Threat Intel Report - May 2026

Executive summary

May 2026 witnessed a significant escalation in global cyber threat activity, characterized by large-scale data breaches, ransomware operations, supply-chain compromises, state-sponsored espionage campaigns, and cyber activities linked to ongoing geopolitical tensions in the Middle East.

The reporting period was dominated by ShinyHunters, which claimed responsibility for multiple high-profile data breaches affecting educational institutions, 7-Eleven, Udemy, and several global brands. Advanced persistent threat (APT) groups linked to Iran and China demonstrated sophisticated cyber-espionage capabilities through campaigns involving Showboat (EvaRAT), Dindoor, Fakeset, MiniUpdate, and MiniJunk V2 malware families.

Global threat overview

Top 5 target sectors: technology, finance, government, healthcare, and defense.

Top 5 risks: data breach, DDoS, ransomware, supply chain, and vulnerability exploitation.

The full report PDF includes charts for the top target countries and the most active malware families.

Notable events

The Canvas platform mass breach

A massive data breach reportedly impacted nearly 9,000 educational institutions worldwide, including top-tier universities such as Stanford, Harvard, UC Berkeley, and the National University of Singapore. The threat actors claim to have compromised 3.5 terabytes of data belonging to roughly 275 million students and staff.

Threat actor: ShinyHunters

ShinyHunters allege they stole names, email addresses, student IDs, and billions of private messages. They gave Instructure and affected schools until May 12 to negotiate payment or face public leaks. Instructure disputes the scope; if confirmed, the breach would be one of the largest education-related data thefts on record.

WantToCry remote encryption attacks

Malware: WantToCry ransomware

Researchers observed a surge in a new ransomware strain, dubbed WantToCry as a nod to WannaCry. It aggressively targets exposed Server Message Block (SMB) services through brute-force attacks.

Evasion tactic: it runs without executing malware locally. Instead, it exfiltrates data to attacker-controlled infrastructure and remotely encrypts and rewrites the files back onto the victim's disk, which minimizes the Endpoint Detection and Response (EDR) footprint.

"Showboat" Linux telecom espionage framework

A long-running, targeted espionage campaign deploys a newly uncovered Linux post-exploitation framework called Showboat, also tracked as EvaRAT. It is attributed to Chinese state-aligned actors, specifically Calypso (also tracked as Red Lamassu or Bronze Medley), and targets telecommunications providers and internet service providers across the Middle East and Central Asia. The backdoor spawns remote interactive shells and sets up internal SOCKS5 proxies to enumerate, compromise, and map target local area networks.

Threat actor: Calypso (Red Lamassu / Bronze Medley)

Target verticals: telecommunications, internet service providers, and critical infrastructure (Middle East and Central Asia)

Evasion tactic: the framework keeps malicious staging inside internal network perimeters and proxies traffic through interior infrastructure rather than making suspicious outbound connections. On compromised Linux nodes it creates process wrappers that masquerade as legitimate system threads (such as kworker) and fetches obfuscated configuration from public clipboard services such as Pastebin, allowing long-term persistence with a small footprint.

The GitHub internal repositories supply-chain breach

GitHub confirmed unauthorized access to and exfiltration of roughly 3,800 internal private repositories containing platform source code, infrastructure configurations, and internal API schemas. The breach is attributed to TeamPCP (tracked by Google Threat Intelligence as UNC6780), a financially motivated group specializing in open-source developer tooling and AI middleware. It did not exploit a perimeter vulnerability. It targeted developer identity through a chain of upstream software supply-chain infections.

Threat actor: TeamPCP (UNC6780)

Target verticals: code hosting platforms, open-source tooling, developer identity, and enterprise CI/CD ecosystems

Evasion tactic: the attack weaponized trusted extension ecosystems and default auto-update behavior. The actor compromised a developer system at Narwhal Technologies through a separate supply-chain attack on the TanStack library and scraped a GitHub personal access token. It then used that token to publish a poisoned release of Nx Console (version 18.95.0), a Visual Studio Code extension with over 2.2 million installs.

The backdoored extension was live for only 18 minutes, but it automatically pushed a minified 2,777-byte script to online developer endpoints, including a GitHub employee workstation. The payload ran entirely in memory and downloaded an obfuscated dropper from an orphaned commit on the official nrwl/nx repository, evading local EDR agents. It harvested developer credentials, cloud identities (AWS, Azure, GCP), and corporate tokens, and used them to pivot into GitHub's internal source code estate.

Spanish public-sector payroll portal access

A threat actor using the alias kr0x6 claims to hold live access to an administrative portal of an unnamed Spanish public-management entity. The access reportedly covers 371 accounts where employee bank details for payroll deposits can be modified. The seller says the affected April payrolls total roughly 962,246 and claims to have held access for around two months.

