Back Trellix

SecondSight Threat Hunting Report September 2026

Trellix • September 9, 2026

Insights gleaned from Trellix SecondSight, expert threat hunters, and a global network of telemetry and intelligence

January 1, 2026 – June 30, 2026

SecondSight threat hunting report

Authored by the Trellix Advanced Research Center, this report (1) highlights threat hunting insights, intelligence, and guidance gleaned from multiple sources of critical data, including Trellix SecondSight, on the top five critical campaigns observed in the first half of 2026, and (2) develops expert, thorough case studies to inform and enable best practices in defending against these types of campaigns. This edition focuses on data and insights captured primarily between January 1, 2026, and June 30, 2026.

The AI era is changing cybersecurity on both sides of the battlefield. Adversaries can adapt and operate at greater speed, while defenders now have unprecedented ability to process massive volumes of telemetry and intelligence. This does not make threat hunting less important. It makes effective threat hunting more important, and requires us to rethink how it is done.

The traditional model of a hunter manually working through endless queries no longer scales. Machines and AI can , correlate, and process data at extraordinary speed, but human expertise remains essential to determine what is worth hunting, why a signal matters, and where an investigation should go . The hunter increasingly becomes the strategist: defining the question, applying analytical logic, interpreting the evidence, and following unexpected paths. Automation provides reach; human curiosity provides direction.

Effective hunting therefore requires both creativity and discipline. A hunt may begin with threat intelligence, an anomaly, a weak detection, or an emerging campaign. From there, hunters evaluate relevance, translate adversary knowledge into indicators and behaviors, across telemetry, validate what they find, and turn those findings into defensive action. This creates a repeatable process without removing the judgment and curiosity that make hunting effective.

The Axios npm supply chain compromise demonstrates why this matters. As intelligence emerged the attack, SecondSight hunters translated the known infrastructure and attacker behaviors into IOC- and TTP-based hunts across Trellix telemetry. Potentially affected environments could then be identified, attack activity reconstructed, and customers notified. The advantage was not simply understanding the threat, it was compressing the time between intelligence, hunt creation, evidence discovery, and action .

That capability represents an important distinction between building security products and operating as a security company. Products detect what they have been designed to recognize. A security company goes further: continuously studying adversaries, translating new knowledge into hunting logic, searching for evidence across customer environments, and feeding those discoveries back into protection. When the threat changes, the hunt changes with it.

The investigations in this second edition of the Trellix SecondSight Threat Hunting Report show that approach in practice. Different campaigns begin with different signals, but the principle remains the same: effective hunting is not measured by the number of alerts generated or queries executed. It is measured by how effectively intelligence, technology, analytical discipline, and human curiosity can uncover what the adversary hoped would remain unseen—and turn that knowledge into protection.

Hunting methodology and framework

SecondSight hunting is driven by a structured prioritization framework designed to identify meaningful risk early, before attackers reach their objective. Our hunters do not start with alerts alone. We begin by continuously assessing active threat campaigns, adversary objectives, and tradecraft observed across the global landscape, then mapping that intelligence to customer environments to determine where exposure is most likely to exist. This approach allows us to focus our efforts where attacker intent, capability, and opportunity intersect.

Hunting decisions are informed by multiple signals rather than single indicators. Low-confidence alerts, anomalous behaviors, infrastructure reuse, and identity abuse are evaluated together and weighted based on relevance, credibility, and potential impact. Individually, these signals may appear benign or fall below traditional detection thresholds.

When combined and placed in an adversarial context, they often reveal early-stage intrusion activity, campaign staging, or abuse of trusted services.

This framework ensures consistency without sacrificing analyst judgment. Each hunt progresses through clear decision points:

Validating threat intel relevance

Confirming behavioral alignment with known techniques

Assessing environmental exposure

Determining whether proactive customer notification is warranted

The result is a disciplined, repeatable approach that prioritizes early disruption over retrospective investigation. This methodology reflects our belief that effective security is not defined by the number of alerts generated, but by the ability to connect intent, behavior, and context in time to prevent meaningful impact.

Top 5 Critical Campaigns Observed

Stealthy APT28 Multistage Campaign Leveraging CVE-2026-21509 and Cloud C2 Infrastructure

Between January 28 and 30, 2026, APT28 (also known as Fancy Bear and UAC-0001) launched a spear-phishing campaign against European government, defense, and diplomatic organizations. Trellix Email Security identified and blocked at least 29 malicious emails sent to targets across nine Eastern European nations. None reached their intended recipients.

