Regional APT Threat Landscape
In August 2026, the global threat hunting system of the FUYING Lab detected a total of 20 APT attack activities. These activities were primarily concentrated in regions including East Asia, Eastern Europe, Middle East, and South Asia as shown in the figure below.
Regarding the activity levels of different groups, the most active APT groups were Kimsuky, Lazarus, and DarkHotel from East Asia as shown below.
The most prevalent intrusion method in this month’s incidents was spear-phishing email attacks, accounting for 70% of all attack events. A minority of threat actors also employed vulnerability exploitation, supply chain attacks, and watering hole attacks, as shown in the figure below.
In August 2026, government agencies were the most frequently targeted category, accounting for 50% of observed APT activity, followed by organizations and individuals at 25%. Other targeted sectors included military institutions and financial services.
East Asia
This month, APT activities in the East Asia region were primarily conducted by known APT groups, targeting entities in both North Korea and South Korea. Victims included North Korean government agencies, organizations, or individuals, as well as South Korean government agencies, organizations, individuals, and military institutions. In terms of attack tactics, the majority of APT operations in East Asia this month leveraged spear-phishing emails, with a smaller number exploiting software vulnerabilities. Regarding spear-phishing campaigns, a typical decoy used was a Korean-language announcement titled “Guidelines for Managing Changes to Store Master Data.”
Subscribe NSFOCUS Threat Intelligence for full details of APT incident insights.
Eastern Europe
This month, APT activities in Eastern Europe were also primarily carried out by known APT groups. Victims included government agencies and military institutions in Ukraine, as well as government bodies in Romania and Spain.
Concerning attack tactics, most APT operations in Eastern Europe this month utilized spear-phishing emails, while a small number of campaigns exploited vulnerabilities to conduct attacks. In vulnerability-based attacks, threat actors distributed phishing emails leveraging CVE-2026-42897. When a user opened such an email within an Outlook Web Access (OWA) environment, the Outlook Exchange server incorrectly processed the HTML content embedded in the message, thereby executing JavaScript code crafted by the threat actors.
Subscribe NSFOCUS Threat Intelligence for full details of APT incident insights.
South Asia
This month, APT activities in South Asia were mainly conducted by known APT groups, with victims including government agencies in Afghanistan and India.
In terms of attack tactics, spear-phishing emails dominated APT operations in South Asia this month. A typical decoy employed was a counterfeit version of AFTEL’s (Afghan Telecom) TMS telecommunications management tool. By mimicking the visual design of legitimate telecom business systems, the threat actors successfully lowered target vigilance to deliver the initial payload. Based on threat actor fingerprint analysis, this campaign has been attributed to the APT group TransparentTribe.
Subscribe NSFOCUS Threat Intelligence for full details of APT incident insights.
Global Key APT Events
| Event Name | Related Groups |
|---|---|
| Lazarus Group Conducts Targeted Attacks Using a Novel Multi-Stage Malware Chain and a Kernel Zero-Day Vulnerability | Lazarus |
| UAC-0099 Conducts Attacks Using a Novel Multi-Stage Malware Chain | UAC-0099 |
Interpretation of Key APT Events
Lazarus Group Conducts Targeted Attacks Using a Novel Multi-Stage Malware Chain and a Kernel Zero-Day Vulnerability
Recently, the Lazarus group has launched spear-phishing campaigns targeting critical sectors in the defense and aerospace industries across Europe and India. These attacks involve delivering an encrypted ZIP archive named Senior_Project_Manager.zip via phishing emails. The archive contains a PDF viewer executable with a legitimate digital signature, a malicious libmupdf.dll, and an encrypted decoy payload. When the victim executes the PDF viewer, the malware employs DLL side-loading techniques to load the malicious DLL. This DLL acts as a loader that reads the malicious payload disguised as a PDF file, launches the MISTPEN malware, and simultaneously opens a decoy PDF titled “Job Description” to evade user suspicion.
MISTPEN leverages the Microsoft Graph API to retrieve components and loads multiple malicious modules directly into memory. These modules include:
- Host reconnaissance capabilities;
- Screen capture functionality;
- A privilege-escalation exploit leveraging CVE-2026-68820 and designed to evade security detection.
- The ForestTiger Trojan.
RelayShell is a PHP-based relay web backdoor utilized by the Lazarus group. Distinct from traditional web shells, its primary function is not to execute system commands directly on the server. Instead, it serves as a communication relay node, forwarding instructions and data to connect with backbone Command-and-control servers. The attack sequence typically begins with the threat actors logging in using compromised Roundcube credentials.
| Group Name | Lazarus |
| First Observed | 2007 |
| Target Country | Australia, Bangladesh, Belgium, Brazil, Canada, Chile, China, Ecuador, France, Germany, Guatemala…… |
Subscribe NSFOCUS Threat Intelligence for full details of APT incident insights.
UAC-0099 Conducts Attacks Using a Novel Multi-Stage Malware Chain
The Russia-linked APT group UAC-0099 has launched a cyber campaign targeting various sectors in Ukraine via spear-phishing emails. The primary targets include local government agencies and organizations related to critical infrastructure, with internal staff of these entities serving as the victims. Once compromised, victim hosts are implanted with the MATCHBOIL.V2 backdoor to achieve persistence. This backdoor enables threat actors to collect hardware and software fingerprints, establish Command-and-control (C2) communications, download and deploy subsequent payloads, and exfiltrate sensitive information.
The attack chain proceeds as follows:
- Initial Access: UAC-0099 sends spear-phishing emails containing malicious compressed archives. Inside these archives are WSF scripts disguised as Word documents, designed to trick victims into executing them.
- Payload Delivery & DLL Side-Loading: ……
| Group Name | UAC-0099 |
| First Observed | 2020 |
| Target Country | Ukraine…… |
In this campaign, the UAC-0099 group deployed new components—including LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2—to construct a multi-stage attack chain: WSF Script → LUNCHPOKE → BURNYBEAR → MATCHBOIL.V2.
The attack begins with the delivery of a malicious compressed archive via spear-phishing emails. This archive contains a file disguised with a double extension (2060.docx.wsf). Once executed by wscript.exe, the WSF script accesses a shortened URL to download a combined archive from a remote server, containing the legitimate ……
Subscribe NSFOCUS Threat Intelligence for full details of APT incident insights.
