and DFIR drivers to disable EDR/AV before encryption. Implement driver allowlisting and monitor for known vulnerable driver hashes.

• Establish shadow copy and backup integrity monitoring: Inhibit System Recovery (T1490) appeared in 38% of documented campaigns, and VSSAdmin was the fifth most commonly used tool across campaigns. Maintain offline, immutable backups and test restoration procedures quarterly.

The Q4 2025 to Q1 2026 vulnerability landscape is defined by two converging crises: an unprecedented volume of new disclosures and an exponential collapse in the time defenders have to mitigate them. AI has dramatically lowered the barrier to discovering new vulnerabilities. Open-source software (OSS) maintainers and enterprise security teams are already overwhelmed trying to keep up, and this AI-assisted discovery trend suggests the storm has barely begun.

Data aggregated from the National Vulnerability Database (NVD) illustrates a trajectory that is rapidly outpacing traditional triage methodologies. In Q4 2025, the NVD recorded 13,166 new vulnerabilities, a number that accelerated to at least 14,128 in Q1 2026. Predictive modeling from FIRST anticipates approximately 59,000 vulnerabilities for the entirety of 2026, warning that reaching 70,000 to 100,000 vulnerabilities is entirely realistic. This sheer volume represents a massive operational burden for security teams, preparing the industry for a shift to a 100,000-vulnerability paradigm.

While the sheer number of vulnerabilities expands, the window to defend against them is aggressively shrinking, signaling the death of the 30-day patch cycle. Intelligence from the Zero Day Clock indicates the defender's response window is approaching zero. In 2025, the mean time-to-exploit (TTE)—the gap between public disclosure and a confirmed, weaponized exploit—was 23.2 days. By Q1 2026, this “mean TTE” had been violently compressed to just 1.3 days.

A strong wake-up call is buried within this data: most exploitation now happens before disclosure. In Q1 2026, an estimated 69.7% of exploited CVEs were true zero-days, meaning they were exploited before or on the very day of disclosure. Given this, highly sophisticated actors are clearly sitting in the “negative weeks” or “negative months” for their true TTE. If the exploit is already in the wild before the CVE is published, the speed of patching cycles becomes largely irrelevant.

The bleeding edge: Rapid weaponization of zero-days and 1-days

Against this macro backdrop, Trellix telemetry reveals the frontline reality. Our sensors observed an unprecedented speed of exploitation for newly disclosed vulnerabilities, confirming that the "patching grace period" is obsolete.

• The "React2Shell" Crisis (CVE-2025-55182): Trellix NX IPS telemetry recorded over 34K hits for this critical pre-authentication RCE in React Server Components, making it the #4-most-detected CVE globally. Validating this massive volume, Trellix SecondSight hunting operations observed threat actors aggressively exploiting this framework flaw to deploy backdoors almost immediately after its late-2025 disclosure, highlighting a severe supply chain risk.

• The "ToolShell" chain: Trellix NX IPS recorded 3K hits for Microsoft SharePoint vulnerability CVE-2025-53771, while Trellix Helix telemetry identified frequent attempts against its sister vulnerability, CVE-2025-53770. Buttressing these telemetry metrics, SecondSight observed attackers chaining these exact late-2025 vulnerabilities (an auth bypass and a deserialization flaw) to achieve unauthenticated RCE. Ransomware affiliates heavily used this chain to establish beachheads before organizations could apply out-of-band patches.

• Infrastructure strikes (CVE-2025-49844): Trellix telemetry flagged emerging exploitation attempts against this critical vulnerability. On October 8, 2025, SecondSight tracked the targeted weaponization of this flaw, observing malicious net_help.exe and explorer.exe processes sending POST requests to attacker infrastructure (signedward[.]com). Based on code overlaps with "SingleCamper," Trellix assesses with medium confidence that the RomCom threat group was behind this activity.

• The 24-Hour weaponization cycle (CVE-2026-21509): On January 28, 2026, Trellix SecondSight detected Russian state-sponsored group APT28 (Fancy Bear) launching a sophisticated spear-phishing campaign. Remarkably, APT28 weaponized CVE-2026-21509 (a Microsoft Office security feature bypass) within 24 hours of its public disclosure. The infection chain executed a fileless .NET loader in memory, deploying the "CovenantGrunt" implant—which abused legitimate cloud storage (filen.io) for C2—and "NotDoor," an Outlook macro backdoor. Highlighting the rapid proliferation of 1-day attacks, SecondSight observed a separate campaign just weeks later using the same CVE to target foreign ministries, establishing C2 on infrastructure previously linked to DPRK operations. Trellix Email Security successfully blocked both campaigns.