The weapon of choice was CVE-2026-21509, a Microsoft Office OLE security feature bypass that APT28 weaponized within 24 hours of public disclosure. The documents arrived as .doc files but were structurally RTF, which bypassed conventional file-type inspection. The lures were carefully matched to their targets:

Weapons-smuggling alerts impersonating border security agencies

Military training invitations spoofing a regional defense university

EU/NATO diplomatic consultation requests the Ukraine conflict

Meteorological emergency bulletins using compromised weather service accounts

All of them used authentic government aesthetics, official letterheads, bilingual formatting, and ministerial seals, likely built from previously stolen documents.

The senders were real, compromised government accounts. When a victim opened the attachment, CVE-2026-21509 triggered without a macro prompt, reaching out over WebDAV to attacker-controlled infrastructure to pull down a malicious LNK file that then loaded a first-stage DLL. The infection split into two paths at that point.

Chain A (BEARDSHELL/Covenant Grunt) established persistence through COM hijacking, decoded .NET shellcode hidden inside a PNG image using steganography, loaded the .NET CLR in memory, and set up a fileless Covenant Grunt implant that used the legitimate filen.io cloud storage service exclusively for C2, so all beaconing looked like ordinary cloud sync traffic.

Chain B (NotDoor) dropped a malicious VbaProject.OTM into Outlook that silently forwarded every inbox email to attacker-controlled addresses, with no trace left in Sent Items. The goal was intelligence collection on NATO military operations, European diplomatic positions on Ukraine, and critical transportation infrastructure.

Phishing: Spear-phishing attachment ( T1566.001 )

Weaponized RTF documents with .doc extensions using geopolitical lures targeting defense, diplomatic, and transportation sectors

Trusted relationship ( T1199 )

Sent from compromised government accounts; all emails passed SPF/DKIM/DMARC

Exploitation for client execution ( T1203 )

CVE-2026-21509: malformed OLE Shell.Explorer.1 object fetches payload via WebDAV on document open, no macro required

System binary proxy execution: Rundll32 ( T1218.011 )

SimpleLoader DLL retrieved via LNK and executed by rundll32.exe

Event triggered execution: COM hijacking ( T1546.015 )

CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} hijacked; EhStoreShell.dll loads into every new explorer.exe instance

Office application startup ( T1137.001 )

NotDoor replaces VbaProject.OTM ; registry modified to disable macro warnings and force load on boot

Obfuscated files or information: Embedded payloads ( T1027.009 )

Covenant Grunt .NET shellcode hidden in PNG IDAT chunks; triple XOR string encryption

Virtualization/sandbox evasion: Time-based ( T1497.003 )

BEARDSHELL validates a sleep of at least 2.9 seconds before proceeding; aborts in time-accelerated sandboxes

Email collection ( T1114 )

NotDoor batches Inbox/Drafts/Junk/RSS folders, saves each as .msg, and forwards with DeleteAfterSubmit = True

Web service ( T1102 )

Covenant Grunt uses the filen.io REST API exclusively for C2; commands and results stored as encrypted cloud files

Exfiltration over web service: Cloud storage ( T1567.002 )

Data exfiltrated via filen.io (BEARDSHELL chain); real-time email forwarding to ProtonMail/Outlook.com (NotDoor chain)

Threat hunting process

This investigation started with a cluster of generic malware detections on incoming .doc attachments. The real opening came when we looked past Trellix’s generic signature detection and checked the actual file structure. Every attachment was RTF despite carrying a .doc extension. That mismatch matters: a legitimate Word document is either Compound File Binary Format or OOXML. An RTF wearing a .doc extension is a pattern we associate specifically with OLE exploit delivery. The politically charged subjects going to government and defense recipients confirmed this was a coordinated APT operation, not a mass phishing run.

We extracted the embedded OLE objects from the RTF files and pulled the hardcoded WebDAV URLs. Pivoting on the code analysis pattern showed the overlap of the loader with APT28’s samples. Full payload analysis mapped both infection chains and revealed filen.io as the C2 channel, which is harder to take down and harder to detect than a traditional C2 server.

Our hunting methodology involved:

File-type mismatch detection: Flagging .doc/.docx attachments where the actual structure is RTF, which is a reliable indicator for OLE exploit delivery that content filters tend to miss.

