Weekly Threat Advisory: APT Storm — 25 Clusters Active, Polymorphic Loader Surge, ICS/OT Threat Surface (Jul 20-26, 2026)

APT storm week. 25 attributed APT clusters ran in parallel — the widest concurrent APT footprint observed in this catalogue year-to-date. Two loader families produced ~15,000 unique hashes combined in seven days — a polymorphic-build-farm signal that defeats hash-based defence at industrial scale. DPRK-adjacent activity double-tracked (cryptocurrency-focused APT + IT-worker infiltration campaign). Russian-aligned clusters concurrent with Middle East / North Africa regional operations. A rare and consequential signal — an ICS/OT PLC-targeted exploitation campaign across three concentrated subnet anchors targeting industrial control systems. A novel delivery vector — SVG-embedded script payloads that bypass traditional attachment scanners. If your CTI team was quiet this week, this briefing is your priority reading list.

Sectioned for the working analyst: aggregate volumes, cluster-category footprint, ATT&CK tactic-pressure roll-up, subnet anchors, top IOCs per indicator type, four production-ready Sigma rules, and a 60-minute operationalisation plan. Vendor-neutral. Operator-grade. Archive of prior advisories.

01 · This week in numbers

The catalogue produced 77,118 unique IOCs across 155 clusters this cycle. Framework-infrastructure entries dominate the topline volume, but the narrow-indicator layer is the intelligence story: 3,374 unique domains + 16,316 unique hashes + 503 URLs. The hash volume alone (16,316) is the second-highest weekly count observed in this catalogue year-to-date — driven by two loader families running at industrial-scale polymorphic-build volume (~15,000 combined hashes). Every APT category is elevated: 25 attributed APT clusters concurrent is the widest APT footprint of the year.

02 · Five headlines — what defined this cycle

Headline 01 · APT Storm — 25 attributed clusters concurrent

Twenty-five attributed APT clusters produced fresh indicators this cycle — the widest concurrent APT footprint in the year-to-date window. The APT-category IOC total: 8,291 records across 25 attributed clusters. Cluster diversity spans DPRK-adjacent activity, Russian-aligned operations, Middle East / North Africa regional operations, multiple tracked cluster groups, and proxy-focused intrusion sets. Concurrent APT activity at this scale is a load-bearing intelligence signal — organisations in strategic-vertical environments (research, government-adjacent, critical infrastructure, cryptocurrency-adjacent) should prioritise indicator ingestion this week.

Headline 02 · Polymorphic loader surge — ~15,000 hashes in 7 days

Two loader families produced ~15,000 unique HASH indicators combined in seven days — the largest loader-tier hash footprint of the year. Volume at that scale from a small number of families indicates a polymorphic build pipeline actively producing many binary variants per target — a defensive-evasion strategy that defeats hash-based endpoint content as fast as it can be updated. The operational implication: hash-blocking is fragile against this volume. Behavioural loader detection is the durable defence layer (Sigma 01 below).

Headline 03 · ICS/OT threat surface — PLC-targeted campaign with 3 subnet anchors

A rare and operationally significant signal. A PLC-targeted exploitation campaign produced 26 IOCs across DOMAIN + HASH + IP with three concentrated subnet anchors (185.82.73.0/24 with 8 IPs, 175.110.121.0/24 with 4 IPs, 88.80.150.0/24 with 3 IPs — 15 IPs across 3 blocks). The cluster targets industrial control systems, not enterprise IT. Utilities, manufacturing, and critical-infrastructure operators are the primary victim profile. ICS ATT&CK techniques observed: T0819 exploit of internet-accessible device, T0866 unauthorised command execution, T0836 modify parameter, T0885 commonly-used-port abuse. If your organisation operates any OT/ICS environment, this cluster warrants immediate attention.