Shift the defense to runtime. When vulnerability weaponization timelines shrink to zero, the traditional "find and patch" model is simply too slow. Stop measuring success solely by patch deployment speed. Shift your strategy toward prevention and robust runtime behavioral controls that can catch zero-day exploits—like fileless memory injection—as they execute.

The silent killers: The N-day long tail

While there is a tendency to fixate on the latest zero-days, our telemetry paints a stark picture of the "background radiation" of the internet. Threat actors do not need new exploits when legacy technical debt remains so pervasive.

• Automated perimeter scanning: Trellix NX IPS telemetry recorded more than 70K hits for Nmap, making it the second-most-detected "application" in our global data. The sheer volume of continuous perimeter scanning suggests a highly automated reconnaissance landscape, likely increasingly augmented by agentic AI and botnets mapping the internet 24/7.

• Legacy application and edge risk: Trellix NX IPS recorded just over 100K hits targeting PHP and 59K hits targeting F5 BIG-IP, underscoring the severe risk of legacy web applications and edge infrastructure.

• Sustained targeting of collaboration platforms: Trellix Helix telemetry confirms that attackers ruthlessly target internal collaboration tools. Top Helix detections are heavily dominated by older, critical enterprise software flaws, specifically Atlassian Confluence (CVE-2022-26134 & CVE-2021-26084) and Microsoft Exchange (ProxyShell).

• Ubiquitous legacy vulnerabilities: Trellix NX IPS logged just over 13K hits for Log4j (CVE-2021-44228), keeping the 2021 bug firmly in the top 10 globally. Trellix Helix also continues to detect the 2014 Bash Shellshock HTTP exploit.

• APT adoption of legacy debt (CVE-2017-11882): The use of old vulnerabilities is not limited to unsophisticated actors. Serving as a prime example, on November 21, 2025, Trellix SecondSight intercepted a highly targeted spear-phishing campaign by the SideWinder APT group. Despite deploying advanced tradecraft—including geographic payload filtering and dynamic generation to evade sandboxes—the core exploit successfully relied on an eight-year-old memory corruption vulnerability in Microsoft Office.

Quiet the noise and build resilience. You cannot patch your way out of legacy technical debt. The sheer volume of automated scanning against decade-old vulnerabilities creates dangerous alert fatigue. Radically shrink your attack surface by quarantining or outright deprecating legacy systems, and ensure your network is segmented enough to withstand a compromised edge device.

October 2025 through March 2026 marks a threshold that threat intelligence analysts have long anticipated but hoped would arrive more slowly. Adversarial AI adoption has crossed from augmentation into integration. AI is no longer a productivity tool that helps a human write better phishing emails or cleaner exploit code. It is now embedded in the execution layer of attacks themselves, generating malicious commands at runtime, operating autonomously across CI/CD pipelines without human direction, and poisoning the AI tools that defenders and developers rely on daily. The question that dominated last year’s reporting: are criminals actually using AI, or just talking about it? has been definitively answered. The more pressing question now is whether the defensive ecosystem can adapt quickly enough to a threat landscape where the attacker’s toolchain is itself intelligent.

The “vibeware” doctrine: AI-generated malware at industrial scale

The most operationally significant shift in this reporting period is not a single novel malware family or a clever new evasion technique—it is a new doctrine of malware production. It was first documented in APT36’s campaign targeting Indian and Afghan government entities. Transparent Tribe, aka APT36, the Pakistan-attributed group with a decade-long history of targeting South Asian diplomatic and military networks, adopted what researchers have termed a vibeware strategy. Threat actors are using AI code generation to mass-produce implants across a deliberately diverse set of niche programming languages (e.g., Nim, Zig, Crystal, Rust, and Go) chosen not for their technical superiority but for their near-absence from commercial detection engine signature databases.

The resulting arsenal was remarkable in its breadth and deliberate mediocrity. Fourteen distinct tools were identified in a single campaign (e.g., BackupSpy, CreepDropper, CrystalShell, ZigLoader, ZigShell, NimShellCodeLoader, SheetCreep, MailCreep, and more), all communicating through legitimate cloud services such as Slack, Discord, Google Sheets, Firebase, and Supabase, in what the industry calls “living off trusted services” (LOTS). 