Dynamic detonation of email attachments in the Trellix IVX sandbox, which surfaced the malicious WebDAV callback URLs embedded in the RTF files. Trellix Email Security automatically revoked the emails upon sandbox verdict.

Subject line and sender correlation to tie together dispersed detections into a single coordinated campaign picture.

Remediation steps

Block wellnesscaremed[.]com, wellnessmedcare[.]org, freefoodaid[.]com, and longsauce[.]com along with their associated IPs. Microsoft released an out-of-band patch for CVE-2026-21509; applying it is the single most impactful thing customers can do.

On endpoints, hunt for the COM hijack registry key, look for EhStoreShell.dll, and SplashScreen.png under. For NotDoor, verify that %APPDATA%\Microsoft\Outlook\VbaProject.OTM has not been replaced, and alert on bulk outbound forwarding to other email addresses. Do not block filen.io at the domain level. Instead, write behavioral rules that alert when non-standard processes make high-frequency HTTPS calls to *.filen-*.net.

The APT28 campaign offers several takeaways for threat-hunting teams.

File-type mismatch detection belongs in your email pipeline: An RTF file disguised as a .doc combined with a generic detection hit. It is a deliberate choice to evade file-type filters, and it should trigger manual review regardless of what the content looks like.

Lure themes that closely mirror a recipient's specific operational role are worth a second look during triage. Particularly when paired with an unexpected sender, an unusual attachment type, or a sandbox signal, the thematic relevance should raise your overall suspicion.

RTF files with OLE objects frequently embed remote URLs that can be extracted statically. Pulling those URLs out of the file and pivoting on the infrastructure takes minutes and can surface the full campaign scope before any endpoint is touched.

Persistent Bitter APT FIFA World Cup Phishing Campaign

In June 2026, a state-aligned threat actor targeted a European embassy in Asia with a sophisticated spear-phishing email. The attackers compromised a legitimate mailbox belonging to a diplomatic account from an African country to send the malicious message. The email was cleverly disguised as a within a legitimate-appearing diplomatic invitation thread regarding a "FIFA World Cup themed event," enhancing its credibility.

The attack utilized a multistage delivery method beginning with a ZIP file attachment containing a VHDX disk image. Inside this image lay a shortcut (.lnk) masquerading as a PDF document. Upon execution, this shortcut initiated an obfuscated PowerShell and command-line sequence.

This process established a scheduled task, deceptively named to appear like a system error to ensure persistence, and beaconed to a remote server. This initial connection facilitated reconnaissance by gathering system information and eventually downloading a second-stage MSI installer, which deployed the BDarkRAT remote-access trojan.

The potential impact of a successful infection could have been severe, providing the attacker with full remote access to a diplomatic workstation. This capability would have allowed for extensive system reconnaissance, theft of sensitive files, and the execution of remote commands on the compromised machine.

What makes this activity particularly interesting is the clear evidence of a sustained, long-term espionage campaign. The threat actor, Bitter APT, reused specific infrastructure, including the BDarkRAT command-and-control domain ( hannahsgpsapp[.]com ), from a campaign targeting the same embassy in October 2025. This consistency in tooling and persistence methods against a specific diplomatic target demonstrates that the activity is not opportunistic spam, but rather a calculated and persistent effort.

Phishing: Spear-phishing attachment ( T1566.001 )

Sent an email with a ZIP file attachment containing a VHDX disk image

User execution: Malicious file ( T1204.002 )

The VHDX disc image had to be mounted and the .lnk file opened by the user

Scheduled task/job: Scheduled task ( T1053.005 )

Creates the scheduled task Services\FILE_NOT_FOUND_ERROR_404 to achieve persistence

Obfuscated files or information ( T1027 ) Hide artifacts: Hidden window ( T1564.003 ) Masquerading ( T1036 )

Base64 + string concatenation Hidden command shell: conhost --headless Shortcut (.lnk) masquerading as a PDF document

System information discovery ( T1082 ) File and directory discovery ( T1083 ) Software discovery: Security software discovery ( T1518.001 )

To understand the environment of the victim, BDarkRAT performs system profiling.

Web service ( T1102 )

Compromised/shared hosting for C2

Exfiltration over C2 channel ( T1041 )

Transfers stolen data out of the network via the established C2 channel.

