Executive Summary

Since the spring of 2026, Insikt Group has observed multiple Russian-language traffer teams that have quickly adapted affiliate-fraud models to capitalize on growing public interest in prediction markets such as PolyMarket and Kalshi. The platforms offered by three such teams — AtlasCore, PolyFucked, and Magnetic Team — provide websites, administrative panels, cryptocurrency payment infrastructure, victim-management capabilities, technical support, and promotional guidance. This model lowers barriers to entry for affiliates and enables campaigns to scale rapidly as new trends attract potential victims. The services combine convincing prediction-market interfaces with established fraud mechanisms designed to manipulate victims and prevent them from recovering deposited funds. These mechanisms include controlled trading outcomes, fabricated market activity, artificial withdrawal restrictions and fees, and the collection of sensitive identity and payment information.

Artificial intelligence (AI) further accelerates this opportunism by reducing the time, cost, and expertise required to adapt campaigns to emerging events. Insikt Group observed threat actors using AI to support multiple stages of their campaigns, including platform development, content creation, social engineering, and victim engagement.

The rapid adoption of prediction markets by multiple traffer teams illustrates a broader threat from mature fraud ecosystems that can pivot toward emerging technologies, financial products, and cultural trends without having to develop entirely new criminal capabilities. Prediction markets are particularly well-suited to this model because legitimate platforms already combine cryptocurrency, speculative financial activity, rapidly changing news events, and social media discussion. Fraud actors can imitate these characteristics to establish credibility and manufacture urgency. As the fraudulent prediction markets gain visibility, additional traffer teams may experiment with the prediction market theme or reuse the underlying tooling for adjacent fraud schemes.

Key Findings

• AtlasCore, PolyFucked, and Magnetic Team supply affiliates with simulated prediction-market websites, administrative panels, payment infrastructure, and promotional support. Advertised compensation includes 70% to 80% of net profits for AtlasCore affiliates, a minimum 60% revenue share for PolyFucked affiliates, and a base 70% share of victim deposits for Magnetic Team affiliates.
• AtlasCore’s Telegram posts recorded approximately $10.97 million in claimed deposits across its scam offerings between May 2 and September 18, 2026, with the deposits predominantly associated with prediction markets. PolyFucked separately advertises approximately $2.4 million in quarterly turnover. Both figures rely on threat actor reporting and remain unverified.
• Magnetic Team advertises more than 3,000 simulated traders across more than 5,000 markets to fabricate convincing trading activity. Its code exposes configurable withdrawal-blocking pretexts, forced-loss controls, and pools of up to 20,000 deposit wallets per blockchain. AtlasCore similarly exposes settings to force wins or losses and impose individualized withdrawal restrictions.
• All three traffer teams advertise or provide AI-assisted victim support. AtlasCore and PolyFucked also supply guidance for AI-generated promotional content, including synthetic influencers and branding, respectively. Magnetic Team’s source code contains indicators of likely AI-assisted development, suggesting AI use may extend to building and maintaining the underlying fraud platforms, although that assessment remains unconfirmed.
• Insikt Group identified over 100 unique domains and subdomains associated with AtlasCore, PolyFucked, and Magnetic Team, including administrative infrastructure and scam websites likely operated by the teams or their affiliates.

Threat Analysis

AtlasCore

In August 2026, Insikt Group identified a post on a low-tier cybercriminal forum seeking affiliates to join the traffer team “AtlasCore”. The thread was first created on May 15, 2026, by the user “AtlasCore”. The affiliate program was also advertised on a top-tier cybercriminal forum by the user “AtlasCorp” on May 28, 2026. The program includes an offering for prediction markets, as well as more typical traffer scams such as cryptocurrency exchanges and casinos.

Figure 1: Advertisement posted by AtlasCore on a cybercrime forum (Source: Recorded Future)

Executive Summary

Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. Increasingly strict measures targeting virtual private networks (VPNs), state-managed internet shutdowns, limitations on civilian communications platforms, and monitoring of domestic and foreign entities very likely represent an escalation from the approaches to censorship and surveillance pursued prior to 2024.

However, despite intensifying internet restrictions, technical and political limitations will likely prevent the Kremlin from achieving its long-held objective of a fully “sovereign internet” in the near term. The most likely scenario is that Moscow exerts extensive censorship and monitoring of online activity with increasingly strict –– though not absolute –– controls on circumvention and anonymizing tools.

Insikt Group assesses that the Kremlin’s primary objectives regarding internet restrictions are twofold: facilitating extensive surveillance of online activity to support control over the domestic information space while maintaining connectivity to the global internet, and developing national internet infrastructure under Kremlin control, enabling isolation from the global internet if the Kremlin so chooses. Efforts in support of these objectives have almost certainly provided the Kremlin with enhanced ability to control and monitor domestic online discourse.

