CYFIRMA Q3 2026 Report Tracks 48 APT Campaigns, Persistent Backdoors and Edge-Device Exploitation
Summary
CYFIRMA’s Q3 2026 report tracks 48 campaigns linked to four threat-actor nexuses, highlighting persistent backdoors, edge-device exploitation, overlapping attribution, and recommended patching and access controls.
Key points
- The report counted 48 campaigns in Q3 across Iran-, Russia-, China- and North Korea-linked nexuses; 21 appeared in both Q2 and Q3, and only three were first seen in Q3.
- China-linked actors were associated with 27 campaigns, while Lazarus Group was linked to 14, up from at least nine in Q2.
- Attribution overlapped substantially: 21 campaigns were linked to multiple actors and eight spanned multiple nexuses. The report cautions that shared indicators or tooling do not establish collaboration.
- Persistent backdoors were recorded in 17 campaigns, VPN, router and edge-device exploitation in nine, and RATs or remote-access implants in six.
- Japan and the United States were the most frequently recorded victim countries, with 41 and 39 campaigns respectively.
- The report describes a Lazarus Group Dream Job campaign using a Windows AFD.sys zero-day, CVE-2026-68820, which was patched on August 11, 2026.
- Recommended actions include patching and integrity-checking internet-facing edge devices, removing direct RDP and SSH exposure, enabling EDR tamper protection, and deploying the August 2026 Windows update.
Article Details
- Publisher
- CYFIRMA
- Report Period
- 2026-07-01 to 2026-09-30
- Scope
- Iran-, Russia-, China-, and North Korea-linked cyber activity, assessed using the CYFIRMA campaign database and public reporting.
- Sample Size
- 48 distinct campaigns; 15 profiled actors.
- Key Statistics
- 48 distinct campaigns were sighted in Q3, compared with at least 33 in Q2; 21 were sighted in both quarters.
- Only 3 campaigns were first seen in Q3; 21 were sighted in every month of the quarter.
- 21 of 48 campaigns had multiple actor attributions, and 8 spanned multiple nexuses. The report does not treat attribution overlap as evidence of collaboration.
- China-linked actors were associated with 27 campaigns, North Korea-linked actors with 14, Russia-linked actors with 13, and Iran-linked actors with 4; these overlapping counts are not additive.
- Persistent backdoors were recorded in 17 of 48 campaigns and edge-device exploitation in 9. Technology-based comparisons with Q2 are limited by product enrichment added in September.
- Recommendations
- Inventory, patch, and integrity-check internet-facing edge devices; review administrator accounts and configuration changes since July 2026.
- Remove direct RDP and SSH exposure and enforce MFA on remote access.
- Enable EDR tamper protection and vulnerable-driver blocking, and deploy the August 2026 Windows update addressing CVE-2026-68820.
- Hunt for DLL side-loading, persistent backdoors, and Cobalt Strike beacons on servers.
- Restrict unnecessary device-code sign-in and monitor OAuth consents and token use.
MITRE ATT&CK
T1014 · RootkitPublic reporting describes deployment of an updated FudModule rootkit in Lazarus Group activity.T1059.001 · PowerShellPublic reporting cited for APT34 and Gamaredon describes PowerShell tooling and execution.T1068 · Exploitation for Privilege EscalationCheck Point Research reportedly identified Lazarus Group exploitation of Windows AFD.sys CVE-2026-68820 for privilege escalation.T1071.004 · DNSPublic reporting cited for APT34 describes DNS-based command and control.T1102 · Web ServiceESET reporting cited in the article describes Gamaredon using legitimate third-party services to conceal command and control.T1105 · Ingress Tool TransferThe database records loader and downloader staging, including HLOADER, RustBucket, and SUGARLOADER in Lazarus Group-linked activity.T1133 · External Remote ServicesVPN and other external remote-access services feature in reported intrusion activity; database mappings are inferred rather than observed procedures.T1190 · Exploit Public-Facing ApplicationThe report describes exploitation of internet-facing applications and edge devices, including publicly reported TP-Link router exploitation.T1204.002 · Malicious FileReported delivery methods include fake updates delivering CornFlake and trojanised PDF viewers used in Lazarus Group activity.T1486 · Data Encrypted for ImpactRansomware deployment was recorded in five distinct Q3 campaigns, including campaigns recording Clop, INC Ransomware, and Sodinokibi.T1505.003 · Web ShellCampaign records describe DEWMODE and ASPXSpy web-shell deployment.T1528 · Steal Application Access TokenMicrosoft-attributed activity used device-code phishing, while router-hijacking reporting describes OAuth token harvesting.T1557 · Adversary-in-the-MiddlePublic reporting describes DNS and HTTP manipulation through compromised captive portals and router-based traffic redirection.T1562.001 · Disable or Modify ToolsThe report records AuKill security-tool tampering and cites FudModule interference with security tooling.T1566.001 · Spearphishing AttachmentPublic reporting describes Gamaredon spear-phishing with booby-trapped RAR archives exploiting WinRAR CVE-2025-8088.