Threat hunting process

While analyzing the email telemetry, we focus on targeted campaigns that might have been overlooked. We identify these campaigns by applying various filters, including the type of attached objects, the recipient email, and the subject line theme. In this case, these three elements caught our attention.

The "light-bulb moment" occurred when we observed the reuse of the command-and-control infrastructure, which was previously linked to a campaign against this same customer in October 2025. This historical context immediately signaled that the activity was not opportunistic spam but a calculated, sustained espionage effort utilizing the same established playbook.

Our hunting methodology involved:

Email analysis, including the subject, the recipient, and the attachments, to detect targeted campaigns

Malware detonation and analysis to verify its family, capabilities, and configuration

Threat intelligence support to correlate this campaign with a one based on the employed command-and-control domain

Remediation steps

To remediate and defend against this threat, prioritize blocking the compromised sender domain and the associated command-and-control infrastructure ( bluevistaviewspa[.]com and hannahsgpsapp[.]com ) across all security layers. Update email and endpoint block lists with the identified malicious file and attachment hashes, and implement stricter inspection policies for ZIP files containing containerized images like VHD or VHDX, as well as .lnk files that trigger PowerShell or command shells.

Enhance detection capabilities by configuring alerts for scheduled tasks containing curl or cmd operations and monitor for conhost.exe instances running with the --headless flag. Finally, establish proactive hunting protocols for mswsrc.exe and script.vbs artifacts within %LOCALAPPDATA% and ensure staff are briefed on the risks of thread-hijacking tactics used in event-invitation spear-phishing campaigns.

Based on the tactics and patterns observed in the report, here is advice for threat hunting teams to help detect similar activity:

Scrutinize containerized attachments: Treat ZIP attachments containing VHD, VHDX, or ISO images with extra caution, as these formats are being leveraged to bypass standard security inspection.

Flag suspicious shortcut behavior: Create detection rules for .lnk files that launch PowerShell or command-line strings, especially when they masquerade as common document types like PDFs.

Monitor scheduled task creation: Alert on the creation of scheduled tasks that utilize curl, cmd, or other scripts to beacon out to external domains, as this is a common persistence mechanism.

Detect execution evasion: Monitor for conhost.exe running with the --headless flag, as this is a specific technique used to maintain hidden command shells on compromised hosts.

Correlate infrastructure across campaigns: Do not analyze C2 domains in isolation. Track and correlate infrastructure reuse over time; actors frequently recycle the same C2 domains and playbooks when targeting specific entities.

Educate on thread-hijacking: Train staff to remain vigilant even when emails arrive within existing, legitimate conversation threads. Attackers are compromising legitimate accounts to hijack these discussions and lower user defenses.

DarkSword iOS Exploit Kit: Russian Spear-phishing Campaign Targeting NATO-aligned Officials

On March 26, 2026, a threat actor sent four named spear-phishing emails against senior government and defense personnel at NATO-aligned organizations. Each email impersonated Frederick Kempe, President of the Atlantic Council, and invited the recipient by their full name to a fabricated "Closed-Door Strategic Discussion." Targets included government officials at a Central European presidential office, a European foreign affairs ministry, a U.S. federal agency, and a defense industry program lead at a major European aerospace enterprise.

All four emails came from a single Russian-hosted MTA, s1277447[.]smartape-vps[.]com (IP 188[.]127[.]227[.]111, Russia), but each used a different sender domain. The actor mixed purpose-built domains registered weeks before the campaign with likely hijacked legitimate domains across unusual TLDs (.tz, .ec, .in). The embedded links led to PHP pages on bridetvstreaming[.]org and motorbeylimited[.]com. Those pages served as benign decoys and reserved the real payload for iPhone visitors geolocated to expected target countries. At delivery, none of the emails got a malicious verdict.

The likely payload was DarkSword, a full-chain browser exploit for iOS 18.4 through 18.7. It uses six vulnerabilities: Two for remote code execution in WebKit/JavaScriptCore (CVE-2025-31277, CVE-2025-43529); one for PAC bypass in dyld (CVE-2026-20700); one for WebContent sandbox escape (CVE-2025-14174); and two for privilege escalation (CVE-2025-43510, CVE-2025-43520).

Clicking the link on a vulnerable iPhone triggers the entire chain with no further user interaction. If the compromise had succeeded, a JavaScript backdoor would have exfiltrated messages, credentials, contacts, location, and files. Apple completed patching the full chain across iOS updates, culminating in iOS 26.3 (and legacy backports).

