11 minhigh
June 2026 Threat Trend Report on APT Groups
The June 2026 APT trend report documents activity from 20 state-sponsored threat groups across North Korea, China, Russia, Iran, India, and Southeast Asia. A significant evolution is observed: groups are increasingly abusing legitimate cloud services (GitHub, Google Drive, Dropbox, Zoho WorkDrive), OAuth tokens, generative AI, and MaaS platforms rather than relying solely on custom malware. Supply chain compromises (notably the Mastra npm ecosystem), DLL sideloading, and cloud-based C2 channels are now standard TTPs across multiple regions, complicating traditional detection approaches.
Conf:medium
Showing defanged values
- filenameRequirement_Letter.VbsVBS script dropped by Bitter (APT-C-08) for persistence, information theft, and remote command execution via phishing disguised as 163 email service
- filenameSearch1ndexer.ExeExecutable used by CNC (APT-C-48) for file exfiltration and CMD command execution, delivered via phishing attachments disguised as personal resumes
- npm_packageeasy-day-jsMalicious npm dependency injected by APT38 (Sapphire Sleet) into the Mastra npm supply chain, affecting 140+ npm packages
Detection / Hunteropenrouter
What Happened
A monthly report describes how 20 government-linked hacking groups from countries including North Korea, China, Russia, Iran, and India are operating in June 2026. These hackers are increasingly using legitimate online services—like GitHub, Google Drive, and job sites—to hide their activities, making them harder to catch. Some groups poisoned software development tools to infect many programs at once, while others posed as recruiters or sent fake emails to trick people into opening malicious files. The targets include software developers, government agencies, military personnel, and people working in healthcare and energy. Organizations should review what software their developers download, check who has access to their cloud accounts, and train staff to recognize fake job offers and suspicious emails.
Key Takeaways
- 20 APT groups tracked across North Korea, China, Russia, Iran, India, and Southeast Asia with a notable shift toward abusing legitimate cloud services, OAuth tokens, and generative AI in operations
- APT38 (Sapphire Sleet) compromised the Mastra npm supply chain, injecting the malicious 'easy-day-js' dependency into over 140 npm packages
- Multiple groups including APT28, Mustang Panda, and Nimbus Manticore employ DLL sideloading and COM persistence for stealth on Windows systems
- Legitimate platforms (GitHub, Google Drive, Dropbox, pCloud, Zoho WorkDrive) are routinely abused for C2 communication and data exfiltration, significantly complicating network-based detection
- Iran-linked groups (MuddyWater, Nimbus Manticore) increasingly leverage external criminal MaaS ecosystems such as Russia-based TAG-150 and CastleRAT
Affected Systems
- npm package ecosystem and Node.js development environments
- REDCap survey research servers
- Zoho WorkDrive cloud collaboration platform
- Windows endpoints (targeted via LNK files, DLL sideloading, COM persistence, VBS scripts)
- Android mobile devices (SiribClone spyware)
- Developer workstations using VS Code, Cursor, GitHub, and GitLab
- Cloud identity providers supporting OAuth token flows
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Social engineering (fake job offers, code review requests, fake LinkedIn recruiters) or supply chain compromise (npm packages, development platform exploitation) delivers initial payload or credential capture lure
- Execution: Malicious files (LNK, VBS scripts, SFX archives) executed on victim systems; DLL sideloading chains and .NET AppDomain hijacking used to load payloads under legitimate-signed binaries
- Persistence: COM object persistence, VBS scripts, and legitimate service abuse establish long-term access on compromised hosts
- C2 Communication: Legitimate cloud services (GitHub Releases, Google Drive, Dropbox, pCloud, Zoho WorkDrive) used as C2 channels and payload delivery infrastructure
- Credential Theft: OAuth tokens, developer credentials, and cryptocurrency wallets harvested via info-stealing malware and credential-phishing pages
- Exfiltration: Sensitive documents, emails, and credentials covertly exfiltrated through legitimate cloud storage and web services to evade network detection
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
This article is a trend report and does not contain any detection rules, queries, or signatures. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL content is provided.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | File-based artifacts (LNK files, VBS scripts, named executables) and behavioral patterns (DLL sideloading, COM persistence) are generally visible to EDR. However, many activities involve legitimate services and signed binaries, reducing visibility for techniques like cloud C2 and OAuth token abuse. |
| Network Visibility | Low | Heavy reliance on legitimate cloud services (GitHub, Google Drive, Dropbox, Zoho WorkDrive, pCloud) for C2 and exfiltration means network traffic blends with normal user activity. TLS encryption further limits payload inspection. |
| Detection Difficulty | Hard | Multiple APT groups abuse legitimate services for C2 and exfiltration, making it difficult to distinguish malicious traffic from normal usage. Supply chain compromises require specialized package dependency monitoring. DLL sideloading using legitimate signed binaries can bypass application whitelisting. OAuth token abuse circumvents traditional authentication controls including MFA. |
Required Log Sources
- EDR process creation and file creation telemetry
- DLL loading and module load events (Event ID 7 Sysmon)
- Registry persistence modifications (Event ID 13 Sysmon)
- Cloud service audit logs (GitHub, Google Workspace, Zoho WorkDrive, Dropbox)
- OAuth token grant and usage logs from identity provider
- npm package installation and dependency resolution logs
- Network connection logs with destination hostname resolution
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| If your organization uses npm, consider hunting for packages containing the 'easy-day-js' dependency or unexpected transitive dependencies introduced through the Mastra supply chain compromise. | npm package installation logs, CI/CD pipeline build logs, package-lock.json files | Initial Access / Supply Chain | Low — the specific package name is a known malicious indicator; broader dependency hunting may produce higher false positives. |
