HackWatch Daily Cyber Threat Intelligence Briefing – May 3, 2026

Source bundle

This daily briefing is generated from public source feeds and HackWatch context. It is designed as a triage briefing, not as a claim that every item is a newly confirmed incident.

• Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite - Mandiant / Google Cloud Threat Intelligence
• Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever - Mandiant / Google Cloud Threat Intelligence
• The German Cyber Criminal Überfall: Shifts in Europe's Data Leak Landscape - Mandiant / Google Cloud Threat Intelligence
• vSphere and BRICKSTORM Malware: A Defender's Guide - Mandiant / Google Cloud Threat Intelligence
• North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack - Mandiant / Google Cloud Threat Intelligence
• M-Trends 2026: Data, Insights, and Strategies From the Frontlines - Mandiant / Google Cloud Threat Intelligence
• The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors - Mandiant / Google Cloud Threat Intelligence
• Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape - Mandiant / Google Cloud Threat Intelligence
• Proactive Preparation and Hardening Against Destructive Attacks: 2026 Edition - Mandiant / Google Cloud Threat Intelligence
• Look What You Made Us Patch: 2025 Zero-Days in Review - Mandiant / Google Cloud Threat Intelligence
• Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit - Mandiant / Google Cloud Threat Intelligence
• Exposing the Undercurrent: Disrupting the GRIDTIDE Global Cyber Espionage Campaign - Mandiant / Google Cloud Threat Intelligence
• From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day - Mandiant / Google Cloud Threat Intelligence
• GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use - Mandiant / Google Cloud Threat Intelligence
• Beyond the Battlefield: Threats to the Defense Industrial Base - Mandiant / Google Cloud Threat Intelligence
• UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering - Mandiant / Google Cloud Threat Intelligence
• Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft - Mandiant / Google Cloud Threat Intelligence
• Guidance from the Frontlines: Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaS - Mandiant / Google Cloud Threat Intelligence
• No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network - Mandiant / Google Cloud Threat Intelligence
• Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088 - Mandiant / Google Cloud Threat Intelligence

Morning Briefing (The Big Picture)

April and early May 2026 show a landscape of persistent, sophisticated adversaries leveraging social engineering, supply chain attacks, and AI-driven exploitation. Notably, UNC6692's social engineering combined with custom malware highlights ongoing risks of lateral movement via trusted communication platforms. Meanwhile, critical vulnerabilities in Linux and Windows remain actively exploited, underscoring patch management challenges. AI-related attacks, particularly indirect prompt injections, are emerging as a new vector requiring immediate attention.

• UNC6692 exploits Microsoft Teams trust to deploy modular malware and pivot internally.
• Critical Linux flaw CVE-2026-31431 enables root escalation across nearly all distros since 2017.
• Indirect prompt injection attacks are now observed in the wild, targeting AI-powered systems.
• Supply chain compromise of Axios NPM package demonstrates continuing risk to open source ecosystems.

Prioritize patching of critical OS vulnerabilities, enhance user training against social engineering, and begin threat modeling for AI prompt injection risks.

Adversary Watch & TTPs

UNC6692 exemplifies the blend of social engineering and custom malware deployment to achieve deep network access. Their use of Microsoft Teams for initial access is a reminder that service accounts and collaboration tools remain high-value attack vectors. North Korea-linked actors continue supply chain attacks, leveraging malicious dependencies to infiltrate software ecosystems. The rise of indirect prompt injection attacks signals a new frontier in TTPs targeting AI agents and automation workflows.

• UNC6692 impersonates IT helpdesk via Teams to gain footholds and execute modular malware.
• UNC1069 employs AI-enabled social engineering targeting cryptocurrency firms with tailored malware.
• Supply chain attacks on popular NPM packages like Axios highlight the risk of malicious dependencies.
• Indirect prompt injection enables adversaries to manipulate AI agents without direct user input.

Monitor collaboration platforms for suspicious account activity, audit third-party dependencies rigorously, and integrate AI threat detection into security operations.

Cloud & Identity

The continued exploitation of hardcoded API keys and credential theft through vishing campaigns underlines the fragility of identity controls in cloud environments. ShinyHunters-branded operations demonstrate how voice phishing combined with MFA bypass techniques threaten SaaS ecosystems. Additionally, the exposure of enterprise emails due to hardcoded keys in SaaS tools like ClickUp reveals gaps in secure credential management. Device Bound Session Credentials (DBSC) deployment in Chrome offers a promising defense against session theft.

• ShinyHunters use vishing and credential harvesting to compromise SSO and MFA in cloud SaaS.
• ClickUp data leak from hardcoded API key exposed sensitive enterprise emails for over a year.
• DBSC in Chrome is publicly available on Windows and coming to macOS, enhancing session security.
• Misconfigurations in MongoDB databases continue to leak sensitive customer and delivery driver data.

Enforce strict API key management, enhance user awareness of vishing threats, adopt device-bound session credentials, and audit cloud database configurations regularly.

Operations and Agentic SOC

Agentic SOCs face new challenges as indirect prompt injection (IPI) attacks emerge, allowing adversaries to manipulate AI-driven workflows silently. The sophistication of these attacks requires continuous monitoring and adaptive defenses. The integration of AI in attack lifecycle acceleration also demands defenders to innovate detection capabilities. Meanwhile, the disruption of large residential proxy networks like IPIDEA reduces adversary anonymity and complicates their operational tactics.

• IPI attacks threaten AI agents by injecting malicious instructions into data sources.
• AI accelerates adversary reconnaissance, social engineering, and malware development.
• Disruption of IPIDEA proxy network limits adversary ability to mask operations.
• Agentic SOCs must evolve to detect AI-targeted exploitation and prompt injection attempts.

Implement continuous AI behavior monitoring, incorporate prompt injection detection, and collaborate on proxy network takedowns to reduce adversary operational freedom.

Compliance, Governance & Geopolitics

Geopolitical tensions continue to influence cyber threat patterns, with state-linked actors from North Korea and China engaging in espionage and supply chain compromises. The addition of CVE-2026-39987 to CISA’s Known Exploited Vulnerabilities Catalog reflects regulatory pressure to patch high-risk flaws promptly. Increasing ransomware pressure and data leak activity in Germany highlight regional risk concentrations. Organizations must balance rapid patch deployment with governance to mitigate exposure.

• North Korean actors target cryptocurrency sector with AI-enhanced social engineering.
• CISA mandates patching of critical vulnerabilities like CVE-2026-39987 to reduce exploitation risk.
• Germany experiences a surge in data leak extortion impacting infrastructure and enterprises.
• Regulatory frameworks increasingly emphasize timely vulnerability management and incident response.

Align patch management with compliance deadlines, monitor geopolitical threat actor activity, and enhance governance around incident detection and reporting.

Key internal signals

Findings

What HackWatch will track next

• Urgently patch critical vulnerabilities in Windows (e.g., CVE-2026-32202) and Linux (CVE-2026-31431) to mitigate active exploitation.
• Enhance user training to detect social engineering attempts, especially those involving collaboration platforms like Microsoft Teams.
• Audit and secure software supply chains, focusing on third-party dependencies and package repositories.
• Deploy Device Bound Session Credentials and strengthen MFA implementations to reduce credential theft risks.
• Integrate AI threat detection capabilities to identify and mitigate indirect prompt injection attacks in agentic SOC environments.
• Maintain compliance with regulatory patching mandates and monitor geopolitical threat actor activity to inform risk management.