Attribution is HIGH confidence Russian state- , consistent with TA446, the FSB Centre 18 actor also tracked as Callisto, COLDRIVER, and Star Blizzard. Proofpoint publicly attributed the activity to TA446 . Google Threat Intelligence Group documented DarkSword and confirmed its use across multiple Russian-nexus actors. Attribution of DarkSword specifically to this campaign is MEDIUM confidence, as the payload pages were offline by the time of investigation and no exploit content was recovered.

Phishing: Spear-phishing link ( T1566.002 )

Named invitation emails impersonating the Atlantic Council president; unique sender domain per target

Acquire infrastructure: Domains ( T1583.001 )

Purpose-built domains registered weeks before the campaign alongside likely hijacked legitimate domains with non-standard TLDs

Acquire infrastructure: Virtual private server ( T1583.003 )

Single Russian VPS ( ASN 56694 Smart Ape ) used as the MTA for all four emails, sharing a process ID

Masquerading: Match legitimate name or location ( T1036.005 )

Display name set to real Atlantic Council president; subject lines personalized with each target's full name

Obfuscated files or information ( T1027 )

Server-side filtering on phishing pages served a benign PDF to automated scanners; the exploit was held back for real iPhone visitors from expected geographies

Exploit public-facing application ( T1203 )

DarkSword one-click browser exploit chain (6 CVEs) targeting iOS 18.4 through 18.7 via Safari/WebKit

Exfiltration over C2 channel ( T1041 )

Post-compromise JavaScript backdoor exfiltrating messages, credentials, location, contacts, and files

Threat hunting process

This investigation was retroactive. A trusted partner shared an email address tied to a Russian threat actor. We took that and looked for it in our own telemetry. What we found was more than a single match: Every email in the wave had come from the same sending host, s1277447[.]smartape-vps[.]com, with each going to a different organization with a different sender domain and a different phishing URL.

One Russian VPS, one process, four named targets across three countries, 66 minutes. That was enough to treat it as a coordinated campaign. The phishing pages were configured to serve a clean PDF to anything that looked like a scanner, and to serve the exploit only to real iPhones geolocated where they expected their targets. Further threat intelligence analysis corroborated the infrastructure and confirmed the attribution.

Our hunting methodology involved:

Retroactive pivot from a partner-shared sender indicator into our email telemetry, then expanding from the sender to the sending infrastructure to find related emails across different organizations.

Message-ID header correlation to identify the shared MTA hostname s1277447[.]smartape-vps[.]com and common process ID that tied all four emails into a single campaign.

Cross-referencing public and private intelligence sources to correlate infrastructure IOCs and confirm attribution.

Remediation steps

Block sending IP 188[.]127[.]227[.]111 and MTA hostname s1277447[.]smartape-vps[.]com in email gateway controls. Block phishing domains bridetvstreaming[.]org and motorbeylimited[.]com at network level. For organizations with senior or high-risk personnel, the most impactful action is iOS patching: All devices should be on iOS 26.3 or later, where all six DarkSword CVEs are patched. Personnel who cannot update immediately should have Lockdown Mode enabled, which blocks the class of browser exploits used here.

The DarkSword campaign offers several takeaways for threat-hunting teams.

Partner-shared indicators are worth acting on even after the fact. Retroactive hunting from a shared sender address can still surface undetected activity in your telemetry, particularly when the original delivery produced false negatives.

A single sender indicator is a starting point, not a destination. Expand your to the sending infrastructure.

Phishing pages that serve clean content to scanners while serving exploits to real users from expected geographies are a deliberate evasion technique.

For organizations whose personnel include senior officials, government employees, or defense industry figures, iPhone patching cadence is as important as endpoint patching. A one-click browser exploit requiring only a single link tap is a realistic threat for these users.

When triage surfaces an email where the subject line is personalized with the recipient's full name and the sender is from an unusual or unfamiliar domain, treat the combination as worth a second look. Neither indicator alone is reliable, but together they suggest the sender had prior knowledge of the target rather than running bulk phishing.

Sophisticated JSCeal Campaign Targeting Southeast Asia

The campaign, seen during the first half of 2026 targeting Southeast Asia customers, began with the execution of an encoded PowerShell script that bypassed initial security controls. This script acted as an initial downloader, fetching a suite of malicious components from an external domain, which included the Node.js runtime and an encrypted application script. The primary objective of this operation appears to be the deployment of an information stealer, potentially known as JSCeal , which is designed to exfiltrate sensitive data from compromised machines.

