Threat Research | Weekly Recap [17 May 2026]

#TeamPCP #Cemu #UNC6671 #BlackFile #node-ipc #Shai-Hulud #TanStack #Qilin #TheGentlemen #LockBit #Fast16 #FrostyNeighbor #Gamaredon #Kimsuky #Seedworm #Doppelgänger #CobaltStrike #Gamaredon #CVE-2023-36036 #Tycoon2FA #ModeloRAT #KongTuke #AmateraStealer #PureLogs #GremlinStealer #PraisonAI #NATSasC2 #Langflow #DirtyFrag #CopyFail #MeshAgent #TeamViewer #ScreenConnect #AnyDesk #Chaos

Supply Chain, Package, and CI/CD Compromises

• TeamPCP campaign poisoned npm/PyPI/GitHub workflows to steal credentials, exfiltrate secrets, and persist via release and CI abuse — Backdoored Cemu release
• Shai-Hulud source leak exposed a modular framework for credential theft, supply-chain poisoning, and stealthy C2 — Shai-Hulud Goes Open Source
• node-ipc malicious republishings stole developer secrets and exfiltrated data via DNS TXT queries — Popular node-ipc npm Package Infected with Credential Stealer
• TanStack packages were compromised in a Mini Shai-Hulud-related campaign targeting GitHub Actions and CI systems — TanStack npm Packages Compromised
• crypto-javascri typosquat delivered a Tor-backed worm that stole npm/GitHub credentials and republished trojanized packages — Inside a Tor Backed Supply Chain Worm
• GemStuffer abused RubyGems and UK council content as a transport layer for forged packages and exfiltration — GemStuffer Campaign Abuses RubyGems
• Malicious Claude Code skills showed how coding-agent extensions can become a supply-chain attack path — Malicious Coding Agent Skills

Phishing, Smishing, and Identity Takeover

• BlackFile / UNC6671 used vishing, AiTM, and SSO abuse to breach Microsoft 365 and Okta for extortion — Welcome to BlackFile
• Device code phishing expanded through PhaaS, QR/PDF lures, and AI-assisted kits targeting Microsoft 365 and Google accounts — Device Code Phishing is an Evolution in Identity Takeover
• Tycoon 2FA operators adopted OAuth device-code phishing using Cloudflare Workers and Microsoft auth services — Tycoon 2FA Operators Adopt OAuth Device Code Phishing
• KongTuke / ModeloRAT evolved from ClickFix into Teams help-desk lures with layered persistence and C2 redundancy — Help-Desk Lures Drop KongTuke’s Evolved ModeloRAT
• Rapid7 also tied a Teams “IT Support” intrusion to ModeloRAT, CVE-2023-36036, and domain compromise — When IT Support Calls
• INPS smishing leveraged fake fuel bonuses and Darcula PhaaS to steal payment data — Smishing Campaign Targeting INPS
• YouTube DMCA phishing infrastructure continued to pivot through fingerprints and redirect patterns — YouTube DMCA Phishing Infrastructure

Stealers and Malware Delivery Chains

• PureLogs was delivered via TXZ, environment variables, and PawsRunner steganography in PNGs — PureLogs: Delivery via PawsRunner Steganography
• Gremlin Stealer evolved with .NET resource hiding, XOR encoding, and virtualization-based packing — Gremlin Stealer’s Evolved Tactics
• Amatera Stealer 4.0.2 added loader/evasion changes and expanded browser, wallet, and chat-data harvesting — Amatera Stealer 4.0.2 Beta

Ransomware, Extortion, and Access Operations

• The Gentlemen backend leak exposed admins, chats, infrastructure, and active access paths — Thus Spoke…The Gentlemen
• DFIR linked EtherRAT, TukTuk, and cloud services into a ransomware intrusion ending in The Gentlemen deployment — Flash Alert: EtherRat and TukTuk C2
• Q1 2026 ransomware stayed elevated, led by Qilin, with gains from The Gentlemen and LockBit — The State of Ransomware – Q1 2026
• 2025 ransomware ecosystem analysis mapped DNS/WHOIS infrastructure across major families including Qilin and Akira — A Look Back at the Top 10 Ransomware of 2025
• April 2026 trends showed ransomware pressure on manufacturing, healthcare, and finance — April 2026 Threat Trend Report on Ransomware

State-Sponsored Espionage and Influence

• Fast16 sabotaged LS-DYNA/AUTODYN simulations to manipulate nuclear detonation modeling — Fast16: Pre-Stuxnet Sabotage Tool
• FrostyNeighbor used spearphishing, PicassoLoader, and Cobalt Strike against Ukrainian government targets — FrostyNeighbor
• Gamaredon abused CVE-2025-8088 with GammaDrop/GammaLoad and selective payload delivery — Gamaredon’s infection chain
• Kimsuky updated PebbleDash/AppleSeed tooling with legitimate remote-access utilities for persistence and theft — Kimsuky targets organizations with PebbleDash-based tools
• Seedworm used signed DLL sideloading and PowerShell orchestration in a broad espionage campaign — Seedworm: Iran-Linked Hackers Breached Korean Electronics Maker
• Doppelgänger influence ops used spoofed media, Telegram, and X bot clusters for pro-Kremlin narratives — Threat Intelligence Report: The SDA / Structura / Doppelgänger
• Iran APT infrastructure analysis highlighted shared DNS/WHOIS footprints across multiple state-linked groups — A Network IoC Analysis for 8 Iran-Affiliated APT Groups

AI, Cloud, and Novel Exploitation

• KeyHunter used NATS-as-C2 after exploiting Langflow to harvest cloud and AI credentials — NATS-as-C2
• PraisonAI authentication bypass was probed within hours of disclosure, underscoring rapid exploitation trends — CVE-2026-44338
• Azure Cosmos for PostgreSQL RCE allowed arbitrary config injection through the management API — Feeding Frenzy: RCE on Azure Cosmos for PostgreSQL
• Dirty Frag / Copy Fail exploit activity spanned ELF, Python, PyPI, and Linux malware variants — How Dirty Frag rose from the Copy Fail exploit
• AI-augmented intrusion campaigns in Latin America used agentic scripts, tunneling, and shared tradecraft — Vibe Hacking: Two AI-Augmented Campaigns
• GTIG reported broader AI abuse across vuln discovery, malware development, recon, and supply-chain compromise — GTIG AI Threat Tracker
• AI + intelligence was framed as a shift toward context-aware, predictive cyber defense — Beyond Acceleration and Automation

Remote Access, RMM, and Living-off-the-Land Abuse

• RMM sprawl expanded attacker hiding places as MeshAgent, TeamViewer, ScreenConnect, AnyDesk, and RDP were abused — The remote access blind spot
• MuddyWater reportedly used Teams lures, remote tools, and false-flag “Chaos” tradecraft in a long-running intrusion — Muddying the Tracks
• State-sponsored actors continued to rely on valid credentials and trusted tools for long-dwell compromise — State-sponsored actors, better known as the friends you don’t want

Threat Research | Weekly Recap – hendryadrian.com