The Q2 2026 Open Source Threat Landscape

Download PDF report

Over three months, April through June 2026, Sol collected and analysed 372 open-source threat intelligence reports. Across all of them sits one shift worth stopping on: supply chain compromise, cloud infrastructure targeting, and credential theft are no longer three separate trends. They are the same attack, observed from three angles at once.

The pattern is consistent. Compromise the developer ecosystem to get in, pivot to cloud infrastructure because that is where the value now lives, and harvest credentials because they are the keys to everything else. Five unrelated actor clusters ran that exact play against npm, PyPI and VSCode simultaneously in May, and when unrelated actors converge on the same surface independently, it is no longer a campaign. It is a market.

What follows is the quarter in full: the six findings that define it, everything that entered the corpus for the first time, and the techniques, actors and targets behind the numbers. One caveat runs throughout: June is present only for its first three days, so every monthly comparison here should be read as undersampled at the tail.

1. What this quarter tells us

Six findings define Q2 and set the agenda for what to watch in Q3. Each is drawn from the corpus as a whole rather than any single report.

1 · The supply chain is a market, not an opportunity

Five independent actor clusters operated against the same npm, PyPI and VSCode attack surface simultaneously in May. When unrelated actors converge on one surface independently, it signals structural profitability rather than a trend or a single campaign, the same way multiple firms entering a market signals that the margins are real. The roster is likely to expand in Q3.

2 · Defense Evasion investment is disproportionate

The quarter produced 91 unique Defense Evasion techniques, nearly double any other tactic. Adversaries are investing more in staying hidden than in novel initial access or impact. MachineGUID-derived decryption, monoglyph obfuscation and AppDomainManager hijacking each represent significant R&D poured into detection avoidance specifically, not into getting in or causing damage.

3 · Criminal and nation-state reached parity in May

May recorded 24 nation-state versus 24 criminal attributed reports, the first time the two drew level. The move is driven almost entirely by UNC6780; remove it and criminal activity is flat. But the statistical event still matters: if criminal supply chain actors keep scaling, the historical 2:1 nation-state dominance may not return in Q3.

4 · DPRK blurs the line on purpose

Lazarus Group, Emerald Sleet and NICKEL TAPESTRY together account for 17 of 27 nation-state reports, and all three carry financial gain as a primary motivation alongside espionage. That pulls financial motivation counts to near-parity with pure espionage (73 versus 75 reports) and complicates any attribution model that assumes nation-state means espionage-only.

5 · Geopolitics sets the cyber tempo

Operation Epic Fury is the clearest case in this corpus of a real-world military event (US Operation Epic Fury, 28 February 2026) directly triggering a named IRGC cyber campaign (Nimbus Manticore) within two months. The correlation between the geopolitical calendar and cyber operational tempo is becoming a reliable planning tool for defenders, not just a retrospective observation.

6 · The patch window is closing

CVE-2026-21509 (Office OLE) and CVE-2026-45321 (npm registry) both appeared in the corpus within weeks of disclosure, already actively exploited by APT28 and UNC6780 respectively. If this pace holds, the gap between disclosure and active exploitation will shrink below the realistic patching cycle for most organisations in Q3.

2. What appeared for the first time

Ten net-new threat actors, 280-plus net-new malware families, 29 net-new MITRE techniques, 54 net-new named campaigns and 14 net-new CVEs entered the corpus with zero prior coverage in January–March 2026. The volume matters less than what some of it represents.

Five of those first appearances are worth calling out on their own, because each moves a technique from theoretical to operational. GlassWorm introduced the first blockchain command-and-control architecture in the corpus, embedding commands in Solana transaction memo fields, traffic that cannot be sinkholed without blocking a legitimate, widely used blockchain API. JS.MonoGlyphRAT used monoglyph obfuscation, a previously uncatalogued technique with no known public prior art, scoring 29 of 59 on VirusTotal evasion at discovery and still unattributed.

3. The corpus at a glance

April peaked at 159 reports and May sustained 150. June covers only its first three days, 63 reports, so the true quarterly total is estimated at 450 to 460 once June is fully ingested. Read every monthly comparison in this report with that undersampling in mind.

