Threat Intel Report - June 2026

Executive summary

June 2026 witnessed a continued shift in the global cyber threat landscape from disruptive ransomware toward data theft, cyber extortion, identity compromise, and software supply-chain attacks. Threat actors increasingly prioritized stealing sensitive data, cloud credentials, source code, intellectual property, and authentication tokens, using extortion to monetize intrusions without deploying encryption payloads.

Several financially motivated groups, including World Leaks, ShinyHunters, FulcrumSec, and TeamPCP, ran increasingly sophisticated attack chains against enterprise identity platforms, cloud services, developer ecosystems, and critical business applications. Supply-chain compromises affecting GitHub, npm, PyPI, CI/CD pipelines, and enterprise software vendors highlighted the growing risk of trusted third-party ecosystems.

Organizations also faced an elevated vulnerability landscape, with multiple actively exploited zero-days affecting enterprise VPNs, Windows, Cisco SD-WAN, the Linux kernel, cloud platforms, Microsoft Exchange, Chrome, and widely deployed open-source software. The shrinking time between disclosure and exploitation reinforces the need for rapid patching and continuous exposure monitoring.

Overall, modern adversaries are exploiting trusted identities, cloud infrastructure, and software supply chains rather than relying solely on endpoint malware. That calls for stronger identity security, secure software development practices, and proactive threat detection.

Global threat overview

Top 5 target sectors: finance, technology, government, healthcare, and education.

Top 5 risks: ransomware, vulnerability exploitation, data breach, DDoS, and supply chain.

The full report PDF includes a chart of the most active malware families.

Notable campaigns and events

World Leaks data extortion campaign

World Leaks is a cybercriminal operation that emerged in early 2025 after the Hunters International ransomware group rebranded. It operates as an Extortion-as-a-Service (EaaS) platform focused on large-scale data theft and extortion rather than file encryption. In June 2026, Tata Electronics confirmed a cybersecurity incident after World Leaks claimed it stole and published more than 200,000 files (about 630 GB) of engineering documents, manufacturing specifications, customer information, emails, and other proprietary data, allegedly including material related to Tata Electronics' customers. The incident reflects the growing trend of extortion-only attacks on global manufacturing and critical supply-chain organizations.

Threat actor: World Leaks (formerly Hunters International)

Target verticals: manufacturing, technology, healthcare, financial services, critical infrastructure, and government

ShinyHunters Oracle PeopleSoft supply-chain campaign

ShinyHunters (UNC6240) ran a large-scale campaign exploiting a critical Oracle PeopleSoft zero-day. Active between late May and early June 2026, it reportedly compromised more than 100 organizations across about 300 PeopleSoft instances, giving attackers access to steal data and extort victims. One notable victim, the National Association of Insurance Commissioners (NAIC), confirmed unauthorized access to its PeopleSoft environment after attackers allegedly exfiltrated about 3.1 TB of data, including regulatory filings, technical documentation, and cloud configuration files. The campaign shows the downstream impact of supply-chain compromises in enterprise ERP platforms.

Threat actor: ShinyHunters (UNC6240)

Target verticals: government, insurance, higher education, financial services, healthcare, and enterprises using Oracle PeopleSoft

Novo Nordisk cyber extortion campaign

The threat actor FulcrumSec was reported to have extorted Novo Nordisk. Initial access came from exposed Azure Container Registry (ACR) credentials embedded in a JavaScript bundle and a leaked GitHub personal access token (PAT). The attackers moved laterally across collaborative drug-discovery and research environments and exfiltrated more than 30 AI/ML models, 494 GB of cell microscopy images, 70 proprietary datasets and compound profiles, and about 11,500 pseudonymized patient records. They demanded a USD 25 million ransom, threatening to publish the data. The incident highlights the risk of credential exposure and extortion in healthcare and pharmaceutical organizations.

Threat actor: FulcrumSec

Target verticals: healthcare, pharmaceutical, biotechnology, life sciences, and research organizations

Attack technique: exposed cloud credentials and GitHub PATs were used to access Azure resources, then lateral movement to find and steal intellectual property, research data, and AI/ML assets, followed by extortion instead of ransomware.

