Beazley Q1 2026 Threat Report Details Supply-Chain Attacks and Emerging Trends
Summary
Beazley Security Labs’ Q1 2026 report examines the TeamPCP supply-chain campaign, AI-assisted vulnerability discovery, the claimed Handala attack on Stryker, and ransomware, BEC and endpoint trends, with defensive recommendations.
Key points
- TeamPCP exploited a GitHub Actions misconfiguration and residual credentials to compromise Trivy, Checkmarx KICS and LiteLLM, then spread credential-stealing malware across more than 66 packages.
- Cisco confirmed source code was stolen from more than 300 internal repositories; CERT-EU confirmed the European Commission was affected, and Mercor said it was among companies affected through LiteLLM.
- The report counted 15,243 newly disclosed CVEs and 40 additions to CISA’s Known Exploited Vulnerabilities catalog in Q1; KEV additions increased 42.9% from the prior quarter.
- In Beazley’s ransomware investigations, compromised credentials paired with exposed remote access services accounted for 74% of intrusions; the report also noted more data-theft-only extortion.
- Handala claimed responsibility for the Stryker incident. The report cites public reporting of administrative access to Microsoft Entra and use of Intune remote wiping across more than 200,000 systems and 79 offices.
- Vendor-related compromise was the leading BEC vector in Beazley’s cases; about 53% of cases involved organizations reporting fully or partially enforced MFA.
- Beazley MDR telemetry showed a resurgence of ClickFix and SEO-poisoning activity delivering malware to endpoints; recommendations include pinning CI/CD dependencies to commit hashes and rotating exposed credentials.
Article Details
- Publisher
- Beazley Security (Beazley Security Labs)
- Report Period
- Q1 2026
- Scope
- Threat landscape observations, vulnerability activity, supply-chain incidents, ransomware, BEC, and MDR telemetry.
- Sample Size
- Not disclosed
- Key Statistics
- 15,243 new CVEs were published in Q1 2026, up 18.5% from Q4 2025.
- 40 vulnerabilities were added to CISA KEV in Q1 2026, up 42.9% from Q4 2025.
- Compromised credentials paired with exposed remote access services accounted for 74% of ransomware intrusions investigated by Beazley Security in Q1.
- Approximately 53% of BEC cases Beazley Security responded to involved organizations reporting fully or partially enforced MFA.
- More than 200,000 systems across 79 Stryker offices were reported remotely wiped.
- Recommendations
- Pin external GitHub Actions and package dependencies to specific Git commit SHA hashes rather than version tags.
- Organizations that used affected Trivy tools or installed LiteLLM during the March 2026 exposure windows should treat environments as potentially compromised and rotate CI/CD secrets and cloud credentials.
- Patch critical vulnerabilities within hours of disclosure; treat exposure during active exploitation as a potential compromise and conduct forensic validation.
- Protect global administrator credentials with phishing-resistant MFA and Privileged Identity Management.
- Restrict remote-wipe authority to specific roles with secondary approval, and immediately review alerts for bulk device-management commands.
MITRE ATT&CK
T1078 · Valid AccountsAttackers used valid global administrator credentials to access Stryker's Microsoft Entra environment.T1195.001 · Compromise Software Dependencies and Development ToolsTeamPCP compromised developer security tooling and software packages, including Trivy, KICS, and packages in the npm and PyPI ecosystems.T1485 · Data DestructionHandala used Microsoft Intune's remote-wipe functionality to destroy data across Stryker systems and enrolled devices.T1550.001 · Application Access TokenTeamPCP stole and reused personal access and package-publishing tokens to access repositories and publish malicious packages.T1557 · Adversary-in-the-MiddleThe report describes adversary-in-the-middle phishing kits using a reverse proxy to intercept authentication attempts and sessions.
CVE
People
Marcus HutchinsThe security researcher commented that many reported memory-corruption vulnerabilities were null pointer dereference bugs that are generally unreliable or unexposed for practical exploitation.xarkesThe researcher studied reported Firefox bugs attributed to Mythos and found that several were not practically exploitable by a threat actor.
Threat Actors
AkiraBeazley Security observed Akira as a prolific ransomware group, recording 191 leak-site posts in Q1.Banished KittenThe article says security organizations track Handala under this name; it is an alternate tracking name for the group that claimed responsibility for the Stryker attack.HandalaThe hacktivist group claimed responsibility for the destructive Stryker attack. Researchers linked the group to Iran's Ministry of Intelligence and Security; this is reported attribution, not independently established in the article.INCThe report notes an uptick in cases involving Inc ransomware operators.InterlockThe report notes an uptick in cases involving Interlock ransomware operators.LAPSUS$The group leaked Checkmarx source code, API keys, database credentials, and employee data; it also claimed that approximately 4 terabytes of data were exfiltrated from Mercor.QilinBeazley Security observed Qilin as a prolific ransomware group; it recorded 419 public victim posts from the group in Q1.Red SandstormThe article says security organizations track Handala under this name; it is an alternate tracking name for the group that claimed responsibility for the Stryker attack.TeamPCPThe report identifies TeamPCP as responsible for a developer supply-chain campaign that compromised Trivy, Checkmarx KICS, LiteLLM, and additional packages, then used stolen credentials to reach downstream environments.The GentlemenThe report identifies The Gentlemen as a ransomware group with 210 public victim posts in Q1.VectThe report describes Vect as a ransomware operation that partnered with TeamPCP to monetize stolen credentials; it says the first confirmed Vect ransomware attack using TeamPCP-sourced credentials followed the partnership announcement.