Headline 04 · DPRK-adjacent double-track — cryptocurrency-focus + IT-worker infiltration

Two DPRK-adjacent operations active in parallel. A cryptocurrency-focused APT cluster (83 IOCs across DOMAIN + HASH + IP) uses a distinctive collaboration-platform-impersonation domain-naming pattern with a subnet anchor at 45.61.163.0/24. Targets cryptocurrency-adjacent audiences. Separately, an IT-worker infiltration campaign (64 IOCs across all 4 primary IOC types) sees DPRK-linked operatives applying to remote-work positions using fabricated identities to gain insider access. This IT-worker campaign is a HR-workflow threat, not primarily an endpoint threat — detection requires identity-verification and hiring-workflow controls, not detection content.

Headline 05 · Novel delivery vector — SVG-embedded scripts

An SVG-embedded script delivery campaign produced 25 IOCs across DOMAIN + HASH. Delivery pattern: attackers embed JavaScript payloads inside SVG image files. When the SVG is rendered in a browser (as an inline image, email attachment preview, or website asset), the embedded script executes. Bypasses many email attachment scanners that do not treat SVG as executable-adjacent. Combined with a concurrent drive-by fake-update malware campaign (143 IOCs), this cycle shows a broader shift toward browser-rendering-time payload delivery. Defensive answer: content-inspection of SVG files at the mail-gateway and web-proxy layers.

03 · Indicator type, severity, and category mix

The narrow-indicator layer is the intelligence story this week: 16,316 unique HASH indicators is the highest hash-share observed year-to-date at 21 percent (driven by polymorphic loader builds). Domain volume at 3,374 is also elevated. Severity distribution shows 27 percent HIGH (20,804 records) — well above the year-to-date baseline. APT category at 8,291 IOCs (11 percent share) is the highest APT concentration of the year.

By indicator type

By severity

By category

04 · Cluster footprint — ranked by unique-IOC count

36 clusters ranked by unique IOC footprint. Framework-infrastructure entries in grey to preserve visual clarity of the campaign-attributed clusters. All names generalised into category descriptors.

05 · Themed deep-dives

05.1 · Polymorphic loader surge — ~15,000 hashes across two families

Two loader families dominated the weekly hash footprint. The larger of the two (7,848 unique HASH indicators) and its counterpart (7,115 unique HASH indicators) together produced ~15,000 unique binaries in seven days. Volume at that scale from a small number of families indicates a polymorphic build pipeline actively producing many binary variants per target — a defensive-evasion strategy that defeats hash-based endpoint content as fast as it can be updated.

Defensive actions: Push the catalogued hashes to endpoint quarantine as a baseline. But the durable defence layer is behavioural loader detection — process-tree anomalies, parent-child spawn patterns, network-flow shapes after execution. Deploy Sigma rule 01 below (universal loader-behaviour detector) as the primary defence.

05.2 · DPRK-adjacent double-track

Cryptocurrency-focused APT cluster (83 IOCs) uses a distinctive domain-naming pattern impersonating collaboration-platform video-call URLs to lure victims into clicking fake “join meeting” links. Subnet anchor at 45.61.163.0/24. Targets cryptocurrency-adjacent audiences.

IT-worker infiltration campaign (64 IOCs across all 4 primary IOC types) sees DPRK-linked operatives applying to remote-work positions using fabricated identities to gain insider access. This is not primarily an endpoint threat; it is a HR-workflow threat. The operator wins by getting hired, not by exploiting a technical vulnerability. Detection requires identity-verification and hiring-workflow controls, not detection content.

Defensive actions: Block the subnet anchor. Alert users in cryptocurrency-adjacent roles specifically. For hiring workflows: video-verify interviews (not chat-only), verify education and employment claims independently, cross-check identity documents against second-source records, flag applicants using VPN or unusual geolocation during interviews.