The code quality was, by traditional standards, poor. Logical errors, implementation flaws, and structural inconsistencies typical of AI-generated output were present throughout. APT36 did not care. The operational logic was not to build one excellent implant but to deploy many adequate ones simultaneously, overwhelming detection through sheer diversity. By consciously accepting lower code quality in exchange for higher volume, the nation-state actor has adopted a “distributed denial of detection” (DDoD) model that fundamentally changes the economics of malware development.

This doctrine has propagated beyond APT36. In January 2026, a Vietnamese cybercrime actor was identified using AI to generate malicious  PureRAT scripts for their attack campaigns. These scripts featured detailed Vietnamese-language comments and numbered debug messages, representing the unmistakable fingerprint of native-language prompting.

Static Tundra APT’s campaign against Poland’s energy sector in December 2025 is another example of the vibeware doctrine’s spreading. The attack on a manufacturing company deployed a PowerShell-based wiper, LazyWiper. This presumably AI-generated script overwrites approximately two-thirds of a file, rendering it irrecoverable. Its core file-corruption component, a C# function named WriteRandomBytes, displayed structural inconsistencies, nonsensical comments, and non-standard indentation, strongly suggesting LLM-generated code. Although the partial overwriting method was likely intended to be faster than full overwrites, it was significantly slower in practice, illustrating the doctrine’s conscious acceptance of flawed, AI-generated components in exchange for volume.

What was once a nation-state capability is now a regional cybercrime technique. The barrier to entry for sophisticated malware development has not merely lowered; it has effectively collapsed.

From AI-assisted to AI-integrated: a qualitative leap

The most technically significant development in this reporting period is not AI-assisted malware development - it is AI-integrated malware execution. Google’s Threat Intelligence Group documented two malware families, PromptFlux and PromptSteal, that call LLM APIs at runtime to dynamically generate their own malicious commands. Rather than executing a fixed payload, these tools query a language model mid-operation and act on the response, enabling real-time behavioral adaptation that renders static analysis and signature detection fundamentally insufficient. A parallel family, HonestCue, was documented abusing Google’s own Gemini API for the same purpose - runtime code generation as a core malware capability.

This is a qualitative leap, not an incremental one. Traditional malware analysis depends on the assumption that malicious behavior is encoded in the binary or script being examined. PromptFlux breaks that assumption entirely. The malicious behavior is generated fresh at execution time, shaped by the current environment, the target’s defenses, and whatever the LLM produces in response to the attacker’s prompt. The implications for detection engineering are severe. Behavioral analysis can still catch the effects of these tools, but the window between execution and detection narrows dramatically when the payload is never the same twice.

The same period saw a tool called CyberStrikeAI assessed as linked to Chinese Ministry of State Security operations. It is not a conventional penetration testing framework with an AI module bolted on. Its architecture is built around LLM-driven decision-making for attack path selection. The AI determines which vulnerabilities to prioritize, which credentials to harvest, and which exploit to deploy against a given target profile. Automated vulnerability scanning, target profiling, credential harvesting, and exploit selection are all orchestrated by the AI layer rather than by a human operator making sequential decisions.

This represents a significant shift from “AI-assisted” to “AI-native” offensive tooling. The practical implication is that the human operator’s role shifts from tactical decision-maker to strategic director and the AI handles the execution logic. A campaign Trellix observed in February 2026 illustrated what this looks like in practice. An actor used AI to automate and optimize the exploitation of FortiGate devices globally, with the AI making tactical decisions about lateral movement sequencing (DCSync, Pass-the-Hash, LLMNR poisoning), rather than a human operator working through a playbook. The AI was not generating code; it was orchestrating post-exploitation operations autonomously.

AI infrastructure: from tool to target

As AI platforms have become critical enterprise infrastructure, they have become critical attack targets. In November 2025, Trellix witnessed a campaign exploiting a vulnerability in the Ray AI compute engine to compromise over 230,000 exposed servers, transforming them into a self-propagating botnet capable of cryptomining, DDoS, and data theft. A key element of this campaign was the use of AI against AI, where threat actors utilized LLM-generated code to enhance their attack methods. The attack involved a sophisticated Python payload that intelligently allocated 60% of cluster resources to maximize profits while skillfully avoiding immediate detection.

The attack surface expanded further in February 2026 with the discovery of 2,200 malicious OpenClaw AI agent skills, each containing encoded commands in SKILL.md files that deploy the Atomic macOS Stealer when executed by an AI agent. This is a supply chain attack against the AI agent ecosystem itself. The plugin and skill marketplaces that AI platforms depend on for extensibility have become malware distribution channels.