To maintain stealth and facilitate execution, the attackers employed a series of technical maneuvers. The script disabled the system's proxy settings to ensure uninterrupted communication with the malicious command-and-control server. The execution environment was carefully configured using environment variables, including an AES‑256‑CBC key for decrypting the main application payload and specific options to force a preloading script to run alongside the Node.js process. This preload script performed the critical task of reading the encrypted file, decrypting the content, and decompressing it using Brotli compression before executing the payload via a V8 bytecode loader.

The potential impact of this activity includes data theft and further network compromise, as the modular nature of the payload allows for the future installation of more destructive tools. What is particularly interesting this threat is the use of a legitimate, widely used environment like Node.js to host malicious activities.

User execution: Malicious file (T1204.002) Command and scripting interpreter: JavaScript (T1059.007)

A fake installer is executed by the victim, which prompts the execution of an encoded PowerShell command The Node.js framework is deployed to decrypt and execute the JSCeal payload

Create or modify system process: Windows service (T1543.003)

A Windows service is created to gain persistence in the system

Deobfuscate/decode files or information (T1140) Obfuscated files or information (T1027)

The different stages and the JSCeal payload employ different obfuscation and encryption techniques

Credentials from password stores: Credentials from web browsers (T1555.003)

JSCeal will target the sensitive information stored in the browsers, including passwords, session cookies, and wallet information

Data from local system (T1005) Screen capture (T1113) Input capture: Keylogging (T1056.001)

JSCeal is capable of stealing a wide variety of sensitive information from the system

Application layer protocol: Web protocols (T1071.001)

The main payload and the Node.js framework is downloaded from the C2 using HTTPS, the same method later used by JSCeal to communicate with the C2

Threat hunting process

The investigation was initiated by a suspicious encoded PowerShell activity on one of the hosts. These commands are quite common in development environments, but this time was different due to the process lineage; specifically, the spawning of a Node.js runtime from a non-standard, masquerading directory ( OneDriveSoftwareInstallerTask-bx3ou, EdgeResourcesInstallerV1-jth3, OSVersionInstallerV12Task-cqimme3 ) to load decrypted, Brotli-compressed bytecode directly in memory.

Our methodology relied on rapid telemetry correlation to deconstruct this multistage attack. By mapping the full execution flow ( powershell.exe -> node.exe -> preload.js -> app.js ), we were able to identify the responsible binaries and reverse-engineer the in-memory decryption logic.

Our hunting methodology involved:

Proactive PowerShell encoded commands hunting

Process-genealogy analysis, which revealed that the PowerShell process spawned a Node.js instance from an anomalous, masquerading directory

Reverse engineering the different stages to understand the execution chain and identify the sample behind the campaign

Remediation steps

To remediate this threat, immediately isolate the affected host to prevent further network access and potential lateral movement. Eradicate all malicious files and identify and remove the Windows service established for persistence. Block the malicious identified domains at the network perimeter (firewall/proxy/DNS) and reset credentials for any accounts that logged into the infected host.

Finally, to prevent future occurrences, enforce application allowlisting (e.g., WDAC or AppLocker), implement PowerShell security configurations such as Constrained Language Mode and enhanced logging, and conduct user awareness training on the dangers of executing untrusted applications.

When investigating sophisticated multistage threats similar to the one identified in this report, consider these tips to improve your detection and response efficacy:

Look beyond obfuscated commands: Attackers often use encoded PowerShell to hide their initial intent. Don't just focus on the decoding; pivot immediately to analyzing the resulting process lineage (e.g., PowerShell spawning unexpected binaries like node.exe ).

Audit non-standard execution paths: Be highly suspicious of legitimate binaries (like node.exe or winpty.exe) executing from unusual or masquerading directories, such as C:\Windows\System32\EdgeResourcesInstallerV1-jth3\ .

Correlation is key: Link events across the chain. If you see an unusual file creation (like .js files) followed by an outbound network connection to a suspicious domain, it is a high-confidence indicator of compromise.

Analyze memory-resident logic: Attackers are increasingly using in-memory decryption (e.g., using AES-256-CBC) and execution (e.g., V8 bytecode loaders) to bypass disk-based antivirus. Focus your hunting on volatile artifacts and process memory when static file analysis is inconclusive.