The Gentlemen ransomware (Storm-2697)

"The Gentlemen" is a ransomware-as-a-service (RaaS) operation tracked as Storm-2697. The group built a Go-based encryptor that both encrypts files with strong encryption and propagates rapidly across compromised environments. It follows a double-extortion model: data is exfiltrated before encryption and later used as leverage in ransom negotiations.

Key activities observed

• A self-propagating encryptor able to spread across networked systems after initial compromise.
• Multiple lateral-movement techniques: remote administration tools, WMI, scheduled tasks, PowerShell remoting, and service-based execution.
• Strong per-file encryption that makes unauthorized recovery highly difficult.
• Data exfiltration before ransomware deployment to support double extortion.
• Attempts to disable or evade endpoint security controls and antivirus.
• Deletion of shadow copies and recovery artifacts, and clearing of Windows event logs and other forensic evidence.
• Targeting of Windows-based enterprise environments and network shares to maximize impact.
• An affiliate-driven model, letting multiple actors run campaigns under the service, and the ability to scale quickly once privileged access is obtained.

7-Eleven data breach claimed by ShinyHunters

7-Eleven disclosed a cyber incident involving unauthorized access to systems used to store franchise-related documents. The company identified the compromise in April 2026 and launched an investigation. ShinyHunters claimed responsibility, alleging it compromised the organization's Salesforce environment and exfiltrated a large volume of corporate and personally identifiable information (PII). After failed ransom negotiations, the group reportedly published part of the stolen data on its leak site.

Key activities observed

• Unauthorized access was reportedly obtained on 8 April 2026, affecting systems that stored franchisee documentation.
• ShinyHunters claimed responsibility on 17 April 2026 and alleged the theft of more than 600,000 records.
• After failed extortion negotiations, a 9.4 GB archive of allegedly stolen data was leaked on a dark web platform.
• 7-Eleven issued breach notifications and began an internal investigation. The exact number of affected individuals and the full categories of exposed data have not been disclosed.
• The incident aligns with ongoing ShinyHunters activity targeting organizations through Salesforce-related compromises.

Udemy: alleged data breach claim by ShinyHunters

On 24 April 2026, ShinyHunters claimed to have compromised Udemy, alleging it obtained more than 1.4 million records containing PII and internal corporate data. The claim was posted on the group's dark web leak site with an extortion demand and a deadline of 27 April 2026 to make contact before the data would be released. The group also warned of additional disruptive activity if its demands were not met. As of the reporting period, Udemy had not publicly confirmed the breach and the claims remained unverified.

The group also dumped data tied to Mytheresa, Zara, Carnival, and 7-Eleven in a fresh leak wave. ShinyHunters is linked to major cybercrime campaigns, such as last year's Salesforce CRM data theft that targeted enterprise cloud services and customer databases.

Cyber incidents amid the Iran-Israel context

Dindoor and Fakeset backdoor frameworks

A targeted espionage surge by the Iran-nexus APT group Seedworm (a sub-cluster of MuddyWater, also tracked as Mango Sandstorm or Static Kitten) was observed. Acting as an intelligence-gathering arm for Iran's Ministry of Intelligence and Security (MOIS), the group ran focused campaigns to establish long-term persistence across banking, aviation, defense, and software supply-chain infrastructure. The campaign uses a new custom toolkit with two backdoors: Dindoor, a remote access trojan, and Fakeset, a Python-based backdoor.

Threat actor: Seedworm (MuddyWater / MOIS sub-cluster)

Target verticals: aviation and airports, financial services, defense and aerospace, and technology operations (US, Middle East, Israel)

Evasion tactic: the group moved from noisy host-based manipulation to abusing specialized runtimes and signed dual-use utilities. Dindoor uses the Deno JavaScript/TypeScript runtime to run obfuscated, Base64-encoded scripts in memory, hiding its logic from file-based signature scanners. Fakeset is dropped through malicious installer packages hosted on legitimate Backblaze storage buckets, using stolen but valid code-signing certificates to look like trusted applications.

In one observed interaction, the attacker reached the user through Microsoft Teams and convinced them to run an installer named update_ms.msi, disguised as a Windows update, which dropped Dindoor.

Cloud evasion and exfiltration: instead of custom exfiltration scripts, the actor uses Rclone, a legitimate command-line cloud management tool, to compress and sync stolen files, databases, and configuration directories into commercial Wasabi S3 and Backblaze buckets. This traffic blends in with routine administrative cloud syncs and evades perimeter anomaly detection.

Handala and IRGC target Fujairah

The Handala Hack Team claimed responsibility for a cyberattack on the Port of Fujairah in the UAE, alleging it compromised the port's infrastructure and exfiltrated more than 430,000 confidential documents.