A week later, malicious GitHub repositories posing as OpenClaw installers became the top-rated result in Bing AI search for “OpenClaw Windows,” exploiting AI-powered search recommendations to surface malware at the moment of highest user trust.

In February 2026, VirusTotal highlighted the abuse of OpenClaw infrastructure involving several sophisticated attack techniques, including indirect prompt injection, execution hijacking, semantic worm propagation, SSH injection, environment harvesting, and prompt file implantation. The exploitation of the OpenClaw AI ecosystem is driving a significant evolution in the AI-based threat landscape, marked by the emergence of these types of novel cyberattack methods. Trellix anticipates this trend will only continue, leading to a new wave of sophisticated, hard-to-detect attacks that exploit OpenClaw's inherent advanced capabilities.

The Shai-Hulud-Style npm worm campaign, identified in February 2026, combined nineteen typosquatted npm packages with MCP server injection targeting AI coding assistants - Cursor, Claude Desktop, and similar tools - to harvest LLM API keys and poison the code generation pipeline. The campaign’s most alarming feature was its use of local LLMs to generate polymorphic evasion variants, combined with a 48-96 hour time-gated execution delay to evade sandbox analysis. If an AI coding assistant is compromised, every piece of code it generates or reviews for a developer becomes a potential attack vector. The implications for software supply chain security are profound and largely unaddressed by current tooling.

Separately, between October 2025 and January 2026, systematic reconnaissance of LLM infrastructure was documented at scale: over 80,000 sessions from two IP addresses probing 73 or more LLM endpoints across major providers, using carefully crafted queries to fingerprint models while maintaining consistent JA4H signatures to avoid detection. Professional cybercriminals are building target lists of LLM deployments. The reconnaissance phase of a broader campaign against AI infrastructure appears to be well underway.

The shift of AI infrastructure "from tool to target" means these critical platforms are now facing mass resource compromises and novel supply chain threats that poison code generation and agent marketplaces. This demonstrates that adversarial AI is integrated into the core execution of attacks, necessitating an urgent defense adaptation to counter these new threats against the software supply chain.

AI as a capability multiplier for low-skill actors

Perhaps the most consequential long-term implication of this reporting period is not what sophisticated nation-state actors are doing with AI, but  what unsophisticated actors are now capable of doing with it. 

In February 2026, a Russian-speaking threat actor assessed to have limited independent technical capability used commercial AI services to automate reconnaissance, credential extraction, and post-exploitation DCSync attacks across 600 FortiGate devices in 55 countries. The tools used—  Mimikatz, Meterpreter, Impacket, Nuclei— are not novel. The scale of the operation, however, would previously have required a team with substantial operational experience to coordinate. AI augmentation collapsed that requirement entirely.

This finding demands a revision of how the industry thinks about threat actor tiers. The traditional model, where nation-states were at the top, organized crime was in the middle, and script kiddies were at the bottom,  assumed that operational scale correlated with technical sophistication. That assumption is no longer valid. A low-skilled actor with access to commercial AI services and a willingness to automate can now achieve operational reach that was previously the exclusive domain of well-resourced groups. Threat modeling that relies on capability assessment as a proxy for likely impact is increasingly unreliable.

The underground marketplace has responded to this demand. In January 2026, a threat actor operating as ‘ImpactSolutions’ advertised an AI-enhanced metamorphic crypter on the Exploit forum, using AI to generate polymorphic code variants that evade signature detection - a purchasable service, not a bespoke capability. A separate listing by ‘Shadowx007’ on Darkforums offered APEX AI, described as an automated APT-level penetration-testing tool covering cloud exploitation, ransomware deployment, and exploit-kit functionality.

The commoditization of AI-enhanced offensive capabilities through underground markets means that the capability uplift documented in nation-state campaigns will propagate to criminal actors on a timeline measured in months, not years.

Deepfakes, voice synthesis, and the social engineering frontier

North Korea’s BlueNoroff sub-group deployed AI-generated deepfake video as an initial access vector against cryptocurrency and DeFi firms across 10 countries in a campaign observed from  October 2025 to February 2026. The attack chain included  a compromised Telegram account and a fake Zoom meeting featuring an AI deepfake of a trusted contact.  A ClickFix prompt then granted initial access deploying a seven-family macOS malware ecosystem coordinated to bypass macOS Transparency, Consent, and Control (TCC) security, steal browser data, and establish multiple persistence mechanisms. The deployment of seven novel malware families in a single campaign against a single target sector reflects industrial-scale tooling investment that AI-assisted development has made economically viable.