| Consider hunting for DLL sideloading behavior where legitimate signed executables load DLLs from non-standard or user-writable directories, as multiple APT groups employ this technique. | Sysmon Event ID 7 (Image Loaded), EDR module load events with process-image path correlation | Execution / Defense Evasion | Medium — legitimate applications may load DLLs from non-standard paths; focus on known-abused signed binaries and writable directory locations. |
| If you have OAuth token audit logs, consider hunting for token grants from unexpected applications, geographies, or tokens with excessive scopes that deviate from baseline user behavior. | Identity provider audit logs, OAuth token grant and usage logs, conditional access logs | Credential Access / Persistence | Medium — legitimate service integrations may generate new token grants; establish baseline before alerting on anomalies. |
| Consider hunting for VBS scripts with document-like names (e.g., containing words like 'requirement', 'letter', 'resume') executing from user-writable locations, as Bitter and CNC APTs use this naming convention. | Process creation logs (Sysmon Event ID 1), EDR process execution telemetry with command line and file path | Execution / Persistence | Medium — some organizations use VBS scripts legitimately; correlate with execution from temp, downloads, or attachment directories. |
| If network logging captures destination hostnames, consider hunting for unusual or first-seen access to cloud storage services (Google Drive, Dropbox, pCloud, Zoho WorkDrive) from developer workstations, particularly outside business hours or from service accounts. | Proxy logs, DNS resolution logs, firewall connection logs with SNI | C2 / Exfiltration | High — cloud storage services are widely used legitimately; focus on anomalous patterns rather than mere presence. |
Control Gaps
- Traditional network security controls may not flag C2 traffic over legitimate cloud services (GitHub, Google Drive, Dropbox, Zoho WorkDrive)
- Supply chain monitoring for npm package dependencies may be insufficient or absent
- OAuth token abuse bypasses MFA and traditional authentication monitoring
- DLL sideloading using legitimate signed binaries may bypass application whitelisting controls
- Cloud service audit logs may not be aggregated into centralized SIEM for correlation
- Endpoint detection for COM object persistence may require specific registry monitoring configurations
Key Behavioral Indicators
- VBS script files with document-like names executing from user-writable directories (Bitter, CNC)
- Named executables with indexer-like names (e.g., Search1ndexer.Exe) running from non-standard locations
- npm packages containing 'easy-day-js' as a transitive dependency
- DLL sideloading chains involving legitimate signed binaries loading DLLs from writable paths
- COM object registry modifications in non-standard locations (APT28 PixyNetLoader)
- PNG files with embedded encoded payloads indicative of steganographic C2 (APT28)
- Unusual OAuth token grants from unexpected applications or geographic locations
- Cloud storage service access from developer workstations outside normal usage patterns
False Positive Assessment
Medium — File-based indicators like 'Requirement_Letter.Vbs' and 'Search1ndexer.Exe' are distinctive but could appear in legitimate contexts. The heavy use of legitimate cloud services for C2 and exfiltration means behavioral detection will produce false positives without careful baseline establishment. DLL sideloading detections will generate false positives from legitimate applications that load DLLs from non-standard paths.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Review npm package dependencies across development environments and CI/CD pipelines for the presence of 'easy-day-js' or other unexpected transitive dependencies.
- Consider auditing OAuth token grants in your identity provider and revoking tokens from unrecognized or unnecessary applications, especially those with excessive scopes.
- Evaluate whether your EDR can detect DLL sideloading behavior and COM persistence mechanisms; if so, consider enabling or tuning relevant detection rules.
- If you have REDCap or Zoho WorkDrive deployments, consider reviewing access logs for anomalous activity consistent with UNC6508 and Mustang Panda TTPs.
Infrastructure Hardening
- Consider implementing supply chain security scanning for npm packages and other development dependencies in CI/CD pipelines.
- Evaluate enabling enhanced audit logging for cloud services such as GitHub, Google Workspace, Zoho WorkDrive, and Dropbox, and forwarding to your SIEM for correlation.
- If supported by your cloud identity provider, consider implementing conditional access policies that restrict OAuth token grants to approved applications and locations.
- Consider implementing network egress filtering or proxy controls for cloud storage services to approved accounts and IP ranges where feasible.
- Evaluate whether your organization's REDCap deployments are internet-exposed and consider restricting access if not required.
User Protection
- Consider deploying or tuning endpoint detection rules for VBS script execution from non-standard locations and DLL sideloading using legitimate signed binaries.
- If applicable, consider enabling application control policies to prevent execution of unsigned binaries from user-writable directories.
- Evaluate whether your EDR supports detection of COM object persistence via registry modifications and consider enabling if available.
- Consider implementing browser-based controls or alerts for access to known cloud storage services from developer workstations.
Security Awareness
- Consider incorporating awareness training on social engineering tactics used by APT groups, including fake job offers, code review requests, and fake recruiter profiles on LinkedIn and job portals.
- Evaluate whether developers need additional training on supply chain risks, particularly around npm package vetting and scrutinizing new dependencies.
- Consider briefing personnel on the risk of credential theft via phishing sites impersonating legitimate email services and job portals.
- If applicable, consider adding guidance for developers on verifying the authenticity of packages, extensions, and tools installed in development environments such as VS Code and Cursor.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Tactic