QR code phishing (quishing) surge

QR code phishing surged in Q1 2026, with Microsoft reporting a 146% increase while blocking about 8.3 billion phishing emails. Attackers use QR codes in emails, PDFs, invoices, and collaboration platforms to send users to credential-harvesting pages that bypass traditional email security. Researchers also identified a campaign against the hospitality sector that impersonated Booking.com and used the ClickFix technique to trick users into running malicious PowerShell commands, leading to credential theft and malware deployment.

Threat actor: multiple cybercriminal groups

Target verticals: hospitality, financial services, government, healthcare, education, and enterprises

Kali365 device code phishing campaign

Kali365 is a Phishing-as-a-Service (PhaaS) toolkit that abuses the Microsoft OAuth device code authentication flow to compromise Microsoft 365 accounts without needing passwords. Victims are tricked into authorizing attacker-generated device codes through the legitimate Microsoft login page, which gives attackers access and refresh tokens for persistent access. The technique bypasses password protections, evades traditional phishing detection, and in some cases bypasses MFA. Access to Outlook, SharePoint, OneDrive, and Teams lasts until the tokens are revoked or expire.

Threat actor: multiple cybercriminal groups (Kali365 PhaaS operators)

Target verticals: government, financial services, healthcare, education, manufacturing, and enterprises using Microsoft 365

Charter Communications data breach

ShinyHunters was linked to a cyber extortion incident at Charter Communications. The attackers reportedly gained initial access through voice phishing (vishing) that compromised an employee's Microsoft Entra account, which gave them access to Salesforce. They claimed to have exfiltrated customer data for extortion. Charter confirmed the incident but stated that no sensitive personal information or CPNI was stolen. The attack shows the continued effectiveness of social engineering against enterprise identity and SaaS environments, in line with ShinyHunters' strategy of targeting single sign-on accounts.

• Threat actor: ShinyHunters
• Accounts affected (claimed): 4.9 million
• Data compromised: email addresses, names, job titles, physical addresses, and phone numbers

TeamPCP supply-chain campaign

TeamPCP (also tracked as UNC6780, PCPcat, Persy_PCP, ShellForce, CipherForce, and DeadCatx3) is running a highly coordinated, financially motivated supply-chain operation that weaponizes trusted developer tools to harvest credentials and distribute malware. Initiated in early 2026, it pivots across five major ecosystems, including GitHub, PyPI, and npm, to compromise CI/CD pipelines. It first targets widely used, implicitly trusted security tools to steal publishing tokens and poison downstream consumers.

The attack chain spans several weeks and many ecosystems: GitHub Actions, Docker Hub, npm, PyPI, OpenVSX, the VS Code Marketplace, and Jenkins. Impacted so far are Aqua's Trivy, Checkmarx KICS, LiteLLM, Bitwarden, TanStack, Mistral AI, AntV (323 packages), Microsoft DurableTask, GitHub (about 3,800 internal repositories), and Red Hat Cloud Services (32 packages), among others.

Zab26 healthcare data listing

A threat actor using the alias Zab26 is advertising for sale what they describe as a 533 GB "full-stack" healthcare dataset spanning French and European health systems. The listing claims 1.16 million files, including more than 534,000 protected-health-information documents, 479,877 Social Security numbers, over 115 million database rows, source code, private keys, and TLS certificates. It also claims live access to health systems, including a query interface to France's shared medical-record platform (DMP), Kubernetes clusters, Slack, and mail. The claim is unverified.

Kuwaiti national security agency database listing

A threat actor using the alias 0cx00iq listed for sale what they describe as a dataset of employees of Kuwait's domestic intelligence service. The listing is priced at around $3,500 (negotiable) with a heavily watermarked sample, and states the data is current as of June 2026. The dataset's authenticity and scope are unverified.