The underground market has arrived at the same destination from a different direction. In February 2026, a seller operating as ‘BlackStoneX’ on BHF forum began advertising a full-service AI deepfake bureau specifically engineered to defeat financial KYC controls, at prices starting from $100 per video.

Post translation

Toggle translation

The service offers face replacement, document forgery combined with matching deepfake video, and verified successful bypasses across cryptocurrency platforms, virtual credit card services, betting sites, and casinos. At $100 per identity package, this is not a boutique service; it is a commodity. Multiple competing services were referenced in the same thread, indicating a mature, competitive market with sustained demand from fraud operators who need clean account access at scale.

The Scattered Lapsus$ alliance  (a consolidation of Scattered Spider, Lapsus$, and ShinyHunters operating as a coordinated threat group) continued its AI-powered voice phishing operations through this period. Using synthesized voices, they  impersonated IT staff during  real-time calls to bypass MFA and gain access to Salesforce and Snowflake environments across retail, telecoms, finance, and aviation targets. The technique requires no malware, no exploit, and no technical sophistication at the point of entry. It  only needs a convincing voice and a target who follows standard IT support procedures. AI voice synthesis has made that convincing voice available on demand.

North Korean threat actors also built a fully functional fake job platform impersonating Anthropic and Anchorage Digital, specifically targeting AI researchers, cryptocurrency professionals, and software developers in the United States. The platform, built in React Next.js with convincing job application workflows,  represents a strategic intelligence collection priority. DPRK is not merely targeting AI companies for financial gain but appears to be systematically attempting to acquire AI research, access, and talent intelligence. The choice to impersonate Anthropic specifically, rather than a generic technology company, suggests a level of targeting precision that goes beyond opportunistic credential theft.

The C2 channel hiding in plain sight

A campaign identified in November 2025 introduced a C2 evasion technique that deserves particular attention from network defenders. It involved malware traffic disguised as LLM API calls, routed through Tencent Cloud Function servers using the standard /v1/chat/completions endpoint format with Base64 and XOR encoding. The technique exploits a specific gap in enterprise security posture— the widespread allowlisting of AI service traffic that organizations have implemented to support legitimate AI tool usage. By mimicking the traffic patterns of commercial LLM APIs, the malware’s C2 communications blend into the background noise of normal AI operations, invisible to network monitoring tools that treat AI service traffic as inherently benign.

This emerging threat vector has been further exemplified by the discovery of SesameOp, a backdoor that leverages the OpenAI Assistants API C2 channel. SesameOp is a novel backdoor that uses the legitimate OpenAI Assistants API for its C2 communications. Instead of relying on traditional attacker-controlled servers, SesameOp abuses the OpenAI API as a relay mechanism to stealthily fetch encrypted commands and exfiltrate data. The malware uses defense evasion techniques, such as .NET AppDomainManager injection through compromised Microsoft Visual Studio utilities. Specifically, it interacts with vector store lists and custom Assistants within the OpenAI platform to orchestrate its activities. This sophisticated abuse of a legitimate, trusted AI service further highlights the challenge of distinguishing between benign AI service traffic and covert malicious operations.

This technique of masquerading in legitimate AI communication will continue to proliferate. As enterprise AI adoption increases and AI service traffic becomes a larger proportion of total network activity, the signal-to-noise ratio for detecting malicious traffic masquerading as LLM calls will only worsen.

Security teams that have not yet developed specific detection logic for anomalous AI API traffic patterns, such as unusual volumes, off-hours activity, unexpected destination IPs claiming to be AI services, should treat this as an urgent gap.

Conclusion

From October 2025 to March 2026, the use of adversarial AI by cybercriminals reached a pivotal point. It is no longer just aiding human attackers but is now systematically embedded in the core execution phase of AI-empowered attacks.

AI has not merely made existing attacks faster or cheaper - it has created new attack categories (autonomous agents, runtime LLM integration, C2 evasion), new targets (AI infrastructure and models), and new capability distributions (low-skill actors achieving nation-state operational scale).

For defenders, the implication is urgent: security teams must now rapidly develop specific detection logic for anomalous AI API traffic patterns and adapt to a threat environment where the attacker's tools possess inherent intelligence. The industry’s response to these structural changes will define the threat landscape for the next several years.