4. Three vectors, one paradigm

Supply chain compromise, cloud infrastructure targeting and credential theft each grew independently through the quarter, but they are operationally linked. Together they describe a single maturing attack: compromise the developer ecosystem to harvest cloud secrets at scale.

Supply chain reports grew from 26 in April to 56 in May, a 5,500% increase since January. Five independent actor clusters now operate concurrently against npm, PyPI, VSCode and GitHub Actions.

Cloud infrastructure is no longer a nation-state-only target. Espionage (APT28), criminal (UNC6780) and destructive (Storm-2949) actors all converged on cloud as the primary target environment by May.

Credential theft widened its surface. In January it meant browser passwords; by May it spanned cloud API keys, SSH keys, Telegram sessions, crypto wallet seeds, webcam streams and CI/CD pipeline secrets.

Supply chain compromise is the delivery mechanism, cloud infrastructure is the target environment, credential theft is the objective. UNC6780, NICKEL TAPESTRY and Shai-Hulud each embody that convergence simultaneously and independently of one another.

5. The ten most-reported techniques

519 unique ATT&CK techniques were observed across the quarter, but ten carry it. The ranking below is by report count; the procedures that follow are real implementations pulled from the corpus, not generic descriptions.

01 · T1027: Obfuscated Files or Information · Defense Evasion · 261 reports

In the Mini Shai-Hulud procedure, the npm payload encodes its exfiltration logic in layers: a Base64-encoded gzip blob in the postinstall script decodes to a second-stage JavaScript file, which then uses String.fromCharCode() array shuffling to reconstruct the C2 URL and credential-harvesting routines at runtime. No malicious string ever exists in plain text on disk, so detection is only possible through behavioural analysis of runtime execution.

02 · T1071.001: Web Protocol C2 · Command & Control · 219 reports

GlassWorm skips conventional HTTP beaconing entirely. It issues read-only RPC calls to the Solana blockchain via api.mainnet-beta.solana.com to retrieve commands embedded in the memo field of on-chain transactions. All C2 traffic looks like ordinary HTTPS to a well-known blockchain API, indistinguishable from DeFi activity on proxy logs, and impossible to sinkhole without blocking all Solana API traffic.

03 · T1036.005: Match Legitimate Resource Name · Defense Evasion · 195 reports

NICKEL TAPESTRY published a trojanised npm package named @bitwarden/cli@2026.4.0, a version string that exactly matches the real Bitwarden CLI release cadence. The package cleared automated scanning because its package.json metadata, README and exported API were copied verbatim from the legitimate package; only the postinstall hook carried the credential-harvesting payload.

04 · T1041: Exfiltration Over C2 Channel · Exfiltration · 156 reports

The MicrosoftSystem64 procedure exfiltrates harvested AWS keys, GitHub tokens and npm credentials by encoding them as JSON and uploading them to the attacker's HuggingFace model repository via the HuggingFace Hub API at huggingface.co/api/datasets. The traffic is HTTPS to a legitimate, widely used ML platform, near-identical to normal developer workflow traffic, and invisible to DLP rules keyed on destination reputation.

05 · T1082: System Information Discovery · Discovery · 152 reports

PLASMAGRID's iOS implant queries UIDevice.current for device model, iOS version, UDID, carrier and battery state immediately post-exploitation, then calls CTTelephonyNetworkInfo for the current radio technology. The triage packet reaches C2 within 800ms, letting operators decide whether to proceed with full exfiltration or silently terminate on sandbox or virtual-device detection.

06 · T1105: Ingress Tool Transfer · Command & Control · 150 reports

In the DPRK Contagious Interview campaigns, BeaverTail executes via a malicious npm package inside a fake coding-interview task, then downloads its second stage (InvisibleFerret) with a GET request to a GitHub Gist URL built dynamically at runtime from encoded string fragments. The staging URL is never static in the binary and rotates across campaigns, defeating indicator-based blocking.

