PT ESC cyber intelligence group presented an overview of cyberattacks for Q1 2026 ✍️

PT ESC Cyber Intelligence Group presented an overview of cyberattacks for Q1 2026 ✍️

The report analyzes the activity of hacker groups targeting Russian organizations: from the public sector and the defense industry to finance, manufacturing, and telecommunications.

It describes the activity of the espionage groups Rare Werewolf, PhaseShifters, PhantomCore, Goffee, IAmTheKing, Tolik, BO Team, as well as the financially motivated Hive0117 and Fluffy Wolf.

✉️ Main initial access vectors:

• Targeted phishing with business email correspondence pretexts
• Password-protected archives with LNK shortcuts, NSIS installers with the double extension .pdf.exe, HTA, XLL, RTF, and SFX files
• Exploitation of vulnerabilities in client software
• Mailings from compromised mailboxes to bypass reputation filters

You can read the report in our blog.

#TI #APT #Malware #Phishing
@ptescalator (X, Max)