Defence and government contractors threat intelligence report — 27 June – 3 July 2026

• Reference: TI-2026-0703-006 (public edition)
• Sector: R&D, military and government contractors
• Reporting period: 27 June – 3 July 2026
• Issued: 3 July 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Research and Development, Military and Government Contractor sector during the period 27 Jun 2026 - 03 Jul 2026. It is intended to support operational defenders and risk owners in defence primes, tier-1 and tier-2 defence suppliers, MoD-adjacent research organisations, dual-use technology firms and Government contractors and is graded TLP:CLEAR. Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659 - a significant risk given the prevalence of SharePoint in classified-adjacent document management - and by continuing PRC state-sponsored activity attributable to Salt Typhoon and Volt Typhoon.

The perimeter tail is dominated by IP Insights critical-scored Tor and bulletproof hosting, with sustained password-spray volumes against Entra ID and VPN sign-in endpoints.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that CVE-2026-45659 will be a priority exploitation target for state-sponsored actors against defence and R&D estates within the next 14 days, given the CISA KEV timeline and the intelligence value of SharePoint repositories in this vertical (HIGH confidence).
2. It is highly likely that Salt Typhoon (China) will continue targeting telecommunications, defence contractors and government agencies through Q3 2026, consistent with the sustained CISA / NCSC / NSA joint advisory campaign under AA25-239A (HIGH confidence).
3. It is likely that Volt Typhoon pre-positioning activity against UK / EU / US critical national infrastructure will continue at low volume but strategic significance through the reporting horizon (MEDIUM-HIGH confidence).
4. It is likely that Iranian and DPRK cyber activity against UK defence and dual-use targets will remain at current volumes, consistent with recent NCSC public advisories on Middle-East-adjacent activity (MEDIUM-HIGH confidence).
5. It is a realistic possibility that a supply-chain compromise of a defence-adjacent software vendor will be publicly disclosed during Q3 2026, consistent with historical PRC operating patterns (MEDIUM confidence).

2. Sector threat landscape

The R&D, military and government contractor vertical sits at the intersection of commercial IT and national-security-sensitive workflows, with attack surface that includes corporate SharePoint / M365, VPN and remote-access gateways, engineering CAD / PLM environments, and (in some estates) genuinely classified enclaves. The collection picture for the period is dominated by PRC state-sponsored activity, sustained ransomware pressure against defence-adjacent SMEs, and the CISA KEV addition of CVE-2026-45659.

CVE-2026-45659 is operationally significant for R&D and defence. Successful exploitation would give an authenticated attacker RCE on the SharePoint server, with downstream access to any document held there. In an intelligence-collection context this is high-value: contract award data, subcontractor mapping, technology roadmaps and IRAD programme documentation are all typical SharePoint holdings that are directly of interest to state adversaries.

Salt Typhoon activity remains the highest-signal state-sponsored threat during the period. Its confirmed victim set includes government agencies, defence contractors, technology companies, consulting firms, chemical manufacturers, transportation providers, hospitality businesses and non-profits per the AA25-239A joint advisory. Its typical initial-access vector is exploitation of edge-device and collaboration-platform vulnerabilities - Ivanti, SharePoint, Fortinet - which places CVE-2026-45659 directly in its exploitation set. Volt Typhoon's pre-positioning activity against CNI continues in parallel with lower operational tempo but higher strategic significance.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Salt Typhoon (PRC)

• Aliases: OPERATOR PANDA, RedMike, UNC5807, GhostEmperor, FamousSparrow, Earth Estries
• Suspected Origin: People's Republic of China
• Suspected Sponsor: Nation state (Ministry of State Security)
• Primary Motivation: Espionage, intelligence collection, positional advantage
• Sector Targeting: Telecoms, defence contractors, government, technology, consulting, chemical, transportation, hospitality, non-profit
• Geographic Focus: Global with heavy Western / Five Eyes focus
• Signature TTPs: Edge device exploitation (Ivanti, SharePoint, Fortinet), stolen valid credentials, LOLBins, long-dwell persistence, careful lateral movement, exfiltration via legitimate cloud services
• Tooling / Malware Families: GhostEmperor rootkit, SnappyBee, ShadowPad, PlugX, custom loaders, LOLBins
• Recent Activity: Continuing AA25-239A campaign; Army National Guard breach exposed admin credentials and network diagrams per DHS reporting
• Assessed Threat to Vertical: HIGH - primary state-sponsored threat to R&D / defence vertical
• Analytic Confidence: HIGH

Volt Typhoon (PRC)

• Aliases: BRONZE SILHOUETTE, Vanguard Panda, DEV-0391
• Suspected Origin: People's Republic of China
• Suspected Sponsor: Nation state (MSS)
• Primary Motivation: Pre-positioning for disruptive attack against CNI
• Sector Targeting: Communications, energy, transportation, water; defence contractor adjacency
• Geographic Focus: US, Five Eyes and allied nations
• Signature TTPs: LOLBins, stolen valid credentials, SOHO router exploitation, prolonged persistence with minimal on-endpoint tooling, long dwell
• Tooling / Malware Families: Minimal - reliance on native binaries and stolen credentials
• Recent Activity: Continued CISA / NCSC joint advisory pressure; c. one-year US grid dwell time referenced in recent public reporting
• Assessed Threat to Vertical: MEDIUM-HIGH - lower operational tempo, strategic significance
• Analytic Confidence: MEDIUM