07 · T1140: Deobfuscate / Decode Files · Defense Evasion · 112 reports

CastleLoader arrives as a legitimate-looking DLL sideloaded through a renamed Windows system binary. At runtime it reads an encrypted blob from a .dat file and decrypts it with a hardcoded RC4 key derived from the victim machine's MachineGUID registry value, making the payload machine-specific and non-portable. An analyst cannot decrypt it without that specific victim's MachineGUID, which severely limits static analysis.

08 · T1059.001: PowerShell · Execution · 111 reports

UAC-0194's ClickFix lure instructs victims to paste a PowerShell one-liner (ExecutionPolicy Bypass, WindowStyle Hidden) straight into the Windows Run dialog. It downloads a second-stage script from a compromised Ukrainian government-adjacent domain, patches AMSI in the current session, and loads a .NET reflective RAT entirely in memory, with no files written to disk after initial execution.

09 · T1583.001: Acquire Infrastructure: Domains · Resource Development · 109 reports

Emerald Sleet registered clusters of domains mimicking South Korean government tax and authentication portals, using privacy-protected registrars in Iceland and Panama, with registration timestamps clustered in a 72-hour window before each campaign wave. The domains resolved to the same /24 block and served identical TLS certificates, a pattern that enables proactive hunting across the whole cluster from a single identified domain.

10 · T1552.001: Credentials in Files · Credential Access · 100 reports

When PCPJack lands as a malicious npm package in a CI/CD environment, its postinstall hook runs a Node.js script that reads, in sequence, ~/.aws/credentials, ~/.config/gcloud/application_default_credentials.json, ~/.npmrc, ~/.pypirc, $GITHUB_TOKEN and every .env file up to four directories deep. All discovered secrets are base64-encoded and exfiltrated over HTTPS in under two seconds of installation.

6. Where the effort concentrates

Mapping all 519 techniques across the 14 ATT&CK tactic phases shows a lopsided distribution. Defense Evasion leads Command & Control by roughly two to one, and the shape of the chart is itself the finding: adversaries are spending far more on staying hidden than on any other stage.

Two rows deserve a second look. Execution holds only 26 unique techniques yet appears in 306 reports, the highest report-to-technique ratio in the corpus. PowerShell, JavaScript and malicious-file execution dominate and show up in virtually every campaign: a narrow technique surface, trafficked intensively.

Lateral Movement is the opposite, the thinnest post-compromise tactic, at 12 unique techniques across just 58 reports. That is either a genuine gap in adversary lateral-movement activity or a gap in how deeply post-initial-access behaviour gets reported. Both readings warrant investigation in Q3.

7. The actors behind the numbers

DPRK actors hold three of the top eight slots. UNC6780's May explosion, ten reports in a single month, was the defining statistical event of the quarter, and the reason criminal reporting drew level with nation-state for the first time.

The shapes tell the story. UNC6780 is a spike, ten of its eleven reports land in May, driven by the Mini Shai-Hulud, Trivy, Bitwarden CLI and LiteLLM campaign waves. Lazarus Group is the opposite: the most consistently active actor across all three months, spanning the Bybit follow-on, the Drift Protocol heist, Operation 99 and npm supply chain campaigns. And UAC-0194 is the one to watch, the only actor trending upward month on month, running ClickFix PowerShell campaigns against Ukrainian Defense Forces and deploying the PhantomRelay/LegionRelay RAT. At the bottom of the table, flexhere687-art is a reminder that the old techniques still work: it exploited CVE-2017-11882, a nine-year-old vulnerability, via Blogger-hosted payloads delivering XWorm against UK finance and government targets.

8. Who they targeted

Finance leads by a wide margin, with 137 reports across 221 entities. Finance and Technology together account for 65% of top-eight report volume. Government saw the sharpest month-on-month decline (52 to 36 reports), while Health held uniquely steady at 14 reports in both April and May.

The gap between reports and entities is itself informative. Government's 96 reports span 214 distinct entities, the widest spread in the top eight, reflecting broad, shallow targeting across many organisations. Finance shows the opposite concentration: high report volume on a comparatively contained set of entities, consistent with the sustained, focused pressure that the DPRK financial actors and UNC6780 apply to the sector.