Skip to main content

Spring 2026 Threat Landscape: Threat Actors, Supply Chain & CI/CD Risk

· 14 min read
Deirdre Hennigar
Deirdre Hennigar
Nerd-o

Spring 2026 Threat Landscape Abstract​

Nation-state actors and financially motivated groups continue to converge in tactics, with increasing emphasis on identity abuse, supply chain compromise, and infrastructure-level access.

Rather than relying solely on malware, many threat actors are shifting toward abusing legitimate access, trusted relationships, and existing enterprise tooling.

Top Risks Observed This Month​

Identity compromise (OAuth / valid accounts)

Abuse of OAuth consent flows and stolen credentials to maintain persistent access.

Focus: sign-in logs, token usage, conditional access signals

Supply chain compromise (CI/CD + dependencies)

Malicious or manipulated dependencies and pipeline injection attacks.

Focus: dependency monitoring, build-time egress controls

Exposed ICS / OT systems

Internet-facing industrial systems targeted via weak authentication and exposed protocols.

Focus: eliminate exposure, monitor ICS protocol traffic

Credential reuse across environments

Shared credentials enabling lateral movement across systems and environments.

Focus: enforce MFA, isolate dev/prod identity boundaries

Limited east-west visibility

Lack of internal network monitoring enabling undetected lateral movement.

Focus: internal traffic analytics, anomaly detection

Threat Actors Driving Activity​

Iranian-Aligned Activity​

THREAT DOSSIER

Iranian-affiliated actors were observed exploiting internet-facing PLCs and OT management tooling with a focus on energy and water sectors. Vendor and government advisories during March–April 2026 describe exploitation of Rockwell/Allen-Bradley controllers, use of legitimate engineering tools and valid credentials, and VPS-based ingress to obscure operator sessions.

Primary Targets
  • Energy and water sector operators
  • Industrial control and SCADA-adjacent environments
Primary Access
  • Exposed PLCs
  • Engineering workstations
  • Remote management paths
  • Externally exposed OT access points
Primary EffectDisruption and operational interference
Technical Signals
Ports
502 / Modbus44818 / EtherNet-IP1022222
MITRE Techniques Observed
T0886T0814T0809T0866T1078
Further Reading
GovernmentAA26-097A — CISA AdvisoryICS targeting activity and mitigation guidanceReportingCybersecurity DiveWater and energy sector targeting (Apr 2026)Vendor ResearchTenable ResearchCyberAv3ngers / controller auth bypass analysisVendor ResearchUnit 42Boggy Serpens and related Iranian-aligned activity

North Korea-Aligned Activity​

THREAT DOSSIER

North Korean actors continue to blend financially motivated operations with espionage, increasingly relying on credential theft, OAuth consent abuse, and identity-based persistence rather than noisy malware.

Primary Targets
  • Cryptocurrency services & exchanges
  • Financial institutions and payment processors
  • Third-party contractors with privileged access
Primary Access
  • Spearphishing & credential phishing
  • OAuth consent/third-party app abuse
  • Stolen or purchased credential sets
Primary EffectFund diversion, long-term access, and operational footholds
Operational Focus

Rapid credential harvesting followed by account takeover and token persistence. Use of obfuscated tooling to move funds and maintain access without triggering obvious alarms.

MITRE Techniques Observed
T1566.002T1550.001T1059.007T1087T1046
Further Reading
ReportingChainalysisOFAC & North Korean crypto worker enforcementReportingSC WorldDrift Protocol incident

China-Aligned Activity​

THREAT DOSSIER

China-aligned groups continue to prioritize stealth, persistence, and targeted espionage against government, defense, and strategic industry targets. Emphasis remains on minimizing operational noise and maintaining access.

Primary Targets
  • Government & defense contractors
  • Telecommunications and critical infrastructure
  • High-value enterprise IP repositories
Primary Access
  • Supply chain compromise
  • Credential harvesting & lateral movement
  • Custom backdoors & firmware-level persistence
Primary EffectIntelligence collection, long-term data exfiltration
Operational Focus

Long-term access and low-noise espionage: prioritizing firmware/backdoor persistence, stealthy lateral movement, and exfiltration of high-value data over time.

MITRE Techniques Observed
T1542T1003T1021T1040
Further Reading
ReportingCyberNewsTA416 targeting (example)Vendor ResearchUnit 42Espionage campaign analysis

Supply Chain Attacks​

THREAT DOSSIER

Supply chain compromise persists as a high-impact vector, leveraging build pipelines, dependencies, and vendor trust relationships to spread malicious code/backdoors into dependent systems.

Primary Targets
  • CI/CD pipelines and build infrastructure
  • Open-source package ecosystems
  • Third-party integrations and vendor tooling
Primary Access
  • Compromised build secrets
  • Malicious dependency updates
  • Compromised vendor accounts
Primary EffectWidespread code injection, stealthy persistence, and rapid downstream compromise
Behavior

Malicious code introduced through dependency updates, obfuscated post-install scripts, or unauthorized build step injection.

MITRE Techniques Observed
T1195.002T1059.007T1552

CI/CD Pipeline Compromise​

THREAT DOSSIER

Attackers target CI/CD pipelines to insert malicious build steps, exfiltrate secrets, or cause tainted artifacts to be produced at scale.

Primary Targets
  • Build servers and artifact repositories
  • Deployment orchestration systems
  • Secrets management back-ends
Primary Access
  • Compromised deploy keys
  • Misconfigured runners with wide privileges
  • Leaked pipeline variables and tokens
Primary EffectTainted builds, secret exfiltration, and mass compromise of downstream consumers
Behavior

Injection of unauthorized build steps, unauthorized artifact signing, and exfiltration of secrets from pipeline environments.

MITRE Techniques Observed
T1552.001T1530T1574.002

Observations & Conclusions​

Spring 2026 reinforces a continued shift toward identity-driven attacks, infrastructure-level compromise, and scalable supply chain exploitation.

Iran-focused groups emphasize disruption of critical infrastructure, North Korean actors blend financial operations with identity abuse, and China-aligned groups prioritize stealth and persistent espionage.

Top defensive takeaways
  • Prioritize identity hygiene: MFA, conditional access, OAuth application controls
  • Eliminate internet-facing OT protocols and enforce segmentation
  • Harden CI/CD pipelines and rotate build secrets
  • Increase east-west visibility and baseline normal internal flows (especially engineering/development)

References​

  • Cybersecurity and Infrastructure Security Agency (CISA). (2026). AA26-097A: IRGC-Affiliated Cyber Actors Exploit Internet-Facing PLCs in Water and Wastewater Systems. cisa.gov.
  • Cybersecurity Dive. (2026). Iran-linked hackers targeting water, energy in US, FBI and CISA warn. cybersecuritydive.com.
  • Tenable Research. (2026). What to Know About CyberAv3ngers, the IRGC-Linked Group Targeting Critical Infrastructure. tenable.com.
  • Unit 42, Palo Alto Networks. (2026). Boggy Serpens Threat Assessment. paloaltonetworks.com.
  • Chainalysis. (2026). OFAC Targets North Korean IT Workers and Cryptocurrency Networks. chainalysis.com.
  • SC World. (2026). Drift Protocol crypto heist pinned on North Korean APT. scworld.com.
  • CyberNews. (2026). Chinese spy group TA416 targets Europe, NATO. cybernews.com.
  • Unit 42, Palo Alto Networks. (2026). Playbook of espionage campaigns against military targets. paloaltonetworks.com.