Defence and government contractors threat intelligence report — 27 April – 3 May 2026

• Reference: TI-2026-0504-006 (public edition)
• Sector: R&D, military and government contractors
• Reporting period: 27 April – 3 May 2026
• Issued: 4 May 2026 · Lead analyst: P. Bassill (SOC Lead) · Reviewed by: SOC Reviewing Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

The R&D and military-government-contractor threat picture for the reporting period is dominated by sustained state-sponsored activity. Google Threat Intelligence Group reporting in February 2026 attributed coordinated defence-sector cyber operations to Russia (UNC5792 and UNC5976), China (APT5, APT31, UNC3236 / Volt Typhoon), Iran (UNC1549, UNC6446) and North Korea (APT43, UNC2970), with credential harvesting via spoofed login pages the common tradecraft. APT28 has been observed exploiting Microsoft Office vulnerabilities against government and military entities. China continues Typhoon campaigns aimed at IP theft and embarrassing Western governments. The principal material-risk scenario remains long-dwell-time espionage rather than ransomware, although secondary criminal targeting persists.

Key Judgements

1. It is highly likely that long-dwell-time espionage from Russia-, China-, Iran- and DPRK-aligned actors will remain the principal material-risk scenario for R&D and government-contractor entities over the next reporting cycle. (HIGH confidence)

2. It is highly likely that credential harvesting via spoofed login pages targeting current and former contractor employees — the documented Feb 2026 GTIG-attributed pattern — will continue at sustained tempo. (HIGH confidence)

3. It is likely that Volt Typhoon (UNC3236) reconnaissance activity against publicly-hosted login portals of North American military and defence contractors will continue, and there is a realistic possibility of similar UK-targeted activity. (MEDIUM-HIGH confidence)

4. It is likely that APT28 Microsoft Office vulnerability exploitation will continue against government and military entities through the next reporting cycle, with multi-stage stealth-focused post-exploitation chains. (MEDIUM-HIGH confidence)

5. There is a realistic possibility that secondary ransomware targeting of R&D entities will increase as APT-criminal collaboration normalises, but at materially lower operational tempo than against finance / retail / healthcare. (MEDIUM confidence)

2. Sector threat landscape

The R&D and military-government-contractor threat picture for the reporting period is dominated by sustained state-sponsored activity. Google Threat Intelligence Group reporting in February 2026 attributed coordinated defence-sector cyber operations to four state-aligned constellations: Russia (UNC5792 and UNC5976), China (APT5, APT31, UNC3236 / Volt Typhoon), Iran (UNC1549 and UNC6446) and North Korea (APT43 and UNC2970). The common tradecraft across these clusters during the reporting period is credential harvesting via spoofed login pages, with messages sent to both corporate and personal email addresses of current and former contractor employees and personalised lures based on victim role, location and personal interest.

China-nexus APT5 ran two spearphishing campaigns in mid-to-late 2024 and again in May 2025, targeting current and former employees of major aerospace and defence contractors. The continued Typhoon campaign portfolio — Volt Typhoon (UNC3236), Salt Typhoon, Linen Typhoon — has been described in NSA / CISA / NCSC joint advisories as a sustained campaign against Western critical infrastructure with the dual aims of intellectual-property theft and pre-positioning for potential future disruption.

Russian APT28 has been observed exploiting Microsoft Office vulnerabilities against government and military entities during the reporting period, deploying multi-stage attack chains designed to remain stealthy during post-exploitation. Iran-aligned UNC1549 and UNC6446 continue to favour the defence-industrial-base and aerospace sub-sector. North Korean APT43 / UNC2970 maintain the cryptocurrency / IP-theft dual-targeting that has characterised DPRK cyber operations through 2024 and 2025.

Secondary criminal targeting persists. Although the operational tempo of ransomware against R&D entities is materially lower than against finance, retail and healthcare, ransomware leak-site postings during the reporting period continued to surface mid-market defence-supply-chain victims. The principal concern in this lane is APT-criminal collaboration: the partnership patterns observed in 2024 and 2025 (especially between Russian-aligned APT operators and ransomware affiliates with shared tooling) are likely to normalise through 2026.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period.