In this environment, individuals and organizations operating in Russia are subject to increasing operational risks, including surveillance and exposure of sensitive data, challenges in conducting emergency communications, disruptions to corporate tools and digital applications, and legal risks. Entities with indirect exposure to Russia face an increased likelihood of supply-chain disruptions and sanctions violations and, over the longer term, face challenges in assessing the political and economic situation in Russia, as restrictions limit the availability of high-quality open sources.

Key Findings

• The Kremlin is very likely using managed internet shutdowns across Russia to test and improve its ability to isolate the Russian internet, though technical and political limitations make it unlikely that it will achieve its objective of establishing a fully “sovereign internet” in the near term.
• In the near- to medium-term, a combination of falling approval ratings for Russian President Vladimir Putin, declining public opinion amid economic strain, and ongoing Ukrainian drone strikes very likely incentivize Moscow to impose further internet restrictions, regardless of reported public dissatisfaction with some of these measures.
• The Kremlin will very likely continue to pursue strategies to deter VPN use by forcing platforms to support VPN blocks and making VPN use more expensive and inconvenient, though likely avoiding direct punitive measures against individual users.

Kremlin Systematically Tightening Internet Restrictions

Since July 2025, the Kremlin has systematically tightened access to widely used civilian communications applications and VPNs, caused regular mobile internet outages across Russia, and instituted requirements that place Russian and foreign individuals and firms under increased government surveillance. The Kremlin likely views these measures as necessary to make it more difficult for Russian elites or the public to coordinate political dissent, and for the Ukrainian government to launch drone strikes against Russian critical infrastructure.

Restrictions Represent Marked Escalation in Control Over Russian Internet

Insikt Group assesses that, since 2012, Russians have seen their ability to operate without restriction on the internet decline in several waves, primarily driven by the Kremlin's calculation that Russians were using the internet to organize anti-government political actions.

Table 1: Russian approaches to internet restrictions from 2000–2024 (Source: Recorded Future)

Executive Summary

Japan’s Active Cyber Defense (ACD) framework shifts the country from voluntary information sharing and post-incident investigation to mandatory reporting, preventive communications analysis, and limited disruption of attack infrastructure. Beginning October 1, 2026, designated critical infrastructure operators must notify the government about covered systems and report qualifying incidents; those with existing systems have six months to submit initial notifications. New authorities that allow the government to collect and act on communications information (通信情報) will not take effect until November 23, 2027.

The transition comes amid persistent Chinese strategic collection, North Korean revenue-driven cyber operations, and Russian cyber espionage. In cases directly linked to Japan, indicators related to these threat activities were frequently observed among victims, overseas affiliates, vendors, carriers, hosting providers, and government agencies. We assess with moderate confidence that connecting those indicators quickly enough to identify broader campaigns, warn potentially affected organizations, and coordinate defensive action will be ACD’s principal operational constraint. Its practical reach will extend beyond designated operators: overseas compromises may trigger Japanese reporting duties when they reach covered systems; vendors should expect remediation requests; carriers may be required to assist government measures; and hosting providers may encounter action against malicious systems operating on their infrastructure.

We further assess that improved visibility within covered organizations will likely make foreign subsidiaries, non-designated suppliers, employees, and external platforms comparatively attractive access paths for threat actors without reducing overall attack volume (because initial activity along these routes likely falls outside ACD’s mandatory-reporting perimeter or precedes recognition of a qualifying incident). Companies should therefore treat ACD not as a narrow compliance requirement, but as a change to incident escalation, contracting, evidence preservation, and public-private intelligence sharing across their operations and supply chains.

Key Findings

• Japan’s Active Cyber Defense is a two-statute framework — Acts 42 and 43 of 2025 — organized around four principal pillars: public-private collaboration, government use of communications information, access and neutralization of cyber threats, and institutional restructuring and independent oversight. Act 42 establishes the reporting, information-sharing, communications-analysis, and oversight framework, while Act 43 amends existing laws to authorize neutralization measures and reorganize Japan’s cybersecurity institutions.
• Japan's mandatory cyber incident reporting begins October 1, 2026, but the government's communications-information collection capacity will not enter force until November 23, 2027 — a gap of roughly 13 months between the reporting duty and the detection capability intended to support it.
• Japanese agencies recorded an eleven-fold increase in cyberattack-related packets from 63.2 billion in 2015 to 686.2 billion in 2024, while 99.4% of observed attack packets used overseas source IP addresses. This is equivalent to roughly one attempted attack per IP address every thirteen seconds.
• Chinese, Russian, and North Korean cyber operations targeting Japan reflect distinct primary drivers: China pursues enduring strategic intelligence collection, North Korea prioritizes sanctions-driven revenue generation, and Russia combines standing espionage requirements with disruption that can track Japanese policy decisions.
• Threat actors will likely emphasize five access paths likely to maintain limited visibility under ACD after reporting begins on October 1, 2026: foreign subsidiaries, non-designated suppliers, individual employees, consumer platforms, and short-lived infrastructure distributed across hosting providers. Organizations occupying these positions may consequently face greater targeting despite having no direct ACD reporting obligation.