Baseline your environment: Establish a clear baseline of expected PowerShell activity and approved binaries. Deviations from this baseline, such as unexpected use of Invoke-WebRequest combined with Invoke-Expression , should trigger immediate investigation.

Enforce hardening: Proactively restrict the attack surface by enforcing Constrained Language Mode for PowerShell, implementing application allowlisting (WDAC/AppLocker), and logging script block execution to gain critical visibility into "living-off-the-land" techniques.

Broad Axios npm Supply Chain Attack

Downloaded 100 million times weekly [ ] Axios is one of the most widely used JavaScript HTTP clients. Execution was observed in 3% of exposed environments before removal. Credential compromise should be assumed where execution occurred.

In late March 2026, two malicious versions of the Axios npm package (v1.14.1, v0.30.4) were published after a maintainer account was compromised. Both introduced a dependency on a newly created malicious package, plain-crypto-js , containing a dropper ( setup.js ) that fetched platform-specific second-stage payloads from sfrclak[.]com:8000, then self-deleted to reduce forensic footprint.

The attack began with the takeover of a maintainer account, which was used to publish the malicious packages. Once installed, a dropper downloaded cross-platform RAT payloads tailored for macOS (Mach-O), Windows (PowerShell with registry persistence), and Linux (Python). These payloads established a C2 beacon every 60 seconds to transmit system inventory and await further instructions. The malware's extensive capabilities include remote shell access, binary injection, directory browsing, process listing, and comprehensive system reconnaissance.

Supply chain compromise: Compromise software dependencies (T1195.001)

Compromised Axios npm package

Command/script interpreters (T1059)

Initial execution via JavaScript postinstall hook (node setup.js) Second-stage execution via a renamed copy of PowerShell interpreter (on Windows) Execution via osascript (macOs) Execution via Python (linux)

The macOS payload is named com.apple.act.mond to spoof Apple daemon naming conventions The Windows payload copies PowerShell and renames it to wt.exe to masquerade as the legitimate Windows Terminal C2 POST bodies mimic legitimate npm traffic (e.g., packages.npm.org/product0)

Indicator removal: File deletion (T1070.004)

Anti-forensic cleanup by deleting itself (setup.js), removing the malicious package.json, and replacing it with a clean stub (package.md) to erase evidence of the post-install hook

Ingress tool transfer (T1105)

Payload retrieval and execution via curl from: sfrclak[.]com -> 142[.]11.206.73

Application layer protocol: Web protocols (T1071.001) Non-standard port (T1571)

The RAT communicates with the attacker-controlled C2 server (sfrclak[.]com) using HTTP POST requests on port 8000.

Threat hunting process

This was an opportunistic hunt triggered by public threat intel reports.

Our hunting methodology involved:

Identifying key IOCs from public threat intel to conduct IOC-Sweep on Trellix telemetry The domain name and IP address of the C2 server were identified as high-confidence IOCs ( sfrclak[.]com -> 142[.]11.206.73 )

Identifying key IOCs from public threat intel to conduct IOC-Sweep on Trellix telemetry

The domain name and IP address of the C2 server were identified as high-confidence IOCs ( sfrclak[.]com -> 142[.]11.206.73 )

Identifying key TTPs from public threat intel to conduct TTP-based hunts on Trellix telemetry Execution of malicious payloads via JavaScript identified as cross-platform TTP Payload download via curl identified as cross-platform TTP Execution of renamed copies of PowerShell interpreter identified as TTP (Windows)

Identifying key TTPs from public threat intel to conduct TTP-based hunts on Trellix telemetry

Execution of malicious payloads via JavaScript identified as cross-platform TTP

Payload download via curl identified as cross-platform TTP

Execution of renamed copies of PowerShell interpreter identified as TTP (Windows)

Once potential victims were identified, deeper analysis to reconstruct the attack chain (which led to identifying additional TTPs). As part of the Trellix SecondSight hunting process, victims were notified.

Once potential victims were identified, deeper analysis to reconstruct the attack chain (which led to identifying additional TTPs).

As part of the Trellix SecondSight hunting process, victims were notified.

Remediation steps

Establish continuous SBOM-backed visibility and rapid containment protocols: Organizations must maintain real-time, environment-level software bills of materials (SBOMs) to comprehensively map component presence across developer workstations, production servers, and ephemeral workloads. In the event of a suspected supply chain compromise, security teams must be empowered to immediately isolate affected systems, flush local and regional package caches, and enforce rigorous blocking of known outbound command and control (C2) indicators at both the firewall and DNS layers.