The period between October 2025 and March 2026 represents a grim maturation of supply chain warfare. Moving beyond simple typosquatting, threat actors integrated immutable blockchains into their C2 infrastructure to evade traditional security scanners. These sophisticated tactics, ranging from tag-poisoning to phantom dependencies, exploit the fundamental trust we place in developer tools and open-source registries.

GlassWorm

First observed in October 2025, GlassWorm is a threat actor cluster targeting IDE extensions on the Open VSX Registry and Microsoft Visual Studio Marketplace. The initial variants used invisible Unicode characters to conceal malicious code from editors and review tools, impersonating popular extensions for Flutter, Angular, Tailwind, and Vue. A credential theft module harvested developer tokens from infected machines and used them to propagate further, creating a self-reinforcing cycle. Developers’ compromised credentials were used to inject malware into their repositories, which in turn infected downstream consumers.

By March 2026, GlassWorm had expanded into two new delivery vectors. ForceMemo compromised hundreds of GitHub repositories by force-pushing obfuscated malware into Python projects, rewriting git history to make the injections invisible during normal code review. Combined with a parallel wave using invisible Unicode injection and the npm hijacking operation described below, GlassWorm affected over 400 projects and packages across Python and JavaScript repositories, VS Code extensions, and npm libraries.

A parallel operation hijacked the npm maintainer account behind two widely used React Native packages with approximately 130,000 combined monthly downloads. It ultimately distributed the malware through both direct and transitive dependency paths where surface-level scanners were unlikely to detect it.

Key takeaways

All three GlassWorm delivery vectors (IDE extensions, ForceMemo, and npm hijacking) use the Solana blockchain as a command-and-control (C2) channel, posting base64-encoded payload URLs as transaction memos and polling public RPC endpoints to retrieve them. The C2 infrastructure is immutable, resistant to traditional takedown mechanisms, and the traffic blends with legitimate Web3 activity.

The npm campaign evolved rapidly. The first wave used obvious install hooks and was caught within minutes. By the third wave, days later, the attacker had locked out the legitimate maintainer, removed all visible indicators from the parent package, and shifted to floating version pins so the payload could be updated through the deepest transitive dependency alone.

The force-push technique used in ForceMemo poses a particular challenge for organizations that rely on commit-level auditing.The rewritten history preserves original author information and commit messages, leaving only subtle metadata discrepancies as forensic evidence. Across all GlassWorm activity, compromised developer credentials are the primary propagation mechanism.

TeamPCP

Between late February and  late March 2026, a second threat actor cluster, TeamPCP, executed a cascading series of compromises against widely used open source security and infrastructure tools. The initial target was Trivy, one of the most widely adopted open-source vulnerability scanners, deployed in thousands of GitHub Actions workflows. The attackers gained access through incomplete remediation of a prior security incident involving the Trivy repository. They then used tag poisoning to redirect nearly all version tags to malicious commits. The compromised action extracted secrets from the CI/CD runner memory and exfiltrated them.

Credentials harvested from Trivy runners likely enabled the subsequent compromise of Checkmarx KICS, an infrastructure-as-code scanner, using the same tag-poisoning technique. Within the same week, a PyPI token exposed through the Trivy incident was used to publish backdoored versions of LiteLLM, an AI proxy framework that Wiz estimates is present in 36% of cloud environments. Three days after that, the same operator backdoored the Telnyx Python SDK.

TeamPCP also deployed CanisterWorm, a self-propagating npm worm that used stolen tokens to inject itself into more than 60 packages across multiple npm namespaces.

Key takeaways

The TeamPCP campaign demonstrated how a single initial compromise can propagate across the ecosystem. Credentials stolen from the Trivy incident directly enabled the LiteLLM and CanisterWorm compromises. Additionally, KICS and Telnyx were linked to the same operator through shared forensic artifacts. The LiteLLM and Telnyx compromises shared an identical RSA-4096 encryption key, and all four attacks were linked through shared infrastructure and methodology, confirming a single threat actor.

The Trivy and KICS compromises exfiltrated stolen credentials to typosquatted domains impersonating the legitimate vendor brands. CanisterWorm used a different approach, relying on Internet Computer Protocol (ICP) blockchain canisters, a form of decentralized smart contract, for takedown-resistant command and control. The LiteLLM compromise relied on traditional C2 domains, while the Telnyx payload exfiltrated to a bare IP address.

Security tools run with elevated privileges in build pipelines, have access to secrets by design, and are generally trusted by default. Compromising one gives an attacker credentials, network access, and a position inside the security boundary in a single step.