Lazarus Group (DPRK): continued global cyber operations

In June 2026, multiple reports highlighted the continued evolution of the Lazarus Group (also tracked as Hidden Cobra, Diamond Sleet, Zinc, and APT38). The North Korean actor expanded beyond financial theft into software supply-chain compromises, developer ecosystem abuse, cryptocurrency theft, and enterprise infiltration through phishing, trojanized software, malicious open-source packages, and credential theft. It remained highly active against cryptocurrency platforms, software vendors, financial institutions, and defense organizations.

Attack technique: spear-phishing, social engineering, supply-chain attacks, malicious software packages, credential theft, living-off-the-land techniques, cloud service abuse, and cryptocurrency theft. Recent campaigns increasingly target developer ecosystems, software repositories, and trusted third-party platforms. Malware observed includes BeaverTail, InvisibleFerret, Tropidoor, and LightlessCan, with Zoom-impersonation and fake-recruitment infrastructure.

FortiBleed: mass Fortinet credential harvesting

FortiBleed is a large-scale credential-harvesting campaign against internet-facing Fortinet FortiGate firewalls and SSL VPNs. Attackers harvested over 110 million credentials from about 430,000 devices, with 73,000 to 75,000 confirmed to have exposed or valid credentials. The stolen access has been linked to INC Ransom and Lynx ransomware operations, enabling unauthorized access, data theft, and ransomware deployment. The campaign mainly exploited previously compromised credentials, credential reuse, brute force, and weak passwords rather than a new FortiOS vulnerability.

Target verticals: government, critical infrastructure, financial services, healthcare, manufacturing, telecommunications, energy, defense, education, and enterprises using FortiGate firewalls or SSL VPN gateways

Whise CRM allegedly breached

A threat actor using the alias ChimeraZ posted what they describe as the database of Whise.eu, a European real-estate CRM used by agencies and agents. The leak is a roughly 15.8 GB JSON dataset of about 40.85 million lines, dominated by about 37.7 million email-sending logs plus several million contact records. Samples show names, email addresses, IP addresses, timestamps, phone numbers, marketing-consent flags, and property search criteria, spanning individuals in multiple European countries. The dataset's authenticity and scope are unverified.

Flawireless allegedly breached by 0xSec

The threat actor 0xSec claims to have leaked the database of Flawireless (Techy Extra), a US-based mobile accessories and refurbished electronics wholesaler. The dataset reportedly includes over 57,000 order records, invoices, shipments, product catalog data, and customer information such as names, addresses, email addresses, phone numbers, and payment metadata. No passwords or full payment card details were observed in the shared samples.

TA4922 expands financially motivated phishing

In June 2026, researchers reported that TA4922, a suspected Chinese-speaking financially motivated group, expanded beyond East Asia to target organizations across Europe, Africa, and other regions. It ran localized phishing campaigns impersonating tax, payroll, HR, invoicing, and regulatory services, and deployed Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos 4.0). The actors also abused legitimate platforms including LINE, WhatsApp, and Microsoft Teams to evade email security.

Threat actor: TA4922

Target verticals: government, financial services, manufacturing, technology, telecommunications, healthcare, retail, professional services, and enterprises

Cyber incidents amid the Iran-Israel and US context

Handala hacked California Water Service

Handala said the intrusion was retaliation for recent US actions in Iran and claimed it could disrupt water access but chose not to. The level of access has not been confirmed. The actor's blog suggests it likely compromised Cal Water's RTKBase instance (a GNSS base station platform) and moved laterally to a billing system. Cal Water, one of the largest investor-owned water utilities in the US with roughly two million customers, confirmed its Chico District as the victim. Leaked data suggests access to a customer billing database and the internal RTKBase application. The company assesses the RTKBase network as the probable initial access vector or pivot point.

LA Metro cyberattack linked to Iranian state-sponsored hackers

The Los Angeles County Metropolitan Transportation Authority (LA Metro) discovered a breach in mid-March that disrupted internal operations. The pro-Iranian group Ababil of Minab claimed responsibility through its Telegram channel and website, publishing a video and screenshots purporting to show access to live internal systems. LA Metro had not publicly confirmed or denied the breach at the time of writing.