Prioritize secret hygiene and rapid credential rotation: Any secrets present in an environment during a compromised installation window must be considered fully exposed. Security teams should immediately isolate affected devices and execute a systematic rotation of all accessible authentication tokens, including SSH keys, cloud provider credentials, database connection strings, and registry publishing tokens. To prevent re-compromise, this rotation must be performed exclusively from verified, secure systems.

Strengthen build integrity through deterministic pinning and gated execution: To eliminate the risk of automated pipelines silently ingesting poisoned dependencies, organizations must transition away from flexible semantic versioning (such as ^ or ~) for critical components. By enforcing exact version pinning and mandating deterministic installation commands—such as npm ci or --frozen-lockfile—security teams can ensure build consistency. Furthermore, restricting ad-hoc runtime commands like npx prevents the dynamic registry resolutions that often bypass project lockfiles, thereby securing the environment against unvetted code execution.

Implement release soak-times and strategic package cooldowns: Given that a vast majority of malicious registry packages are identified and purged by the security community within hours or days of publication, organizations should utilize package manager configurations to enforce a minimum release-age buffer (e.g., seven days). This "cooldown" period prevents development environments and automated pipelines from resolving bleeding-edge, unvetted updates, effectively establishing a critical time-delayed safety shield against nascent supply chain threats.

This npm Supply Chain Attack campaign offers several takeaways for threat-hunting teams.

Command/scripts interpreter binaries running from unexpected paths or running under unexpected file names are good candidates for hunting.

Remote payload execution involving Command/Script interpreters and utils like curl, wget, and certutil can help unveil all sorts of incidents.

Protecting Sensitive Data in the Age of AI

The Trellix SecondSight Advantage

Trellix built SecondSight on the principle that we cannot wait for perfect telemetry while an adversary is active. While security products are excellent at surfacing data, sophisticated attackers often hide in the noise of legitimate administrative activity. SecondSight bridges this gap by augmenting your SOC with elite human hunters who provide a "second set of eyes" over your environment.

The real-world incidents in this report highlight how adversaries are outmaneuvering defenders at scale. APT28 weaponized a new vulnerability within 24 hours of disclosure, an actor used self-cleaning droppers to mimic legitimate traffic in a supply chain compromise, and JSCeal hid inside a trusted runtime to defeat static detection entirely.

These incidents reflect a systematic effort by nation-state and financially motivated actors to study, anticipate, and circumvent the defenses organizations rely on most. AI has accelerated this effort, enabling adversaries to adapt tradecraft at machine speed. The volume of signals analysts now process has long exceeded what any human team can manage alone. This is the new baseline, and it demands a fundamentally different approach to cyber defense.

Threat actor playbooks are engineered to defeat conventional defenses: Every campaign in this report is deliberately engineered to slip through the gaps in conventional security controls: APT28 paired an N-day vulnerability with file-type obfuscation to bypass email filters; DarkSword used server-side fingerprinting to serve a clean PDF to scanners while reserving the iOS exploit chain for real targets; and the Axios supply chain compromise exploited the implicit trust organizations place in widely used open-source packages. Organizations continuing to rely on detection thresholds and signature-based controls as their primary line of defense will find those...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Trellix Reports on Five Evasive Cyber Campaigns in 2026 Trellix's SecondSight Threat Hunting Report details five significant cyber campaigns from the first half of 2026, including APT28 and the Axios npm supply chain attack. Attackers exploited trusted infrastructures and employed advanced evasion techniques, such as using compromised government accounts and weaponizing CVE-2026-21509. The APT28 spear-phishing campaign targeted European government and defense organizations, utilizing malicious emails that bypassed conventional detection methods. The report emphasizes the importance of combining AI and human intelligence in threat hunting, allowing for quicker detection and response to these sophisticated attacks. Trellix's findings highlight the ongoing challenges in cybersecurity as adversaries adapt their tactics to evade detection. 2 sources 77

Extracted Entities

SecondSight Threat Hunting Report September 2026

The full story

Extracted Entities

APT Groups (3)

Attack Types (2)

Campaigns (2)

Countries (1)

CVEs (7)

Domains (13)

Industries (2)

IP Addresses (2)

Malware (3)

MITRE ATT&CK (11)

Platforms (2)