Defence and government contractors threat intelligence report — 20–26 June 2026

• Reference: TI-2026-0626-006 (public edition)
• Sector: R&D, military and government contractors
• Reporting period: 20–26 June 2026
• Issued: 26 June 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Research & Development and Military / Government Contractors sector during the period 20 Jun 2026 - 26 Jun 2026. It is intended to support contractor IT and security functions, security-cleared personnel handling export-controlled and OFFICIAL-SENSITIVE information, and the senior information risk owner, and is graded TLP:CLEAR. The collection picture this period is dominated by sustained state-aligned espionage activity (Salt Typhoon, Mustang Panda, APT28 and Screening Serpens all remain active), continued infostealer activity affecting contractor supply chains, and the edge-appliance exposure introduced by the 23 June Ubiquiti UniFi OS KEV addition.

IP Insights enrichment surfaced ten 'critical' or 'block' addresses in the perimeter scan tail. The DoD's June 10 infostealer report - documenting 11.1 million infostealer-compromised devices and 3.3 billion stolen credentials in 2025 - remains the most relevant strategic context for the supply-chain risk model.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that PRC state-aligned actors (Salt Typhoon, Mustang Panda and related clusters) will continue sustained intrusion campaigns against UK and EU R&D and government contractor networks through Q3 2026, consistent with multi-year tracking and 2026 vendor reporting (HIGH confidence).
2. It is highly likely that Russian state-aligned actors (APT28 and related GRU clusters) will continue router and edge-appliance exploitation tradecraft against contractor edge networks and remote-worker CPE, consistent with current NCSC advisories (HIGH confidence).
3. It is highly likely that the three Ubiquiti UniFi OS defects added to KEV on 23 June will be exploited against unpatched contractor branch and back-office UniFi deployments within the next 14 days, with state-aligned actors a plausible exploiter alongside criminal volume (HIGH confidence).
4. It is highly likely that infostealer-derived credentials harvested from contractor-supplier estates will continue to feed valid-account-based intrusions against principal contractors through Q3 2026, consistent with the DoD's June 10 report (HIGH confidence).
5. It is a realistic possibility that Iranian state-aligned activity (Screening Serpens cluster) will expand from regional targeting to UK or EU contractor networks within the next two reporting cycles, given the post-February 2026 escalation pattern documented by Unit 42 (MEDIUM confidence).

2. Sector threat landscape

The R&D and military / government contractors vertical sits at the intersection of state-aligned espionage targeting, criminal ransomware activity and supply-chain compromise risk. The collection picture for this period is dominated by sustained PRC and GRU state-aligned activity (Salt Typhoon and Mustang Panda for PRC; APT28 for GRU), the edge-appliance exposure introduced by the 23 June Ubiquiti UniFi OS KEV addition, and the structural supply-chain compromise risk highlighted by the DoD's June 10 infostealer report.

Salt Typhoon (PRC) continues sustained operations against telecommunications, ISP and lawful-intercept infrastructure with downstream relevance to defence and intelligence contractor connectivity. Mustang Panda (PRC) continues targeting of NGOs, think-tanks, trade bodies and defence-adjacent professional services with PlugX, ToneShell and Korplug deployments. APT28 (GRU) continues router and edge-appliance exploitation per the current NCSC advisory; remote-worker CPE and SOHO routers remain a particular concern for contractor staff working from home.

Iranian state-aligned activity (Screening Serpens cluster) has increased operations since the February 2026 regional escalation, deploying two new RAT variants across entities in up to five countries per Unit 42's tracking. While currently regionally focused, the cluster's expansion pattern suggests UK and EU contractor networks could see targeting within Q3-Q4 2026, particularly where the contractor work involves Middle East programmes, sanctions enforcement or defence-export activity.

