Q2 2026 Threat Briefing

Attack techniques evolved from targeted exploitation to broad-scale automation and supply chain contamination. In April, activities were largely focused on specific high-value targets using zero-days like CVE-2026-34621 in Adobe Acrobat Reader. By May, the focus had shifted to infrastructure-wide compromises via TeamPCP's multi-vector campaign against developer tools. This evolution demonstrates a strategic preference for impacting many victims through a single compromised dependency rather than conducting individual intrusions. The use of worms like Shai-Hulud allowed for self-propagating access that bypassed traditional network segmentation and endpoint detection.

Nation-state actors expanded their targeting beyond traditional government entities to include critical industrial infrastructure and AI development pipelines. APT41 and UAT-4356 targeted genomic data repositories and water treatment systems, respectively, indicating a move toward kinetic impact capabilities alongside espionage. The emergence of OT malware like ZionSiphon highlights a maturation in industrial targeting, where the objective is physical disruption rather than mere data theft. This diversification requires defense strategies to address both cyberespionage and operational technology safety simultaneously.

Financially motivated groups also evolved their methodologies by consolidating power and increasing the tempo of extortion campaigns. ShinyHunters operated with high consistency across multiple sectors, utilizing credential abuse and public exposure tactics to pressure victims into payment. The group’s integration of Salesforce and Okta misconfigurations demonstrated a repeatable methodology for bypassing multifactor authentication controls. This industrialized approach to data theft allowed them to impact millions of individuals rapidly, setting a new standard for ransomware operational efficiency.

The role of AI in threat execution evolved from assistance to autonomy during the quarter. Early in Q2, AI was used primarily for content generation and reconnaissance automation. By June, we observed the debut of JADEPUFFER, an autonomous AI agent capable of orchestrating ransomware attacks without human oversight. This progression suggests a future where malicious actors can deploy self-sustaining campaigns that adapt to defenses in real-time, requiring defensive systems to operate at similar speeds and levels of autonomy.

OAuth device code phishing has emerged as a significant concern due to its ability to bypass multifactor authentication entirely. The disruption of traditional PhaaS platforms accelerated the adoption of this technique by groups like ShinyHunters, allowing them to maintain persistent access to compromised accounts without triggering security alerts. This trend requires organizations to audit and restrict OAuth scopes across all third-party integrations, particularly for privileged accounts in identity providers like Okta and Azure AD.

The convergence of state and criminal tactics on AI infrastructure presents a dual threat vector. Nation-state actors target AI development pipelines for intellectual property theft, while financial criminals exploit AI inference APIs for data exfiltration. This overlap indicates that AI systems are now high-value targets for diverse adversary groups, requiring specialized security controls to protect both the models and the data they process from both espionage and extortion objectives.

Insider threat recruitment within the security industry has intensified, as evidenced by the sentencing of Ryan Goldberg and Kevin Martin for collaborating with BlackCat. This deliberate targeting of incident response staff suggests that adversaries are seeking to compromise the defenders themselves to gain insight into active investigations and victim environments. Organizations must implement strict segregation of duties and communication logging for staff interacting with external parties to mitigate this risk.

Physical-digital hybrid attacks pose a growing challenge to perimeter-based security models. The use of in-person USB drops by Silent Ransom Group indicates that adversaries are willing to engage in tangible risks to achieve initial access when digital defenses are robust. This trend expands the attack surface to include physical facilities and supply chain logistics, requiring integrated security programs that address both digital and physical intrusion vectors.

First, organizations must transition from calendar-based patching to continuous risk-based prioritization. The collapse of patch windows means that relying on monthly updates leaves critical systems exposed for dangerous periods. Security leaders should implement automated vulnerability scanning and compensating controls that can be deployed immediately upon disclosure, ensuring that high-risk flaws like CVE-2026-41940 are mitigated before active exploitation peaks.

Second, implement strict identity and access management controls across all cloud and SaaS integrations. The prevalence of credential abuse by groups like ShinyHunters necessitates the adoption of hardware-based multifactor authentication for all privileged accounts. Organizations should also audit OAuth grants regularly, revoking excessive scopes and monitoring for anomalous token usage patterns that indicate compromise.

Third, enforce comprehensive supply chain integrity verification for all third-party dependencies. Attacks on npm and PyPI demonstrate that trusted package registries are no longer safe foundations. Security teams must deploy software composition analysis tools that detect malicious hooks and code changes, and establish processes to vet and monitor updates from external vendors before deployment.

Fourth, develop detection capabilities for AI-assisted and autonomous threats. Traditional signature-based tools are insufficient against dynamically generated code and autonomous malware like JADEPUFFER. Investment in behavioral analytics and user entity behavior analytics will be critical to identify anomalies that indicate AI-driven automation or unauthorized access via identity chains.

Fifth, integrate physical security protocols with digital incident response plans. The rise of hybrid attacks requires a unified approach to perimeter defense. Organizations should conduct tabletop exercises that simulate physical intrusion scenarios alongside cyber incidents, ensuring that both physical and digital response teams are coordinated in addressing complex breach events.