Claims and activity observed

• Unauthorized access to systems associated with the Port of Fujairah.
• Theft of shipping and traffic data, financial records, contracts, and maps of oil pipeline infrastructure.
• Coordination between cyber operations and missile strike activity targeting the port.
• Public threats of continued cyber and intelligence operations against UAE entities, and use of the incident for propaganda and psychological messaging.

Operation Persistent Serpens

Researchers observed a new espionage campaign deploying the MiniUpdate and MiniJunk V2 RAT families, run by the Iran-nexus group Screening Serpens (UNC1549, Smoke Sandstorm, or Nimbus Manticore). It targets aerospace, defense manufacturing, and telecommunications in the United States, Israel, and the United Arab Emirates through tailored social engineering: spear-phishing lures and fake software updates that use DLL sideloading. To improve resilience, the actor routes command and control through three to five unique subdomains on legitimate Azure infrastructure for each target and variant.

Threat actor: Screening Serpens

Target verticals: aerospace, defense, telecom, and technology providers (Middle East and US)

Evasion tactic: AppDomainManager hijacking. Rather than relying on executables that flag security software, the actor uses legitimate configuration files to manipulate how trusted .NET applications initialize. This instructs the runtime to disable the application's own protections, such as Event Tracing for Windows (ETW) and strong-name signature validation, so the embedded RATs run silently in memory with a minimal EDR footprint.

BadeSaba Calendar application compromise

An information operation was reportedly carried out through the BadeSaba Calendar app, one of Iran's most widely used prayer and calendar apps. According to media reports, its push notification service was compromised and used to send messages encouraging Iranian security personnel to distance themselves from the government, shortly after military strikes on Iranian leadership and strategic assets.

• Messages reached millions of users through a highly trusted app with regular daily engagement.
• Multiple outlets attributed the activity to Israel or an Israel-aligned entity, but no public technical evidence or official attribution has been released.
• Iranian authorities reportedly restricted or throttled internet connectivity in affected regions and described the incident as foreign psychological warfare.

The incident shows how trusted consumer applications can be used to deliver influence operations at scale, extending geopolitical conflict into the digital domain.

Vulnerability and exploit intelligence

Enterprise edge infrastructure and networking

Directory services and identity platforms

Core operating system components

SaaS and shared hosting web assets

Adversary-in-the-middle (AiTM) attacks on cloud identity

AiTM is a high-priority, tactic-based threat rather than a single CVE. Proxy-phishing engines intercept valid session cookies and SAML tokens, letting attackers copy an active session to their own machine. This bypasses traditional multi-factor authentication and gives access to Microsoft 365 or Entra ID, compromise of corporate directories, and automated business email compromise (BEC).

Recommendations

Cloud and identity security

• Enforce phishing-resistant MFA across critical systems.
• Monitor and periodically rotate privileged credentials.
• Restrict personal access token (PAT) use in development environments.
• Run vulnerability assessments and validation scans to find exposed services and misconfigurations.
• Review cloud storage activity for unusual uploads, synchronization, or bulk data transfers.

Ransomware readiness

• Maintain backups and test recovery procedures periodically.
• Segment critical assets from user networks.

Email and social engineering protection

• Strengthen email security controls to identify and block phishing, spear-phishing, and malicious attachments.
• Run user awareness exercises on fake software updates, Microsoft Teams impersonation, credential harvesting, and BEC attempts.

Vulnerability management

• Prioritize remediation of the latest vulnerabilities.
• Verify that internet-facing assets are fully patched and periodically validated.

Appendix

Threat actors observed

Malware families observed

Indicators of compromise (file hashes, IP addresses, domains, and URLs) for the Showboat, GitHub, Dindoor and Fakeset, and Persistent Serpens campaigns, along with the MITRE ATT&CK / TTP mapping, are in the downloadable PDF.

Methodology

Collection period

May 2026

Data source

Prepared by the EnCyb Threat Intelligence team as a monthly overview of significant incidents, threat actor activity, and security developments, with a focus on events linked to geopolitical tension and emerging threats. The source report is marked TLP:GREEN.

Limitations

Many incidents are based on threat-actor claims published on leak sites or on media reports, and several remain unconfirmed by the affected organizations. Attribution is as reported and may change.

Frequently asked questions

Which threat actors were most active in May 2026?

ShinyHunters dominated the month, claiming multiple high-profile data breaches. Iran-nexus groups (Seedworm/MuddyWater and Screening Serpens), the China-aligned Calypso group, the supply-chain group TeamPCP, the hacktivist group Handala, and the Gentlemen ransomware-as-a-service operation were also observed.

Which sectors were targeted most in May 2026?

The top five targeted sectors were technology, finance, government, healthcare, and defense.

What are the most important defensive actions from this report?

Enforce phishing-resistant MFA, restrict and rotate privileged credentials and personal access tokens, maintain and test backups, segment critical assets, train users on fake software updates and Microsoft Teams impersonation, and prioritize patching of internet-facing assets.