Positive Technologies Analyzes 140 Incidents: Web Applications Drive Half of Breaches, APT Groups Found in 49% of Cases
Positive Technologies' Incident Response unit (PT ESC IR) has published findings from more than 140 full-cycle incident response and retrospective analysis projects carried out between the fourth quarter of 2025 and the third quarter of 2026. The report highlights persistent attack patterns, the continued prominence of supply-chain compromise, and the growing use of artificial intelligence by threat actors.
Web applications exposed on the network perimeter served as the initial access vector in 50.8% of cases. Among the newly observed targets were Zimbra mail servers and TrueConf video-conferencing servers. Exploitation of known and zero-day vulnerabilities in 1C:Enterprise, Joomla, Atlassian Confluence, and CommuniGate Pro was also recorded.
APT-group activity was identified in 49.3% of investigated organizations, up from 43% the previous year. Seventeen distinct APT groups were observed, with PhantomCore appearing most frequently, followed by IAmTheKing. Cybercrime actors focused on encryption and data destruction were found in 34.2% of cases.
Newly Identified APT Groups
Three previously unknown groups were discovered by the team. Stingy Basilisk maintained stealthy access to a government network for nearly four years using custom loaders TediousLoader, CunningDoor, and SilentCOM. APT10051 abused a backdoored Zabbix monitoring server to proxy traffic through allowed monitoring ports. Chewbacca deployed cross-platform agents and network wipers targeting Cisco, Huawei, and QNAP devices.
Supply-chain attacks accounted for 14.9% of intrusions. Half of these incidents involved compromised contractors; the remainder leveraged the trusted ViPNet network. One contractor compromise allowed ExCobalt to move laterally through multiple organizations over several weeks.
The industrial sector generated the largest share of engagements at 22.5%, more than double the previous period. Median time to contain an incident after PT ESC IR engagement remained two days.
Related articles
Peskov Rejects Claims of Russian Involvement in European Refrigeration System Attacks
Kremlin spokesman Dmitry Peskov has dismissed accusations that Russian-linked cyber groups were behind recent attacks on industrial refrigeration equipment across nine European countries. The incidents, which occurred in early November, involved unauthorized changes to temperature settings on internet-connected cooling systems, with some units pushed to +50 °C. Similar attacks had already been reported in France during October, affecting meat producers and other facilities that rely on precise climate control. Peskov described the allegations as lacking any evidence and part of a recurring pattern of unsubstantiated claims directed at Russia by European nations. The targeted systems are typically connected online for remote maintenance and fault alerts, a feature that becomes a liability when external actors gain access. No group has claimed responsibility for the October or November operations, leaving attribution unconfirmed. The events highlight risks associated with exposing industrial control equipment directly to the internet without adequate segmentation or authentication controls.
North Korean Hacker Groups: Lazarus, Kimsuky, Andariel and Financial Clusters Behind Billions in Thefts
North Korean state-sponsored hacking operations linked to the Reconnaissance General Bureau and other agencies involve dozens of clusters conducting cyber espionage, technology theft, and large-scale financial crimes. Groups such as Lazarus, Kimsuky, Andariel, BlueNoroff, and APT38 have been tied to the 2014 Sony Pictures breach, the 2016 Bangladesh Bank heist, WannaCry, and recent multi-billion-dollar cryptocurrency thefts from Bybit and Binance. Specialized teams focus on fake job offers to infiltrate defense contractors, supply-chain attacks on developers, and ransomware operations that fund further espionage. Researchers from Microsoft, CrowdStrike, Google, and Mandiant track overlapping clusters using names like Diamond Sleet, Labyrinth Chollima, TraderTraitor, and UNC2970, noting frequent infrastructure sharing and evolving tactics. The activity spans political intelligence collection, defense technology theft, and crypto wallet compromises, with some clusters creating fictitious IT workers to gain remote access to foreign companies.
China-Linked WARP PANDA Exploits VMware ESX Zero-Day CVE-2026-41709 to Evade Logging
CrowdStrike reported on 28 October 2026 that the China-linked group WARP PANDA used CVE-2026-41709, a zero-day in VMware ESX, to operate without leaving records on compromised hypervisors. The vulnerability carries a low CVSS 3.1 score of 2.7 and was added the same day to the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 11 November. Broadcom describes the flaw as insufficient logging that allows a malicious administrator to execute certain operations without them appearing in logs. The issue does not enable remote code execution or privilege escalation on its own; its value lies in erasing the audit trail that incident responders rely on to reconstruct activity. CrowdStrike linked the exploitation to espionage operations against U.S. legal-sector organizations, with activity intensifying in early 2026. The report also highlights deployment of BRICKSTORM and SharpStorm malware in vCenter environments along with stolen cloud session tokens. Broadcom has released fixed builds for ESXi 9.1, 9.0.2 and 8.0 U3j, while VMware Cloud Foundation 5 requires version 5.2.4.
North Korean WaterPlum Group Infects 30,000 Computers Across 100 Countries via Fake Coding Tests
The North Korean-linked group WaterPlum, also known as Contagious Interview, has infected at least 30,000 computers in more than 100 countries between December 2025 and July 2026. According to the Internet Crime Complaint Center (IC3), the operation moved at least $10.7 million in cryptocurrency to North Korea and compromised more than 7,000 wallets. Attackers pose as recruiters on social media and freelance platforms, luring software developers with nonexistent job offers that require downloading malicious files disguised as coding tests. The malware arsenal includes BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle, with the latter hiding inside blockchain-themed projects and abusing Visual Studio Code configurations. Developers are specifically targeted because they often store production keys, wallets, and credentials on the same machines used for testing third-party code. Japanese authorities have dismantled laptop farms connected to the scheme that helped maintain the attackers' operational cover.