05.3 · ICS/OT PLC-targeted exploitation campaign — 3 subnet anchors

The rare-and-significant signal. 26 IOCs across DOMAIN + HASH + IP with three concentrated subnet anchors:

• 185.82.73.0/24 — 8 IPs concentrated
• 175.110.121.0/24 — 4 IPs concentrated
• 88.80.150.0/24 — 3 IPs concentrated

15 IPs across 3 blocks targeting industrial control systems. ICS ATT&CK techniques observed: T0819 exploit of internet-accessible device, T0866 unauthorised command execution, T0836 modify parameter, T0885 commonly-used-port abuse. Utilities, manufacturing, energy, and critical-infrastructure operators are the primary victim profile.

Defensive actions: If your organisation operates any OT/ICS environment: block all three /24 anchors at the perimeter now. Verify no internet-accessible PLCs in your environment. Alert on any modbus / EtherNet-IP / DNP3 / Profinet traffic from unfamiliar external sources.

05.4 · Browser-render-time delivery — SVG scripts + drive-by fake-update

Two campaigns point at the same shift — adversaries increasingly delivering payloads via browser-render-time execution rather than direct file execution. The drive-by fake-update campaign (143 IOCs combined) compromises legitimate websites to inject fake browser-update prompts. The SVG-embedded script delivery campaign (25 IOCs) embeds JavaScript inside SVG image files that execute on browser render. Both defeat email-attachment-scanner defensive controls because the payload is not delivered as an attachment.

Defensive actions: Content inspection of SVG files at mail-gateway and web-proxy layers (treat SVG as executable-adjacent). For drive-by fake-update: detect the pattern where a user visits a legitimate-looking site, then downloads a browser-update from a non-corporate domain.

05.5 · WebDAV-transport delivery campaign (275 IOCs)

275 IOCs across HASH + IP + URL. Uses WebDAV as the payload-delivery transport rather than HTTP/HTTPS. WebDAV traffic frequently escapes conventional web-proxy content inspection because it is treated as file-sharing rather than web browsing.

Defensive actions: Alert on outbound WebDAV traffic from non-collaboration-tool hosts. If your environment has no legitimate WebDAV use case, block WebDAV outbound at the perimeter.

05.6 · Regional and tracked-cluster activity summary

The remaining 20-plus APT clusters cover Russian-aligned, Middle East / North Africa regional, proxy-focused, credential-access-focused, and multiple tracked-cluster group activity. Combined they represent 8,291 APT-category IOCs. Standard multi-stage APT chain applies across most: adversary-acquired-domain infrastructure → phishing initial access → second-stage payload pull → web-protocol C2 → exfil-over-C2. Detection content that fires on that universal chain (Sigma 02 below) catches most of the APT surface without per-cluster tuning.

06 · ATT&CK tactic-pressure roll-up

Detection-engineering takeaway. The universal APT chain (T1583.001 → T1566 → T1105 → T1071.001 → T1041) covers most of the 25 attributed clusters this week. Two well-designed detectors — one on adversary-acquired-domain first-seen contact, one on the ingress-tool-transfer-plus-exfil sequence within 5 minutes — cover most of the APT surface with minimal per-cluster tuning. For the loader-heavy layer, behavioural loader-detection is the durable defence layer (Sigma 01 below).

07 · Subnet anchors — the shared-infrastructure signal

The asymmetric block. The ICS/OT-attributed campaign operates across three distinct /24 anchors with 15 concentrated IPs — unusual for an ICS/OT-focused cluster. Blocking all three /24s at the perimeter costs the defender nothing (no legitimate business use) and forces the operator to rebuild across three different hosting tenants simultaneously to defeat the block. The 9-IP-in-one-/24 anchor and the 3-IP DPRK-adjacent anchor are the other high-leverage blocks.

08 · Top IOCs per indicator type

Operator-grade extractions with category and severity attribution only. All indicators are defanged (re-fang on import: [.] → . and hxxp → http). Domain list reduced this week to remove brand-referencing entries.

