10 minhigh
July 2026 Threat Trend Report on APT Groups
The July 2026 ASEC/AhnLab threat trend report describes a shift among state-sponsored and financially motivated threat actors toward abusing legitimate accounts, cloud platforms, and developer supply chains rather than relying solely on custom malware. Groups from North Korea, China, Russia, Iran, and South Asia used phishing, ClickFix-style social engineering, supply chain compromise of open-source repositories, webmail vulnerabilities, and device-code OAuth flow abuse to achieve initial access, credential theft, and long-term persistence. Common post-compromise tradecraft includes script-based execution (PowerShell, VBScript, CMD, JavaScript), obfuscation, ingress tool transfer, HTTP/HTTPS C2, and abuse of legitimate cloud services such as Filen.io, Proton Drive, and Google Sheets for command-and-control and exfiltration.
Conf:medium
Detection / HunterAnthropic
What Happened
This report summarizes a month of activity from multiple government-linked hacking groups around the world, tracked by security researchers at AhnLab. The affected parties span businesses, universities, government officials, and software developers across several countries, including organizations using Microsoft 365 email, cloud storage, and open-source software packages. This matters because the attackers are increasingly hijacking legitimate accounts, cloud tools, and even open-source code repositories instead of using obviously malicious software, which makes their activity harder to spot with traditional antivirus tools. Organizations should prioritize multi-factor authentication (a second login verification step beyond a password), separate day-to-day accounts from administrator accounts, monitor logs across their systems, verify the integrity of open-source software they use, and audit business partners who have access to their networks.
Key Takeaways
- State-sponsored groups across North Korea, China, Russia, Iran, and South Asia are shifting toward abuse of legitimate accounts, cloud services, and developer ecosystems rather than relying primarily on custom malware.
- North Korean groups combined ClickFix-style social engineering in fake Zoom/Teams meetings with compromised GitHub maintainer accounts to inject obfuscated JavaScript loaders into npm, Packagist, Go modules, and Chrome extensions.
- China-linked actors emphasized long-term persistence, SYSTEM-level command execution, and ORB network infrastructure built from compromised Ruckus and ASUS routers.
- Russia-linked groups exploited webmail platforms and the Microsoft device-code authentication flow to steal OAuth tokens and Microsoft 365 credentials, including via compromised hotel and conference Wi-Fi gateways.
- Multiple groups used legitimate cloud and collaboration services (Filen.io, Proton Drive, Google Sheets, AnyDesk) as command-and-control or exfiltration channels to blend in with normal traffic.
Affected Systems
- Microsoft 365 accounts
- Webmail platforms (Zimbra, Outlook Web Access, Roundcube, SOGo)
- Windows and macOS endpoints
- GitHub repositories and npm/Packagist/Go module ecosystems
- Chrome browser extensions
- VPN and remote access systems
- Ruckus wireless routers and ASUS AiCloud routers
- Cloud infrastructure and container environments
- Mobile devices
- University and manufacturing enterprise networks
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing, social engineering (fake meeting lures, ClickFix), supply chain compromise of GitHub/npm/Packagist packages, or exploitation of webmail and router vulnerabilities.
- Execution: Script-based execution using PowerShell, VBScript, CMD, or JavaScript, often obfuscated to evade detection.
- Persistence and Privilege Escalation: SYSTEM-level command execution, registry hive persistence, DLL sideloading, and installation of remote access tools such as AnyDesk.
- Command and Control: HTTP/HTTPS-based C2 or abuse of legitimate cloud services (Filen.io, Proton Drive, Google Sheets) to blend in with normal traffic.
- Credential Access and Collection: Harvesting of browser credentials, cookies, OAuth tokens, emails, and local system data via tools like TAMECAT, ZimReaper, OWAReaper, and BusySnake.