The tag-poisoning technique used to compromise Trivy and KICS exploits a common GitHub Actions practice, where workflows reference actions by mutable version tags rather than immutable commit hashes. Any workflow following this convention pulls the compromised code automatically. The LiteLLM compromise introduced an additional evasion technique. It leveraged a Python interpreter feature to execute code on every process startup without any install hook or postinstall script, bypassing a class of security scanners entirely.

Axios

On March 31, 2026, attackers compromised the npm account of Axios’ lead maintainer. It is a  widely used HTTP client library with approximately 100 million weekly downloads. Two malicious versions were published within 39 minutes.

The Axios source code itself was left untouched. Instead, the attacker added a phantom dependency, a typosquat of a legitimate cryptography library, that was never imported anywhere in the codebase. The dependency's primary purpose was to execute its postinstall hook, which deployed platform-specific remote access trojans for macOS, Windows, and Linux. The RAT provided arbitrary code execution and secondary payload deployment capabilities, with persistent access on Windows established via a combination of file drops and a Registry Run key. After execution, the dropper deleted itself and replaced the package manifest with a clean stub, complicating post-incident forensics on affected machines.

The C2 domain had been registered approximately eight hours before the first malicious version was published, suggesting a tightly coordinated operation. npm's security team removed both versions in approximately three hours. Google’s Threat Intelligence Group has since attributed the attack to UNC1069, a financially motivated North Korean threat actor. No connection to GlassWorm or TeamPCP has been identified.

Key takeaways

The Axios compromise shows the blast radius of a single maintainer account compromise at the top of the dependency tree. Even with a three-hour exposure window, the library's download volume means a significant number of organizations likely pulled one of the compromised versions before they were removed.

The phantom dependency technique is effective because automated tools comparing source code diffs between versions would find no changes; the only indicator was the addition of an unfamiliar dependency in the package manifest. Organizations monitoring their software supply chains should be tracking dependency changes, not just source code changes, across the packages they consume.

The attack also reflects a structural weakness in the open source ecosystem: high-impact packages with hundreds of millions of downstream consumers can be compromised through a single maintainer account with publish access, and the authentication requirements for those accounts are set by the registry, not by the downstream organizations that depend on them. Until registries enforce stronger authentication and token management requirements for maintainers of high-impact packages, account takeover will remain the most efficient entry point for supply chain attacks.

The supply chain attacks in Q1 2026 share a common root cause: compromised developer and maintainer credentials. Require hardware security keys for all accounts that can publish packages or push to production repositories. Pin CI/CD actions to immutable commit references rather than mutable version tags. Implement monitoring for unexpected dependency changes in lockfiles, particularly the addition of unfamiliar transitive dependencies or shifts from pinned to floating version references.

• Rise of AI-generated payloads: Adversaries are leveraging large language models (LLMs) to rapidly generate, obfuscate, and iterate malicious payloads. A notable example is the deployment of AI-generated code, such as the DCRat "vibe coded" scripts, which utilize AI to dynamically bypass static detection signatures. These AI-assisted malware families often contain Russian or Farsi language prompts and intentional bloat code to confuse heuristic analysis.

• Proliferation of virtual machine evasion: With rising frequency, threat actors are using the Run Virtual Instance technique to bypass host-based EDR telemetry. For example, the Curly COMrades campaign deployed custom Alpine Linux VMs via Hyper-V to host CurlyShell and CurlCat, successfully shielding their malicious tools from host-level security.

• "Living-off-the-cloud" for C2 and hosting: Threat groups are demonstrating widespread abuse of trusted cloud platforms, particularly GitHub and Telegram, for C2 and payload staging. By utilizing web services and web protocols, actors blend malicious communications with legitimate enterprise traffic. Campaigns like the Astaroth banking trojan utilized GitHub repositories to host configuration files via steganography. At the same time, numerous Python-based RATs leveraged the Telegram Bot API for encrypted exfiltration and command execution.

• SEO poisoning and "pull" social engineering: There is a distinct paradigm shift toward "pull" social engineering tactics that uses SEO poisoning to lure victims to malicious infrastructure. Advanced operations guide users searching for legitimate software (e.g., VPN clients, AI tools) into "FakeCaptcha" frameworks. This mechanism forces the victim to manually copy and paste malicious scripts, thereby executing malware like Latrodectus or NetSupport RAT while bypassing standard email gateways.