Top 15 · IP addresses (High severity)

Top domains (High severity)

Top 15 · File hashes (High severity)

Top 15 · URLs (High severity)

09 · Sigma detection rules

Sigma 01 · Universal loader behaviour (polymorphic-build durable defence)

title: Universal Loader Behaviour — Polymorphic Build Family Detector
id: 6a2c8e1f-5b74-4930-a681-3f9b5c2e8d10
status: experimental
description: Detects the universal loader behaviour signature — a downloaded
  binary spawns from a browser or document reader parent process, then triggers
  outbound network traffic to a non-corporate destination within 60 seconds.
  Catches polymorphic-build loader families where hash-blocking is defeated
  by build-farm volume.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-20-26-2026/
author: HackForLab Threat Intelligence
date: 2026/07/27
tags:
  - attack.execution
  - attack.t1204
  - attack.command_and_control
  - attack.t1105
  - attack.t1071.001
logsource:
  product: correlation
detection:
  s1_downloaded_binary:
    EventID: 4688
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\edge.exe'
      - '\OUTLOOK.EXE'
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\AcroRd32.exe'
    Image|contains:
      - '\Downloads\'
      - '\Temp\'
      - '\AppData\Local\Temp\'
  s2_outbound_web:
    EventID: 5156
    DestinationPort: [80, 443, 8080, 8443]
    DestinationIp|expand: '%non_corporate_destinations%'
  condition: s1_downloaded_binary and s2_outbound_web within 60s
falsepositives:
  - Legitimate software installers from allowlisted domains
level: high

Sigma 02 · Universal APT chain (adversary-acquired domain first-seen)

title: Universal APT Chain — Adversary-Acquired Domain First-Seen Contact
id: 4e8b7c1d-3a95-4620-b791-6d8f2c1e5a90
status: experimental
description: Detects DNS or HTTP contact with a domain that (a) has been
  first-observed to your environment within the last 24 hours, (b) has a
  registration age under 30 days, and (c) is contacted from a workstation
  rather than a mail-gateway or web-proxy. Catches the universal APT
  first-stage-C2 pattern across most attributed clusters.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-20-26-2026/
author: HackForLab Threat Intelligence
date: 2026/07/27
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.resource_development
  - attack.t1583.001
logsource:
  category: dns_query
detection:
  selection:
    QueryName|first_seen_within: 24h
    QueryName|registration_age: <30d
    SourceHost|category: workstation
  condition: selection
falsepositives:
  - New corporate SaaS onboarding (allowlist by known-good tenant patterns)
level: high

Sigma 03 · PLC-targeted subnet + OT-protocol egress

title: PLC-Targeted Subnet Anchor Contact + OT-Protocol Egress (ICS/OT)
id: 8d1a4b6f-5c92-4670-a881-3f9c7d5b2a40
status: experimental
description: Detects any outbound connection to the PLC-targeted campaign's
  three concentrated subnet anchors. Also fires on OT-protocol traffic to any
  destination outside the internal OT segment. Critical signal for OT/ICS
  environments.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-20-26-2026/
author: HackForLab Threat Intelligence
date: 2026/07/27
tags:
  - attack.command_and_control
  - attack.t1071
  - ics.t0819
  - ics.t0866
logsource:
  category: network_connection
detection:
  ot_subnet_anchors:
    DestinationIp|cidr:
      - '185.82.73.0/24'
      - '175.110.121.0/24'
      - '88.80.150.0/24'
  ot_protocol_egress:
    DestinationPort:
      - 502    # Modbus TCP
      - 44818  # EtherNet/IP
      - 20000  # DNP3
      - 34962  # Profinet
      - 34963  # Profinet
      - 34964  # Profinet
    DestinationIp|expand: '%external_destinations%'
  condition: ot_subnet_anchors or ot_protocol_egress
falsepositives:
  - Legitimate OT vendor remote-support (allowlist by known-good IPs)
level: critical