Supply-chain compromise risk remains structural. The DoD's June 10 infostealer report - 11.1 million compromised devices and 3.3 billion stolen credentials in 2025 - documents the scale of credential exposure across contractor supplier estates. MSP and BPO supplier compromise continues to be a major vector. Ransomware activity from Qilin, Akira and LockBit 5.0 has touched contractor-adjacent organisations during 2026 and supply-chain blast-radius remains a credible escalation path.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Salt Typhoon (PRC)

• Aliases: Salt Typhoon, GhostEmperor, Earth Estries, FamousSparrow overlap
• Suspected Origin: People's Republic of China
• Suspected Sponsor: Nation-state (MSS)
• Primary Motivation: Espionage, lawful-intercept system access, telecommunications intelligence
• Sector Targeting: Telecommunications, government, defence contractors, research institutions, legal services with state-client work
• Geographic Focus: Five-Eyes primary; EU, JP, SEA secondary
• Signature TTPs: Edge-appliance and router exploitation; valid-account abuse; long-dwell-time intrusion; living-off-the-land binaries
• Tooling / Malware Families: GhostSpider, Demodex rootkit, custom POSIX implants
• Recent Activity: Sustained 2026 operations; reporting consistent with continued telco / ISP infrastructure access
• Assessed Threat to Vertical: HIGH for R&D and gov contractor verticals
• Analytic Confidence: HIGH

APT28 / Fancy Bear (GRU)

• Aliases: APT28, Fancy Bear, Sofacy, Strontium, Forest Blizzard, GRU Unit 26165
• Suspected Origin: Russian Federation
• Suspected Sponsor: Nation-state (GRU)
• Primary Motivation: Espionage, influence operations, strategic intelligence collection
• Sector Targeting: Government, defence contractors, R&D, NGOs, trade bodies, legal services with state-adjacent work
• Geographic Focus: NATO and partner states primary
• Signature TTPs: Router and edge-appliance exploitation for DNS hijack; spear-phishing of credentialed staff; AiTM token theft; ongoing exploitation of Outlook / Exchange
• Tooling / Malware Families: X-Agent, X-Tunnel, GooseEgg, Headlace, JaguarTooth
• Recent Activity: NCSC advisory on continued APT28 router exploitation and DNS hijack tradecraft remains current
• Assessed Threat to Vertical: HIGH for R&D, gov contractor, trade-body verticals
• Analytic Confidence: HIGH

Mustang Panda (PRC)

• Aliases: Mustang Panda, Bronze President, RedDelta, TA416, HoneyMyte
• Suspected Origin: People's Republic of China
• Suspected Sponsor: Nation-state (MSS-aligned)
• Primary Motivation: Espionage, influence collection on diaspora and NGO targets
• Sector Targeting: Government, NGOs, think-tanks, trade bodies, defence contractors, R&D
• Geographic Focus: Global, with sustained EU and SEA operations
• Signature TTPs: Spear-phishing with weaponised LNK / ISO containers; PlugX deployment; long-dwell-time operations against policy-influence targets
• Tooling / Malware Families: PlugX, ToneShell, Korplug, ClaimLoader
• Recent Activity: Sustained 2026 operations against trade bodies and NGOs documented in vendor reporting
• Assessed Threat to Vertical: HIGH for trade bodies and R&D
• Analytic Confidence: HIGH

Screening Serpens (Iran)

• Aliases: Screening Serpens, MuddyWater overlap, CharmingKitten overlap
• Suspected Origin: Islamic Republic of Iran
• Suspected Sponsor: Nation-state (assessed IRGC-aligned)
• Primary Motivation: Espionage, regional collection, retaliatory positioning
• Sector Targeting: Government contractors, defence, R&D, maritime, energy
• Geographic Focus: Middle East primary; expanding EU / UK
• Signature TTPs: Spear-phishing with credential harvest; deployment of custom RAT families; ongoing positioning against regional adversaries
• Tooling / Malware Families: Two new RAT variants documented by Unit 42 in 2026, MuddyWater-style scripting toolkits
• Recent Activity: Increased operations since February 2026 regional conflict; activity across up to five countries (Unit 42)
• Assessed Threat to Vertical: MEDIUM-HIGH for R&D and government contractor verticals
• Analytic Confidence: MEDIUM