APT28 (Fancy Bear, GRU)

• Aliases: Fancy Bear, Sofacy, STRONTIUM, Forest Blizzard, BlueDelta
• Suspected Origin: Russian Federation
• Suspected Sponsor: Nation state (GRU 26165)
• Primary Motivation: Espionage, intelligence collection, occasional disruption
• Sector Targeting: Government, defence, defence contractors, aerospace, media, dissident targeting
• Geographic Focus: US, EU, UK, Ukraine, wider NATO
• Signature TTPs: Router exploitation (Cisco IOS XE, Fortinet), credential harvest, targeted spearphishing, Outlook / Exchange abuse, OAuth token theft
• Tooling / Malware Families: X-Agent, Zebrocy, Cannon, GreyEnergy, various custom loaders
• Recent Activity: Continuing NCSC public advisories on Middle-East-adjacent GRU activity; router-hijack DNS activity referenced by NCSC
• Assessed Threat to Vertical: HIGH - persistent, well-resourced threat to defence vertical
• Analytic Confidence: HIGH

APT35 (Charming Kitten, IRGC)

• Aliases: Charming Kitten, Phosphorus, Mint Sandstorm, TA453, APT42
• Suspected Origin: Islamic Republic of Iran
• Suspected Sponsor: Nation state (IRGC)
• Primary Motivation: Espionage against defence, policy, academia
• Sector Targeting: Defence, aerospace, academia, journalism, policy institutes, dissidents
• Geographic Focus: US, UK, EU, Israel, wider anti-Iran policy sphere
• Signature TTPs: Sophisticated spearphishing (long-conversation lures, credential-harvest via fake conference and academic pretexts), OAuth token theft, cloud-first pivoting
• Tooling / Malware Families: GhostEcho, BellaCiao, custom loaders, credential-harvest kits
• Recent Activity: Continued targeting under NCSC public advisory on Middle-East-conflict-adjacent activity
• Assessed Threat to Vertical: MEDIUM-HIGH - persistent threat to defence policy / research staff
• Analytic Confidence: MEDIUM

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection engineering should treat CVE-2026-45659 as the principal hunting hypothesis for the next reporting cycle, with an assumption that state-sponsored exploitation will precede volume criminal exploitation. Deploy w3wp.exe child-process hunts and ULS deserialisation exception rules. Extend hunts to Salt Typhoon-specific patterns: unexpected management-agent activity on edge devices, LOLBin execution chains on SharePoint / IIS hosts, and unexpected M365 admin activity on defence-adjacent tenants. Deploy long-dwell detection heuristics: OAuth token issuance to unusual client-app IDs, refresh-token abuse against defence-relevant mailboxes, and anomalous PIM / Global Admin activation.

Defend

Preventive priorities follow Section 6 directly. SharePoint patching must be applied to meet the CISA KEV 04 Jul deadline as an absolute floor - defence estates should prioritise this above other work. Complete NetScaler patching and session-invalidation. Deploy phishing-resistant MFA (FIDO2, hardware token) on all IT-admin, defence-project and senior-officer accounts. Enforce Conditional Access rules limiting sensitive session issuance to compliant / hybrid-joined devices only. Baseline network segmentation between corporate IT, engineering / CAD environments, and any classified enclave. Verify SOHO router estate posture for remote workers - Volt Typhoon's exploitation of small-office routers is a documented pattern.

Disrupt

Disruption activity within client lawful authority should focus on: (i) participation in the Defence Cyber Protection Partnership (DCPP) indicator exchange and NCSC CiSP under the defence and government-contractor vertical, with this week's IP Insights critical / block tail contributed; (ii) intelligence-sharing under the joint AA25-239A framework where the client is a Salt Typhoon-relevant target; (iii) coordinated response with MoD cyber teams for any confirmed state-sponsored intrusion; (iv) participation in DCPP and NCSC-facilitated tabletop exercises for state-sponsored incident-response playbook validation.

10. Forward outlook

Looking forward to the next reporting period (04 Jul - 10 Jul 2026), it is likely that Salt Typhoon exploitation of CVE-2026-45659 against defence and government targets will begin within the reporting window, given the strategic value of the vulnerability set. Volt Typhoon activity is expected to remain at low operational tempo but continuing strategic significance. IRGC and GRU spearphishing volumes against defence targets are expected to remain steady or slightly elevated given the ongoing Middle-East geopolitical context.

Trigger conditions that would prompt revision of this outlook include: (a) any publicly-disclosed defence or government-contractor SharePoint incident; (b) any confirmed Salt Typhoon or Volt Typhoon intrusion against a UK defence prime or tier-1 supplier, which would warrant immediate out-of-cycle advisory; (c) any significant Middle-East geopolitical escalation increasing the IRGC / GRU threat picture; (d) further CISA / NCSC joint advisories under the AA25-239A framework.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.