Sigma 04 · SVG file with embedded script content

title: SVG File Delivery with Embedded Script Content
id: 5c9e7b2d-1a83-4550-b721-3f9b6d4f2a10
status: experimental
description: Detects delivery of SVG files (inbound mail attachment or web
  download) that contain embedded JavaScript. Catches the SVG-embedded
  script delivery campaign and any future SVG-based delivery.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-20-26-2026/
author: HackForLab Threat Intelligence
date: 2026/07/27
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059.007
logsource:
  category: file_event
detection:
  svg_delivery:
    TargetFilename|endswith: '.svg'
    FileContent|contains:
      - '





10 · Hunt queries — SIEM-agnostic pseudo-syntax
Hunt 01 · Loader chain — browser/document parent + outbound web within 60s
// Pseudo-query
FROM process_creates AS pc
JOIN network_flows AS nf
  ON pc.host = nf.src_host
  AND nf.flow_time BETWEEN pc.create_time AND pc.create_time + 60s
WHERE pc.parent_process IN ('chrome.exe', 'firefox.exe', 'edge.exe',
                             'OUTLOOK.EXE', 'winword.exe', 'excel.exe',
                             'powerpnt.exe', 'AcroRd32.exe')
  AND pc.image_path MATCHES regex '\\(Downloads|Temp)\\'
  AND nf.dest_ip NOT IN (allowlisted_ranges)
  AND nf.dest_port IN (80, 443, 8080, 8443)
| PROJECT pc.host, pc.image_path, nf.dest_ip, nf.dest_domain
| SORT BY pc.create_time DESC
Hunt 02 · APT subnet-anchor first-seen contact
// Pseudo-query
FROM network_flows
WHERE dest_ip IN CIDR('185.82.73.0/24', '175.110.121.0/24', '88.80.150.0/24',
                       '45.61.163.0/24', '216.252.238.0/24', '185.177.93.0/24')
  AND first_seen_pair(src_ip, dest_ip) WITHIN 90d
| PROJECT src_ip, dest_ip, first_seen
| SORT BY first_seen DESC
Hunt 03 · ICS/OT subnet + OT protocol traffic
// Pseudo-query
FROM network_flows
WHERE (dest_ip IN CIDR('185.82.73.0/24', '175.110.121.0/24', '88.80.150.0/24'))
   OR (dest_port IN (502, 44818, 20000, 34962, 34963, 34964)
       AND dest_ip NOT IN (internal_ot_segment))
| AGGREGATE BY src_ip, dest_ip, dest_port
| SORT BY flow_count DESC
Hunt 04 · New-registration domain first-seen from workstations
// Pseudo-query
FROM dns_queries
WHERE first_seen_in_environment(query_name) WITHIN 24h
  AND domain_registration_age(query_name) < 30d
  AND src_host_category = 'workstation'
| PROJECT src_host, query_name, query_time
| SORT BY query_time DESC
11 · Operationalise in 60 minutes
Minute 00 – 15 · Block + sinkhole

Block all three ICS/OT-attributed subnet anchors: 185.82.73.0/24, 175.110.121.0/24, 88.80.150.0/24.
Block the largest single-cluster anchor 185.177.93.0/24 (9 concentrated IPs).
Block DPRK-adjacent anchor 45.61.163.0/24 + APT-tier anchor 216.252.238.0/24.
Add outbound-deny for WebDAV traffic from non-collaboration-tool hosts.

Minute 15 – 30 · Detection content

Deploy Sigma 01 (universal loader behaviour) — catches polymorphic-loader families without hash volatility.
Deploy Sigma 02 (universal APT chain — new-registration domain first-seen).
Deploy Sigma 03 (ICS/OT subnet + OT-protocol egress) — critical for OT/ICS environments.
Deploy Sigma 04 (SVG with embedded script).