Malware
Lumma StealerThis multi-agency international enforcement significantly disrupted the operations of the Lumma Stealer and Rhadamanthys malware families, creating an opportunity for StealC and Vidar to fill demand.RhadamanthysThis multi-agency international enforcement significantly disrupted the operations of the Lumma Stealer and Rhadamanthys malware families, creating an opportunity for StealC and Vidar to fill demand.Shai-Huludthe developer supply chain attack pattern Beazley Security Labs highlighted in prior reporting on the Shai-Hulud campaigns, which demonstrated how self-propagating, credential-stealing malware could weaponize the npmStealCThis multi-agency international enforcement significantly disrupted the operations of the Lumma Stealer and Rhadamanthys malware families, creating an opportunity for StealC and Vidar to fill demand.TeamPCP Cloud stealerThe group published a backdoored Trivy binary that included malware called “TeamPCP Cloud Stealer” to GitHub Releases, Docker Hub, and several other repositories followed by additional malicious images in the days thatVidarThis multi-agency international enforcement significantly disrupted the operations of the Lumma Stealer and Rhadamanthys malware families, creating an opportunity for StealC and Vidar to fill demand.
Vendors
AnthropicIn parallel, Anthropic’s announcement of Project Glasswing and the Mythos model generated significant industry attention and briefly moved cybersecurity stocks.Aqua Securityactor group TeamPCP used an AI-assisted bot called hackerbot-claw to gain an initial foothold into Aqua Security’s Trivy vulnerability scanner, then used stolen credentials to spread across Checkmarx’s KICS securityCheckmarx#TeamPCPF5Stolen F5 Big-IP APM vulnerabilities weaponized: Chinese state-affiliated threat actors continued to capitalize on the October 2025 F5 corporate breach covered in our Q4 report.IvantiIvanti vulnerabilities reported in EPM and EPMM: Ivanti reported critical vulnerabilities in both their Endpoint Manager Mobile (EPMM) and Endpoint Manager (EPM) products in Q1.MicrosoftHandala Group used Microsoft Entra and Intune to remotely wipe over 200,000 systems at Stryker.
Products
BIG-IP APMStolen F5 Big-IP APM vulnerabilities weaponized: Chinese state-affiliated threat actors continued to capitalize on the October 2025 F5 corporate breach covered in our Q4 report.Endpoint Manager (EPM)Ivanti vulnerabilities reported in EPM and EPMM: Ivanti reported critical vulnerabilities in both their Endpoint Manager Mobile (EPMM) and Endpoint Manager (EPM) products in Q1.Endpoint Manager Mobile (EPMM)Ivanti vulnerabilities reported in EPM and EPMM: Ivanti reported critical vulnerabilities in both their Endpoint Manager Mobile (EPMM) and Endpoint Manager (EPM) products in Q1.GitHubTeamPCP operated across parts of the software development ecosystems, including Github, Docker, npm, and PyPI to execute this attack, compromising security tools trusted by thousands of organizations.GitHub Actionsnamed “hackerbot-claw,” created February 20, 2026, scanned public repositories for misconfigured GitHub Actions workflows that allowed untrusted pull request code to execute with full repository permissions andKICSTeamPCP used AI-assisted access to compromise Trivy, Checkmarx KICS, and LiteLLM through a developer supply chain campaign.Microsoft EntraHandala Group used Microsoft Entra and Intune to remotely wipe over 200,000 systems at Stryker.Microsoft IntuneThe group gained administrative access to Stryker’s Microsoft Entra environment and weaponized Microsoft Intune’s remote wipe functionality, destroying data across more than 200,000 systems and 79 offices worldwide.Mythos#TeamPCPNotepad++Additionally, the popular text editing application Notepad++ disclosed that their update infrastructure was compromised by an advanced persistent threat (APT) with a highly sophisticated and unusually selectiveOpus 4.6Opus 4.6, Opus 4.7, and the latest OpenAI models have all shown steady, measurable improvements in vulnerability discovery and reliability on cybersecurity tasks.Opus 4.7Opus 4.6, Opus 4.7, and the latest OpenAI models have all shown steady, measurable improvements in vulnerability discovery and reliability on cybersecurity tasks.Trivy#TeamPCP
Tools
EvilginxModern kits such as Evilginx are designed to clone legitimate login pages like Okta, M365, and Google and can be highly effective when paired with vishing impersonations.hackerbot-clawThreat actor group TeamPCP used an AI-assisted bot called hackerbot-claw to gain an initial foothold into Aqua Security’s Trivy vulnerability scanner, then used stolen credentials to spread across Checkmarx’s KICS
Countries
Industries
Financial institutionsProfessional Services and Financial Institutions accounted for a combined 37% of cases we investigated, representing the largest distribution this quarter. Both sectors are consistently targeted due to the high level ofHealthcareReporting of incident distribution in other sectors remained mostly consistent, except for Healthcare declining from 15% to 10%.Manufacturing and DistributionWith a significant drop in reported incidents impacting Business Services, Manufacturing and Distribution rose to second on our list, with an increase in reporting from 11% to 15%.Professional ServicesProfessional Services took over as the most targeted sector in Q1, representing 21% of observed ransomware incidents, up from 16% in Q4 2025. Professional Services regularly accounts for a larger portion of reported