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period.

5. Notable incidents and campaigns

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue.

7. Indicators of compromise

Indicators are defanged in line with industry convention. Confidence ratings reflect the analyst's assessment of the strength of the association between the indicator and the named actor or campaign. IP Insights reputation feed currently lists 812,641 distinct IPv4 addresses across active blocklists (snapshot 04 May 2026 08:15 UTC). AS200651 (FlokiNET) currently lists 110 of 131 known IPs as blacklisted (risk score 100/critical); the AS continues to host bulletproof-style infrastructure observed in the reporting period across phishing, RAT C2, and brute-force activity.

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection priorities are: hunting for OWA / Exchange mailbox-rule and forwarding-rule manipulation against non-baseline source IPs (APT28 hallmark); spoofed-login-page domain hunting (vendor-login-svc patterns) in proxy / DNS telemetry; Volt-Typhoon-pattern living-off-the-land hunting (netsh portproxy, WMIC remote, abnormal scheduled-task creation); long-dwell-time persistence hunting (Run-key / scheduled-task / WMI-event-subscription anomalies); and Citrix NetScaler / FortiOS / Exchange exploitation indicators as soon as Sigma rules are released. Where customers operate publicly-hosted login portals, sustained reconnaissance-pattern hunting (Volt-Typhoon-style) is warranted.

Defend

Patching priorities are dominated by Citrix NetScaler ADC / Gateway, FortiOS, Microsoft Exchange and the Linux kernel CVE-2026-31431. The CISA KEV April additions should be patched on the published federal-deadline schedule. Identity-controls hardening to mitigate spoofed-login-page credential harvest is the highest-impact defensive investment for the vertical: phishing-resistant MFA (FIDO2 hardware tokens), conditional-access rules requiring known-device tokens, and aggressive proxy / URL-defence on personal-and-corporate-mailbox boundaries. ISO/IEC 27001 Annex A controls A.5.13, A.5.16, A.5.17, A.8.10 and A.8.20 are direct levers; for UK customers the NCSC Cyber Essentials Plus and the Defence Cyber Protection Partnership Cyber Risk Profiles (CRP1-5) should be the operating standards, with US customers operating to NIST 800-171 / CMMC.

Disrupt

Disruption priorities are sustained sharing of the IP Insights blocklist into customer perimeter-block lists; coordinated takedown of FlokiNET-hosted spoofed-login-page infrastructure via AS200651 abuse channels and CERT-UK; tabletop exercise against the long-dwell-time-espionage scenario for any customer with material classified or IP exposure; rehearsal of the personal-mailbox-credential-compromise playbook for current and former employees; and engagement with NCSC and the Defence Cyber Protection Partnership where customers are members.

10. Forward outlook

It is highly likely that long-dwell-time espionage from state-aligned APT clusters will remain the principal material-risk scenario for the vertical over the next reporting cycle. (HIGH confidence; 30-day horizon)

It is highly likely that credential-harvesting via spoofed login pages will continue at sustained tempo. (HIGH confidence; 30-day horizon)

It is likely that Volt Typhoon reconnaissance will extend or has already extended to UK military and defence-contractor login portals. (MEDIUM-HIGH confidence; 90-day horizon)

It is likely that APT28 Microsoft Office vulnerability exploitation will continue at sustained tempo against UK and allied government entities. (MEDIUM-HIGH confidence; 60-day horizon)

There is a realistic possibility of secondary ransomware-against-defence-supply-chain incidents at low-to-medium operational tempo. (MEDIUM confidence; 90-day horizon)

Trigger conditions that would prompt revision of this forecast: a UK-attributed Volt Typhoon login-portal reconnaissance disclosure; an in-the-wild APT28 Office zero-day publication; a confirmed APT-criminal-cluster ransomware deployment against a UK defence contractor.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst's assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.