Minute 30 – 45 · Retrospective hunt

Run Hunt 01 (loader chain) baseline scan across last 30 days.
Run Hunt 02 (APT subnet-anchor first-seen) across last 90 days.
Run Hunt 03 (ICS/OT subnet + OT-protocol egress) across last 60 days.
Run Hunt 04 (new-registration domain first-seen) across last 30 days.

Minute 45 – 60 · Awareness + policy

Brief cryptocurrency-adjacent users on collaboration-platform impersonation lures.
Brief HR on the IT-worker infiltration pattern — video-verify interviews, cross-check identities against second-source records, flag applicants using VPN or unusual geolocation.
For OT/ICS environments: emergency verification that no internet-accessible PLCs are exposed. Immediate external-attack-surface inventory recommended.
Update mail-gateway policy to inspect SVG file contents (treat as executable-adjacent).


// CONTINUE WITH HUNTINTEL
This briefing ships a selected subset per type. The catalogue carries the full 77,118 unique IOCs from this week — category attribution, ATT&CK technique, confidence score, source provenance included.
Open HuntIntel →

12 · Frequently asked questions

25 attributed APT clusters in one week — is that unusual?
Yes. Twenty-five concurrent attributed APT clusters is the widest APT footprint in this catalogue year-to-date. The typical week sees 5-10 concurrent attributed clusters; this week's 25 is more than double baseline. Organisations in strategic-vertical environments (research, government-adjacent, critical infrastructure, cryptocurrency-adjacent) should prioritise indicator ingestion this week. The APT-storm signal is a leading indicator of near-term intrusion activity.


Two loader families produced 15,000 hashes in one week. How does hash-blocking survive that?
It doesn't. Hash-blocking is fragile against polymorphic-build volume at that scale — the operator can generate new variants faster than any hash feed can catalogue them. The durable defence is behavioural loader detection (Sigma 01 above). Detect the pattern browser/document parent → downloaded binary → outbound web within 60s, and you catch the family regardless of hash variance.


Why is the PLC-targeted campaign flagged as critical when it's only 26 IOCs?
Because it targets industrial control systems, not enterprise IT. A single successful PLC compromise can shut down a power substation, contaminate a water treatment facility, or halt a manufacturing line. The impact-per-IOC is orders of magnitude higher than typical malware. For any organisation operating OT/ICS environments, this cluster belongs in the priority-block queue regardless of IOC count.


What is the IT-worker infiltration campaign and why is it different?
DPRK-linked operatives applying to legitimate remote-work positions using fabricated identities to gain insider access to target organisations. It is not primarily an endpoint threat; it is a HR-workflow threat. The operator wins by getting hired. Detection requires HR-workflow controls (video-verify interviews, independent identity verification, second-source employment/education checks) — not detection content.


Why is SVG script delivery worth its own detection rule?
Because most email-attachment scanners don't treat SVG as executable-adjacent. SVG files can contain embedded JavaScript that executes when the file is rendered in a browser — including via inline preview in mail clients. The delivery vector defeats attachment-scanning defensive controls that would catch a malicious .exe / .doc / .zip. Adding SVG content inspection at the mail gateway closes the gap.


What confidence threshold should the SOC use for automated blocking?
High confidence only for automatic blocklist promotion. Medium and above for watchlist enrichment. Include Low for retrospective hunting.


Where can I see this briefing's intelligence operationally?
The HuntIntel operator console exposes every IOC with category attribution, ATT&CK technique, severity, confidence, and source provenance pre-joined. Open at huntintel.hackforlab.com/login.html. For the underlying frameworks reference, see Indicators of Compromise and Threat Intelligence: A Practitioner Reference.


Related reading:

Previous week (Jul 13-19) ·

Two weeks back (Jul 6-12) ·

Practitioner Reference (IOC + TI) ·

Cloud Threat Hunting Library ·

15-Month Threat Hunter Roadmap ·

Threat Intelligence archive