August 2026 Threat Trend Report on APT Groups
2026-09-18 • Ahnlab •
North Korea-linked actors focused on developers, software supply chains, remote hiring, and defense targets during August 2026. Famous Chollima continued PolinRider supply-chain activity and used Ethereum for covert command and control, while Jasper Sleet sought internal access through AI-generated identities and remote-job scams. Kimsuky employed AI-generated decoys and Git-based command and control. Lazarus used a malicious PDF viewer and the then-undisclosed CVE-2026-68820 zero-day against defense-sector targets in Operation Dream Job.
Related Actors
Related Reports
2026-09-18 •
90% Match
#Trend
#DreamJob
#Kimsuky
#Lazarus
#FamousChollima
#JasperSleet
#PolinRider
#CVE-2026-68820
Shares tags: Trend, DreamJob, Kimsuky • Same author: Ahnlab • Published within a week
2026-10-16 •
65% Match
#Kimsuky
#Konni
#ContagiousInterview
#FamousChollima
#OtterCookie
#PolinRider
#VelvetCake
Shares tags: Kimsuky, FamousChollima, PolinRider • Same author: Ahnlab • Published within a month
2026-10-16 •
65% Match
#Kimsuky
#Konni
#ContagiousInterview
#FamousChollima
#OtterCookie
#PolinRider
#VelvetCake
Shares tags: Kimsuky, FamousChollima, PolinRider • Same author: Ahnlab • Published within a month
Shares tag: Kimsuky • Same author: Ahnlab • Published within a month
2026-10-12 •
55% Match
From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases
Ahnlab
Shares tag: Kimsuky • Same author: Ahnlab • Published within a month
2026-09-30 •
55% Match
#Kimsuky
#Phishing
#LNK
#GitHub
#AutoIt
#XenoRAT
#T1566.001
#T1053.005
#T1059.001
#T1574.002
#Hangul
#PubNub
Shares tag: Kimsuky • Same author: Ahnlab • Published within a month