Claimed access

• VMware vCenter Server: administrative access to a virtualization platform managing about 1,421 VMs, 28 hosts, 7.79 TB of RAM, and 45 TB of storage. Compromise could enable mass VM disruption, ransomware deployment, and persistent infrastructure-wide access.
• Microsoft IIS web server: administrator access to servers hosting internal and public-facing applications, including SSO services. This could enable defacement, credential theft, and lateral movement.
• Rail yard management / train control: access to a live operational technology (OT) system showing real-time rail yard operations. Compromise could affect operational safety and trigger critical-infrastructure reporting requirements.

UAE Cyber Security Council foils attacks on the financial sector

The UAE Cyber Security Council announced that the national cybersecurity system detected and thwarted a series of sophisticated attacks on multiple organizations in the financial sector, preventing disruption to financial services. No threat actor, victim organizations, CVEs, or indicators were disclosed.

Attack vectors reported

• Attempts to compromise digital systems and critical technology infrastructure supporting financial institutions, detected and contained before service availability was affected.
• Advanced phishing campaigns to harvest credentials and gain initial access.
• Exploitation of known vulnerabilities in exposed systems and services.
• Attempts to deploy malware after intrusion, consistent with persistence, credential theft, or disruption goals.
• Use of artificial intelligence to develop more sophisticated attack methods and automate parts of phishing campaigns.

Vulnerability and exploit intelligence

Enterprise network and infrastructure

Identity and cloud platforms

Microsoft Windows (June 2026)

Open source and enterprise applications

MITRE ATT&CK mapping

Recommendations

Cloud and identity security

• Enforce phishing-resistant multi-factor authentication across all privileged and remote access accounts.
• Apply privileged access management (PAM) with just-in-time administrative access.
• Rotate exposed API keys, GitHub personal access tokens, service accounts, and cloud credentials immediately upon exposure.
• Enforce least-privilege access across CI/CD pipelines and software repositories.
• Check package repositories for typo-squatting and dependency confusion attacks.

Ransomware readiness

• Implement application allowlisting and EDR to detect and block ransomware execution, privilege escalation, and lateral movement.
• Segment critical systems and backup infrastructure from user networks.
• Test recovery procedures periodically.

Email and user protection

• Deploy advanced email security that detects phishing, malicious attachments, and impersonation.
• Block unsigned PowerShell scripts and restrict Office macros where possible.
• Run recurring awareness training on phishing, vishing, QR-code scams, device code phishing, and ClickFix.

Vulnerability management

• Prioritize remediation of internet-facing assets affected by actively exploited vulnerabilities.
• Continuously scan external attack surfaces for exposed VPNs, firewalls, cloud applications, and management interfaces.
• Use risk-based prioritization focused on Known Exploited Vulnerabilities (KEVs).

Appendix

Threat actors observed

Malware families observed

Indicators of compromise (IP addresses, domains, URLs, file paths, and hashes) for the World Leaks, ShinyHunters, FulcrumSec, TeamPCP, and Lazarus Group campaigns are in the downloadable PDF.

Methodology

Collection period

June 2026

Data source

Prepared by the EnCyb Threat Intelligence team as a monthly overview of significant incidents, threat actor activity, and security developments, with a focus on events linked to geopolitical tension and emerging threats. The source report is marked TLP:GREEN.

Limitations

Many incidents are based on threat-actor claims published on leak sites or dark web forums, or on media reports, and several remain unverified or unconfirmed by the affected organizations. Attribution is as reported and may change.

Frequently asked questions

Which threat actors were most active in June 2026?

Financially motivated groups led the month: World Leaks, ShinyHunters, FulcrumSec, and TeamPCP. The Lazarus Group (DPRK), the TA4922 phishing group, and the pro-Iranian groups Handala and Ababil of Minab were also observed.

Which sectors were targeted most in June 2026?

The top five targeted sectors were finance, technology, government, healthcare, and education.

What are the most important defensive actions from this report?

Enforce phishing-resistant MFA and just-in-time privileged access, rotate exposed API keys and personal access tokens immediately, lock down CI/CD and package dependencies, patch actively exploited internet-facing assets first, and train users on vishing, QR-code scams, device code phishing, and ClickFix.