LockBit 5.0

• Aliases: LockBit, LockBit Black, LockBit Green, LockBit 5.0 (Aug 2025 relaunch)
• Suspected Origin: Russian-speaking criminal underground
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - encryption + extortion
• Sector Targeting: Financial services, healthcare, manufacturing, government contractors, legal services
• Geographic Focus: Global; consistent UK / EU / NA volume
• Signature TTPs: Initial access via exposed RDP, public-facing exploits, valid accounts; ESXi-specific encryptor build; double-extortion via leak site
• Tooling / Malware Families: LockBit 5.0 encryptor (Win/Linux/ESXi variants), StealBit exfiltrator, Cobalt Strike, Mimikatz
• Recent Activity: Continuing 2026 leak-site activity post-relaunch; selective targeting of FS, legal and contractor sub-verticals
• Assessed Threat to Vertical: HIGH
• Analytic Confidence: MEDIUM-HIGH

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection engineering should treat the Ubiquiti UniFi OS chain, APT28 router-exploitation tradecraft, Mustang Panda PlugX patterns and infostealer-credential-reuse indicators as the principal hunting hypotheses for this period. Hunt actively for low-and-slow exfiltration patterns and for web-shell artefacts on edge appliances.

Defend

Preventive priorities follow Section 6 directly. Ubiquiti UniFi OS 5.0.8 patch must be applied across the contractor estate by 26 June to meet CISA BOD 26-04. The Cisco SD-WAN Manager and Arista EOS prior-period defects remain mitigation-only and require sustained ACL and netadmin-role discipline. For APT28 router-exploitation exposure, audit remote-worker CPE estates against NCSC current router-hardening guidance and replace unsupported SOHO router hardware where remote-worker traffic carries credentialed access. For infostealer-credential-reuse risk, enforce mandatory password rotation on any account flagged by HaveIBeenPwned, BreachAlert or supplier-estate infostealer reporting and enforce phishing-resistant authentication (FIDO2 / WebAuthn) for privileged R&D and export-controlled access. Apply DSPT / NIS2 / CMMC / DEFCON 658 / 705 compliance-aligned hardening per applicable regulatory regime. Maintain immutable, off-premises backups of all R&D and export-controlled material.

Disrupt

Disruption activity within client lawful authority should focus on: (i) participation in the Defence Cyber Protection Partnership (DCPP), the NCSC CiSP contractor and CNI communities, and the relevant national-authority indicator exchange, with this week's IP Insights critical / block tail submitted as the highest-value contributable; (ii) coordination with NCSC on the APT28 router-exploitation campaign and the Ubiquiti UniFi OS chain across contractor supply chains; (iii) takedown coordination via NCSC ACD for contractor-brand-themed phishing infrastructure; (iv) coordination with the MoD JSyCC, Defence Equipment & Support and the relevant export-control authority on incident notification thresholds; (v) submission of observed state-aligned indicators to NCSC Early Warning, MISP communities and ipinsights.io.

10. Forward outlook

Looking forward to the next reporting period (27 Jun - 03 Jul 2026), it is likely that at least one UK or EU R&D or contractor organisation will publicly disclose an incident traceable to one of the Ubiquiti UniFi OS chain, Cisco SD-WAN Manager, Arista EOS or APT28 router-exploitation patterns in Section 6. Sustained state-aligned activity from Salt Typhoon, Mustang Panda and APT28 is highly likely to continue. The Screening Serpens cluster's geographical scope is likely to expand further during Q3 2026.

Trigger conditions that would prompt revision of this outlook include: (a) NCSC, FBI or partner attribution of a fresh PRC or GRU campaign specifically targeting UK contractor networks, which would warrant immediate out-of-cycle reporting; (b) emergence of evidence linking Screening Serpens to a successful UK or EU contractor intrusion, which would elevate the Iranian threat from MEDIUM to HIGH; (c) a publicly attributed APT28 router-exploitation incident affecting remote-worker CPE that touches a UK contractor's privileged access, which would trigger an emergency SOHO router-replacement advisory; (d) a sector-impacting infostealer disclosure naming UK contractor staff, which would trigger immediate password-rotation and FIDO2 step-up enforcement. The principal intelligence gap remains visibility into peer-contractor incident telemetry across non-CDS supply chains.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.