Trellix Reports on Five Evasive Cyber Campaigns in 2026

• •Trellix identified five major cyber campaigns in early 2026, including APT28 and Axios npm.
• •Attackers used sophisticated evasion techniques, exploiting trusted infrastructures and CVE-2026-21509.
• •The combination of AI and human intelligence is crucial for effective threat hunting and response.

Trellix's SecondSight Threat Hunting Report details five significant cyber campaigns from the first half of 2026, including APT28 and the Axios npm supply chain attack. Attackers exploited trusted infrastructures and employed advanced evasion techniques, such as using compromised government accounts and weaponizing CVE-2026-21509. The APT28 spear-phishing campaign targeted European government and defense organizations, utilizing malicious emails that bypassed conventional detection methods. The report emphasizes the importance of combining AI and human intelligence in threat hunting, allowing for quicker detection and response to these sophisticated attacks. Trellix's findings highlight the ongoing challenges in cybersecurity as adversaries adapt their tactics to evade detection.