• Targeting the developer supply chain: Threat actors aggressively compromised npm, PyPI, and VS Code extensions to target software developers. State-sponsored groups, such as North Korea's UNC5267 (Lazarus), deployed hundreds of malicious packages to deliver BeaverTail and InvisibleFerret malware. These campaigns specifically harvested source code, CI/CD secrets, and cryptocurrency wallets via compromise software dependencies and tools.

• Exploitation of critical edge infrastructure: Rapid weaponization of zero-day and n-day vulnerabilities dominated initial access vectors. High-profile exploitation included the React2Shell vulnerability (CVE-2025-55182), which saw global attacks deploying cryptominers and RATs within hours of disclosure. Furthermore, extensive attacks on SonicWall VPNs (CVE-2024-40766) and Oracle WebLogic environments facilitated rapid ransomware deployments and deep network infiltration.

• Ransomware cartels and advanced extortion: Ransomware operations evolved from decentralized affiliates into well-organized cartels. The DragonForce group matured into a multi-variant cartel operation, partnering with initial access brokers like Scattered Spider. Extortion groups uniformly adopted bring your own vulnerable driver (BYOVD) tactics to terminate EDR processes and leverage legitimate RMM tools (e.g., SimpleHelp, ScreenConnect) exfiltrating data to deploying payloads.

• Geopolitical espionage and hybrid warfare: Nation-state operations closely mirrored kinetic conflicts. Russian-aligned actors (APT28, Sandworm) aggressively targeted Ukrainian infrastructure and European defense entities using zero-days and wipers (e.g., DynoWiper). Concurrently, Chinese actors (Mustang Panda, Silver Fox, APT41) expanded operations across Southeast Asia and the Middle East. Additionally, Iran-aligned groups (MuddyWater, Boggy Serpens) escalated attacks against critical infrastructure in response to regional tensions.

Comparison with previous six months

The global threat landscape shifted notably during the current period. Geographically, while the USA remains the primary target, India moved into the second position as South Korea’s share of activity declined. Brazil also emerged as a significant focal point, appearing as the third most targeted nation globally.

Sector targeting saw Government return to the top of the list, followed by Finance. Both industries, however, saw their relative shares decrease as targeting became more distributed across the landscape. Conversely, threat actor attribution grew more concentrated; groups like MuddyWater and UNC5267 became highly active, with the top five actors accounting for a much larger portion of total activity than before. Tactically, traditional dual-use tools like PowerShell remain central to operations despite a decline in reported frequency.

Outlook for CISOs

Based on the highly evasive and infrastructure-centric attacks observed between October 2025 and March 2026, organizations must continue to adapt their defensive postures to counter threats that actively manipulate trust and user behavior. We recommend focusing on the following strategic imperatives:

• Integrate strategic threat intelligence: Institutionalize continuous, strategic, and operational threat and vulnerability intelligence consumption to stay ahead of the most sophisticated emerging threats, TTPs, and dedicated threat actors.

• Fortify proactive deception and end-user trust defenses: Prioritize hardening the user execution environment and moving beyond traditional email filtering to  counter social engineering that leverages trusted interfaces. 

• Ensure supply chain integrity and development environment security: Establish rigorous zero-trust principles for the software development lifecycle (SDLC) and stay ahead of the most pervasive efforts to secure the entire developer toolchain against external compromise.

• Manage cloud egress and prevent lateral movement: Implement advanced behavioral monitoring and strict egress control to prevent the abuse of legitimate cloud platforms for C2 and data exfiltration.

• Accelerate vulnerability response for public-facing infrastructure: Treat all public-facing and edge infrastructure as the most critical access vectors, demanding a sub-24-hour response for patching and robust continuous monitoring to prevent rapid weaponization.

Application: How to use this information

It’s imperative that any industry-leading assessment team and process understand, acknowledge, and, where possible, mitigate the effects of bias – the natural, embedded, or invisible inclination to either accept, reject, or manipulate facts and their meaning. The same precept holds true for consumers of the content.

Unlike a highly structured, control-based mathematical test or experiment, this report is inherently a sample of convenience – a non-probability type of study often used in medical, healthcare, psychology, and sociology testing that makes use of data that is available and accessible.

• In short, our findings here are based on what we can observe and, pointedly, do not include evidence of threats, attacks, or tactics that evaded detection, reporting, and data capture. 

• In the absence of “complete” information or “perfect” visibility, this is the type of study best suited to this report’s objective: to identify known sources of critical data on cybersecurity threats and develop rational, expert, and ethical interpretations of this data that inform and enable best practices in cyber defense