Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
NSFOCUS Monthly APT Insights – April 2026
Threat Actors
Excerpt
Regional APT Threat Situation In April 2026, the global threat hunting system of Fuying Lab detected a total of 29 APT attack activities. These activities were primarily concentrated in regions including East Asia, South Asia, Eastern Europe, North America, and the Middle East, as shown in the figure below. Regarding the activity levels of different groups, the most active APT groups this month were Kimsuky, Lazarus, and Transparent Tribe, operating out of East Asia, while…
Read the original report →Diamond Model
Adversary(2)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-21509 | High | Score 79/100 | First seen |
| CVE | CVE-2026-21513 | Medium | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…