CVE
CVE-2023-50224and, separately, the UK NCSC, in which internet-facing SOHO routers (including TP-Link devices via CVE-2023-50224) were compromised to alter DNS settings, redirect traffic, and harvest credentials and OAuth tokens;CVE-2025-8088the GammaWorm and GammaSteel tools through booby-trapped RAR archives that abused a WinRAR flaw (CVE-2025-8088), and ESET’s 25 June 2026 report on the group’s 2025 activity described new PowerShell tooling, aCVE-2026-68820Patch and integrity-check internet-facing edge devices, remove direct RDP and SSH exposure, enable EDR tamper protection, and deploy the August 2026 Windows update (CVE-2026-68820).
Threat Actors
Cozy BearRussia-linked espionage actor associated with four Q3 campaigns, three attributed to it alone. The report also cites externally attributed identity-focused and captive-portal operations.Lazarus GroupLinked to 14 Q3 campaigns, nine attributed to it alone. Check Point Research reportedly associated its recruiter-themed activity with Windows zero-day exploitation and FudModule deployment.MISSION2074CYFIRMA-designated China-linked cluster associated with 12 Q3 campaigns, four attributed to it alone. Shared records contain tooling associated with other actors.SOLAR IONIran-linked espionage actor explicitly identified as OilRig. All three Q3 campaigns in its profile are shared; one contains only North Korean tooling and is excluded from its technique assessment.Stone PandaChina-linked espionage actor associated with eight Q3 campaigns, three attributed to it alone; recorded activity includes backdoors, remote-access implants, and web shells.
Malware
AppleJeusOne, recorded under OilRig, carries only North Korean tooling (AppleJeus, NukeSped RAT, RustBucket, HLOADER, SUGARLOADER) and describes Lazarus Group tradecraft.ClopReported malware families and capabilities included Clop, FlawedAmmyy RAT, and DEWMODE, demonstrating a focused but adaptable operational toolkit.CornFlaketo fake update pages, Microsoft 365 credential-harvesting pages, and device-code phishing, with the CornFlake remote-access trojan among the payloads delivered.FudModuleexploited the Windows AFD.sys zero-day CVE-2026-68820 (patched on 11 August 2026) to deploy an updated FudModule rootkit, and delivered the new Troy backdoor, with confirmed victims in France, Germany, Brazil, andNukeSped RATOne, recorded under OilRig, carries only North Korean tooling (AppleJeus, NukeSped RAT, RustBucket, HLOADER, SUGARLOADER) and describes Lazarus Group tradecraft.PlugXBLACKCOFFEE, LODEINFO, PlugX, ShadowPad, Volt (as recorded), Winnti and 3 moreRustBucketOne, recorded under OilRig, carries only North Korean tooling (AppleJeus, NukeSped RAT, RustBucket, HLOADER, SUGARLOADER) and describes Lazarus Group tradecraft.ShadowPadBLACKCOFFEE, LODEINFO, PlugX, ShadowPad, Volt (as recorded), Winnti and 3 moreTroyCVE-2026-68820 (patched on 11 August 2026) to deploy an updated FudModule rootkit, and delivered the new Troy backdoor, with confirmed victims in France, Germany, Brazil, and India.WinntiBLACKCOFFEE, LODEINFO, PlugX, ShadowPad, Volt (as recorded), Winnti and 3 more
Vendors
Citrixto document exploitation of known vulnerabilities in technologies such as Fortinet, Pulse Secure, Citrix, F5 BIG-IP, Ivanti, Check Point, and Palo Alto Networks to obtain or maintain access.FortinetFortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager, VPN solutionsIvantiexploitation of known vulnerabilities in technologies such as Fortinet, Pulse Secure, Citrix, F5 BIG-IP, Ivanti, Check Point, and Palo Alto Networks to obtain or maintain access.MicrosoftOn 31 July 2026, Microsoft Threat Intelligence disclosed CaptiveCrunch, a campaign active since early May 2026 that it attributes to Storm-2945, an operational sub-cluster of Midnight Blizzard.TP-Linkinternational partners and, separately, the UK NCSC, in which internet-facing SOHO routers (including TP-Link devices via CVE-2023-50224) were compromised to alter DNS settings, redirect traffic, and harvestVMwareBlock (SMB), SQL Server Performance Monitoring Tools, TOR, Transportation & Logistics Software, USAHerds, VMware vCenter Server, Windows Management Instrumentation (WMI).