- Exfiltration: Data staged and exfiltrated via established C2 channels or reverse SSH tunnels.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article is a high-level trend report and does not include YARA, Sigma, Snort/Suricata rules, or query language content. It references AhnLab's TIP (Threat Intelligence Platform) as a source for deeper indicator and detection data.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Several described techniques such as script-based execution, DLL sideloading, registry persistence, and use of tools like mshta.exe and git.exe would typically be visible to EDR process and script monitoring, but abuse of legitimate cloud services and valid accounts reduces the signal-to-noise ratio. |
| Network Visibility | Medium | HTTP/HTTPS C2 and abuse of legitimate services such as Filen.io, Proton Drive, and Google Sheets blend with normal cloud traffic, making network-based detection dependent on TLS inspection or cloud access visibility rather than simple domain reputation. |
| Detection Difficulty | Hard | The described activity relies heavily on valid accounts, legitimate cloud services, and living-off-the-land tools, which reduces the effectiveness of signature-based detection and requires behavioral and anomaly-based approaches across identity, cloud, and endpoint telemetry. |
Required Log Sources
- Windows Event Logs (process creation, PowerShell script block logging)
- Microsoft 365 / Entra ID sign-in and OAuth consent logs
- Webmail server access logs (Zimbra, OWA, Roundcube, SOGo)
- GitHub/npm package publish and maintainer account activity logs
- Router/firewall administrative access logs
- EDR telemetry for script interpreters and remote access tools
- DNS query logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for anomalous Microsoft device-code authentication flows or unexpected OAuth token grants, which may indicate credential phishing tied to Wi-Fi gateway compromise (T1550.001, T1078). | Entra ID / Microsoft 365 sign-in logs, OAuth consent and token issuance logs | Credential Access / Initial Access | Medium - legitimate device-code flows exist for IoT and CLI tools, requiring correlation with unusual geolocation or client patterns. |
| Consider monitoring for unexpected package publish events or maintainer account changes on GitHub/npm/Packagist repositories used internally, which may indicate supply chain compromise (T1195). | GitHub/npm audit logs, package version diffs, CI/CD pipeline logs | Initial Access / Supply Chain Compromise | Low - legitimate publish activity is generally well-scoped and attributable to known maintainers. |
| Consider looking for script interpreter processes (PowerShell, mshta.exe, wscript.exe) spawning from document applications or email clients, which may indicate execution following phishing (T1059). | EDR process ancestry, PowerShell script block logging, command-line logging | Execution | Medium - administrative scripts and macros can trigger similar patterns in legitimate business workflows. |
| Consider hunting for outbound connections to consumer cloud storage or spreadsheet services (e.g., file-sharing or note-taking platforms) from server or workstation assets not normally associated with such services, which may indicate C2 or exfiltration channel abuse (T1567, T1071.001). | Proxy/firewall logs, DNS logs, cloud access security broker logs if available | Command and Control / Exfiltration | Medium - employees legitimately use cloud storage and productivity services, requiring baselining of expected usage per host role. |
| Consider auditing router and network appliance administrative interfaces for unauthorized configuration changes or firmware modification, especially on unpatched Ruckus or ASUS AiCloud devices, which may indicate ORB network infrastructure buildout (T1584). | Router/firewall admin access logs, firmware version audits, configuration change history | Infrastructure Development / Persistence | Low - legitimate administrative changes are typically scheduled and attributable to known IT staff. |
Control Gaps
- Signature-based antivirus alone will not detect abuse of valid accounts or legitimate cloud services used as C2 channels.
- Standard perimeter firewall rules may not flag traffic to reputable cloud platforms such as Filen.io, Proton Drive, or Google Sheets.
- Basic MFA without conditional access policies may not prevent OAuth token theft via device-code phishing.
- Unpatched consumer/SOHO-grade routers (Ruckus, ASUS AiCloud) are often outside standard enterprise vulnerability management scope.
Key Behavioral Indicators
- Script interpreters (PowerShell, wscript.exe, mshta.exe) launched from Office applications or email clients
- git.exe invoked in unusual process chains outside developer workflows
- Registry hive modifications used for persistence outside standard software installation patterns
- Remote access tools (e.g., AnyDesk) installed or run unattended on endpoints without a corresponding help desk ticket
- Unexpected OAuth application consent grants or device-code authentication attempts from atypical locations
- Outbound connections from server assets to consumer file-sharing or productivity cloud services
False Positive Assessment
Medium - the report describes abuse of legitimate accounts, cloud services, and administrative tools, which overlaps significantly with normal business activity and requires careful baselining to distinguish malicious use from routine operations.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing recent Microsoft 365 and webmail sign-in logs for anomalous device-code authentication or unexpected OAuth token grants.
- Consider auditing GitHub, npm, and other package repository maintainer accounts used by your organization for unauthorized changes or suspicious commits.
- Consider checking for unpatched Ruckus wireless routers or ASUS AiCloud devices on your network and applying available firmware updates.
Infrastructure Hardening
- Evaluate enforcing MFA across all Microsoft 365, webmail, VPN, and remote access accounts, prioritizing administrator accounts.
- Consider separating administrator accounts from standard user accounts and applying least-privilege access principles.
- Evaluate integrity verification processes for open-source dependencies and third-party software before deployment.
- Consider extending vulnerability management and patch cadence coverage to network appliances such as routers and VPN gateways.
- Evaluate whether integrated log monitoring spans identity, cloud, email, and endpoint telemetry to reduce detection blind spots.
User Protection
- Consider deploying EDR/XDR with behavior-based detection capable of identifying script-based execution and living-off-the-land activity.
- Evaluate whether browser credential storage is discouraged or supplemented with a managed password manager to reduce impact of browser data theft.
- Consider restricting installation of unattended remote access tools like AnyDesk to approved and monitored deployment channels.
Security Awareness
- Consider training staff to recognize fake meeting invitations (Zoom/Teams) and ClickFix-style social engineering prompts.
- Consider briefing developers on supply chain risks tied to compromised maintainer accounts and unexpected package updates.
- Consider extending security awareness programs to cover business partners and third parties with network or repository access as part of supply chain audits.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Lateral Movement
Tactic
Command and Control
Tactic