Background

Japan’s Active Cyber Defense framework (能動的サイバー防御, “ACD”) is a package of legal and institutional reforms intended to prevent serious cyberattacks against government and critical infrastructure. The ACD establishes mechanisms for public-private collaboration (官民連携), government use of specified communications information (通信情報の利用), and narrowly defined authority to access and neutralize systems being used to conduct cyberattacks (アクセス・無害化措置) before they cause significant harm or damage. The framework also restructures the government’s central cybersecurity institutions and establishes independent oversight of the framework’s most sensitive authorities.

The framework is principally established through two statutes passed by the National Diet (国会) on May 16, 2025, and promulgated on May 23, 2025:

• Cyber Response Capability Strengthening Act (サイバー対処能力強化法), Act No. 42 of 2025
  Full statutory title: Act on the Prevention of Damage from Unauthorized Acts against Important Computers (重要電子計算機に対する不正な行為による被害の防止に関する法律).
  This statute establishes the critical-infrastructure reporting, communications information use, public-private information-sharing, and independent oversight framework.
• Cyber Response Capability Strengthening Act Arrangement Act (サイバー対処能力強化法整備法), Act No. 43 of 2025
  Full statutory title: Act on the Arrangement of Related Laws Accompanying Enforcement of the Act on the Prevention of Damage from Unauthorized Acts against Important Computers (重要電子計算機に対する不正な行為による被害の防止に関する法律の施行に伴う関係法律の整備等に関する法律).
  This companion statute amends existing legislation, including the Police Duties Execution Act (警察官職務執行法), Self-Defense Forces Act (自衛隊法), and the 2014 Basic Act on Cybersecurity (サイバーセキュリティ基本法). These amendments authorize access-and-neutralization measures, restructure the government’s cybersecurity institutions, and strengthen interagency coordination.

Implementation is phased; the reorganization of the government’s central cybersecurity institutions took effect on July 1, 2025, and the independent Japan Active Cyber Defense Oversight Commission (サイバー通信情報監理委員会) was established on April 1, 2026. The public-private reporting and access-and-neutralization provisions will take effect on October 1, 2026. Supplementary Article 1(4) of Act No. 42 requires the communications-information use provisions to enter force within two years and six months of promulgation, by November 23, 2027.

The Four Pillars

For explanatory purposes, this overview organizes the ACD framework into four principal pillars:

1. Public-Private Collaboration (官民連携)
2. Government Use of Communications Information (通信情報の利用)
3. Government Access and Neutralization Measures (アクセス・無害化措置)
4. Institutional Restructuring and Independent Oversight (組織・体制整備・独立監督)

Together, the pillars summarize the framework’s principal government authorities, institutional changes, oversight mechanisms, and legal obligations for public- and private-sector organizations. They reflect a fundamental shift in Japan’s cybersecurity posture toward earlier detection, structured public-private cooperation, and preventive disruption, while placing the framework’s most sensitive authorities under specialized independent oversight. They do not encompass every provision within the two statutes.

Pillar 1 — Public-Private Collaboration (官民連携)

Pillar 1 creates mandatory reporting requirements and a consent-based information-sharing framework. For ACD reporting purposes, “designated operators” (特別社会基盤事業者) are critical-infrastructure operators designated under the Economic Security Promotion Act that use covered systems — Specified Important Computers (特定重要電子計算機). These include qualifying operators in sectors such as electricity, telecommunications, transport, and finance. Designated critical-infrastructure operators must notify the responsible government minister when they introduce covered systems — Specified Important Computers — and report qualifying cyber incidents (特定侵害事象等) to that minister and the prime minister. The prime minister will establish a statutory council (協議会)for information sharing and countermeasures to prevent damage to Important Computers (重要電子計算機) — the law’s broader category of protected computer systems, including Specified Important Computers — from specified unauthorized acts. This statutory council will replace and strengthen the existing 2019 Cybersecurity Council (サイバーセキュリティ協議会). Council members may be required to provide relevant materials and must comply with statutory confidentiality requirements.