Products
Atlassian ConfluenceAlso recorded: Remote desktop software, Routers, Atlassian Confluence, Citrix NetScaler ADC, Citrix NetScaler Gateway, Cloud Migration Services, Content Delivery Networks, Content Management System, Dropbox, FileCitrix NetScaler GatewayAlso recorded: Remote desktop software, Routers, Atlassian Confluence, Citrix NetScaler ADC, Citrix NetScaler Gateway, Cloud Migration Services, Content Delivery Networks, Content Management System, Dropbox, FileFortiOSFortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager, VPN solutionsFortiProxyFortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager, VPN solutionsFortiSwitchManagerFortinet FortiOS, Fortinet FortiProxy, Fortinet FortiSwitchManager, VPN solutionsIvanti Connect SecureFortinet FortiProxy, Fortinet FortiSwitchManager, Go, GitHub, Internet-facing Web Applications, Ivanti Connect Secure, Ivanti Policy Secure, Java, Microsoft .NET Framework, Microsoft Exchange Server, NetworkIvanti Policy SecureFortinet FortiSwitchManager, Go, GitHub, Internet-facing Web Applications, Ivanti Connect Secure, Ivanti Policy Secure, Java, Microsoft .NET Framework, Microsoft Exchange Server, Network Monitoring Tools, Perl,Microsoft 365 Apps for Enterprisesimilar venues were used to manipulate DNS and HTTP traffic and redirect guests to fake update pages, Microsoft 365 credential-harvesting pages, and device-code phishing, with the CornFlake remote-access trojan amongMicrosoft Exchange ServerWeb Applications, Ivanti Connect Secure, Ivanti Policy Secure, Java, Microsoft .NET Framework, Microsoft Exchange Server, Network Monitoring Tools, Perl, PowerShell, Server Message Block (SMB), SQL Server PerformanceMicrosoft WindowsPatch and integrity-check internet-facing edge devices, remove direct RDP and SSH exposure, enable EDR tamper protection, and deploy the August 2026 Windows update (CVE-2026-68820).NetScaler ADCAlso recorded: Remote desktop software, Routers, Atlassian Confluence, Citrix NetScaler ADC, Citrix NetScaler Gateway, Cloud Migration Services, Content Delivery Networks, Content Management System, Dropbox, FileRoundcubeSOHO router compromise (TP-Link, CVE-2023-50224) and Roundcube exploitationVMware vCenter ServerSQL Server Performance Monitoring Tools, TOR, Transportation & Logistics Software, USAHerds, VMware vCenter Server, Windows Management Instrumentation (WMI).WinRARgroup, delivering the GammaWorm and GammaSteel tools through booby-trapped RAR archives that abused a WinRAR flaw (CVE-2025-8088), and ESET’s 25 June 2026 report on the group’s 2025 activity described new
Tools
AuKillTwo campaigns are co-attributed to Lazarus Group (AuKill EDR killer, CivetQ, Dridex).Bad PotatoPatch and integrity-check Ivanti and vCenter, hunt for DLL side-loading consistent with ShadowPad and PlugX, and look for Cobalt Strike beacons and token-impersonation tools (Bad Potato) on servers.Cobalt StrikePost-exploitation framework (Cobalt Strike)
Countries
AustraliaJapan (41 campaigns) and the United States (39) were the most frequently recorded victim countries, followed by the United Kingdom (24), India (23), South Korea (22), and Australia (21).BrazilVietnam, Spain, Cambodia, Oman, Israel, Turkey, Qatar, China, Norway, Indonesia, New Zealand, Brazil, Ukraine, Cyprus, Kuwait, Iraq, Syria, Yemen, Iran, Lebanon, Bahrain, Jordan, Egypt, Austria, SouthChinaChina remains the largest nexus.FranceAlso recorded: Denmark, Morocco, Norway, Argentina, China, Macao, the Netherlands, Malaysia, Indonesia, Canada, Italy, France.GermanyRecorded victims are in Germany, Japan, Saudi Arabia, Ukraine, the UAE, the UK, and the US, across telecommunications, IT, government, finance, and defence.IndiaJapan (41 campaigns) and the United States (39) were the most frequently recorded victim countries, followed by the United Kingdom (24), India (23), South Korea (22), and Australia (21).Iranthe July–September 2026 reporting period, state-sponsored Advanced Persistent Threat (APT) groups from Iran, Russia, China, and North Korea, alongside Russian-speaking financially motivated cybercrime groups,JapanJapan (41 campaigns) and the United States (39) were the most frequently recorded victim countries, followed by the United Kingdom (24), India (23), South Korea (22), and Australia (21).North Koreaperiod, state-sponsored Advanced Persistent Threat (APT) groups from Iran, Russia, China, and North Korea, alongside Russian-speaking financially motivated cybercrime groups, continued to demonstrateRussiaJuly–September 2026 reporting period, state-sponsored Advanced Persistent Threat (APT) groups from Iran, Russia, China, and North Korea, alongside Russian-speaking financially motivated cybercrime groups, continued toSouth KoreaJapan (41 campaigns) and the United States (39) were the most frequently recorded victim countries, followed by the United Kingdom (24), India (23), South Korea (22), and Australia (21).TaiwanJapan, the US, the UK, India, Germany, Taiwan, and Australia lead.UkraineRecorded victims are in Germany, Japan, Saudi Arabia, Ukraine, the UAE, the UK, and the US, across telecommunications, IT, government, finance, and defence.United KingdomJapan (41 campaigns) and the United States (39) were the most frequently recorded victim countries, followed by the United Kingdom (24), India (23), South Korea (22), and Australia (21).United StatesJapan (41 campaigns) and the United States (39) were the most frequently recorded victim countries, followed by the United Kingdom (24), India (23), South Korea (22), and Australia (21).
Industries
Aerospacewith strategic espionage, targeting cryptocurrency platforms, financial institutions, defence, aerospace, and software development organisations through social engineering, fraudulent employment campaigns,CryptocurrencyGroup, continued combining financially motivated cyberattacks with strategic espionage, targeting cryptocurrency platforms, financial institutions, defence, aerospace, and software development organisations throughDefenceRussian-speaking cybercrime groups FIN7, FIN11, and TA505, maintained operations against government, defence, financial, technology, and strategically significant organisations, combining cyber espionage,financeRecorded victims are in Germany, Japan, Saudi Arabia, Ukraine, the UAE, the UK, and the US, across telecommunications, IT, government, finance, and defence.HealthcareAPT34 (OilRig) and Fox Kitten, continued targeting government, energy, financial, telecommunications, healthcare, and critical infrastructure organisations through credential theft, vulnerability exploitation,Information TechnologyThe group has been associated with targeting government, financial, healthcare, information technology, insurance, energy, telecommunications, manufacturing, defence, and critical infrastructure organisations across theManufacturinggovernment, financial, healthcare, information technology, insurance, energy, telecommunications, manufacturing, defence, and critical infrastructure organisations across the Middle East, Europe, North America,Transportation and LogisticsPerl, PowerShell, Server Message Block (SMB), SQL Server Performance Monitoring Tools, TOR, Transportation & Logistics Software, USAHerds, VMware vCenter Server, Windows Management Instrumentation (WMI).