In practice, two things change under Pillar 1. First, ACD-specific reporting becomes a statutory duty for designated critical-infrastructure operators that use covered systems — including operators in sectors such as electricity, telecommunications, transport, and finance — thereby reducing the government’s dependence on voluntary disclosure once a qualifying incident is detected. Second, government-to-industry sharing enters a protected statutory framework designed to support the distribution of sensitive threat and mitigation information. Pillar 1, therefore, aims to give the government broader visibility into threats while providing participating organizations with actionable warnings. Joining the council is voluntary, but participating members must comply with statutory information-handling and confidentiality obligations and may be required to provide relevant materials.

Pillar 2 — Government Use of Communications Information (通信情報の利用)

Pillar 2 authorizes the government to obtain and analyze specified communications information through two principal pathways:

• Voluntary agreements with participating organizations (当事者協定)
• Defined government measures involving certain foreign-related communications (国外関係通信)

The latter includes foreign-to-foreign communications transiting Japan, as well as limited foreign-to-domestic or domestic-to-foreign communications associated with specified cyber threats. Before a government employee may review acquired data, automated selection (自動選別) must retain only defined mechanical information (機械的情報), such as IP addresses, timestamps, and command information, and delete the remainder. Government measures not based on consent generally require prior approval from the Japan Active Cyber Defense Oversight Commission.

In practice, two things change under Pillar 2. First, the government gains a standing statutory framework for obtaining and analyzing communications information for preventive cyber defense: Japan’s pre-ACD Communications Interception Act authorized interception only for criminal investigations of specified offenses and pursuant to a judge-issued warrant, and Japan lacked a comparable framework for systematic preventive collection and analysis. Second, the limit on what may be retained is enforced by the collection architecture rather than by rules governing analyst conduct. Officials set the selection criteria, but no person may examine the acquired data before the selection is complete, and unselected material must be deleted immediately.

Pillar 3 — Government Access and Neutralization Measures (アクセス・無害化措置)

Pillar 3 establishes access-and-neutralization authority through amendments to the Police Duties Execution Act and Self-Defense Forces Act. Specially designated Cyber Harm Prevention Measure Enforcement Officers (サイバー危害防止措置執行官) may order an administrator to take necessary measures against a computer associated with communications or electronic records identified as being used in malicious cyber activity, or may take those measures directly. Depending on the circumstances, those measures could include:

• Stopping or removing attack software
• Disrupting malicious command-and-control communications
• Changing system settings to prevent an attacker from continuing to control compromised infrastructure

The authority applies when an urgent need exists to prevent serious harm to life, physical safety, or property. Measures generally require prior approval from the Japan Active Cyber Defense Oversight Commission. When circumstances leave no time for advance approval, a measure may proceed, but the Commission must be notified promptly afterward and confirm whether the measure was appropriate.

In practice, Pillar 3 gives designated officers legal authority to intervene against attack infrastructure — including through actions that could otherwise constitute unauthorized access under the 1999 Act on Prohibition of Unauthorized Computer Access — rather than relying on criminal investigation or voluntary remediation. The authority can reach infrastructure outside Japan, but overseas operations are subject to additional restrictions. Police measures against systems not reasonably believed to be in Japan may be conducted only by officers of the National Police Agency (NPA) following consultation with the minister for foreign affairs. In cases involving highly organized and planned threats by a person outside Japan, the prime minister may order the Japan Self-Defense Forces (JSDF) to conduct Communications Protection Measures (通信防護措置) jointly with police, but only when the JSDF’s specialized technology or information is indispensable, and the National Public Safety Commission has requested or consented to JSDF involvement.

Pillar 4 — Institutional Restructuring and Independent Oversight (組織・体制整備・独立監督)

Pillar 4 restructures the government's cybersecurity institutions and creates an independent body to oversee the authorities established in Pillars 2 and 3. The reforms include:

• The National Cybersecurity Office (国家サイバー統括室, NCO) replaces the former National Center of Incident Readiness and Strategy for Cybersecurity (内閣サイバーセキュリティセンター, NISC).
• A new cabinet cyber officer (内閣サイバー官) leads the NCO and coordinates cybersecurity policy across the government.
• The restructured Cybersecurity Strategy Headquarters (サイバーセキュリティ戦略本部) is headed by the prime minister (内閣総理大臣) rather than the chief cabinet secretary, with all other ministers of state as members.
• The Japan Active Cyber Defense Oversight Commission (サイバー通信情報監理委員会) grants prior approvals, conducts ongoing inspections, reviews emergency measures taken without advance approval, and may issue recommendations.

In practice, two things change under Pillar 4. First, central coordination is elevated: the Strategy Headquarters is now chaired by the prime minister rather than the chief cabinet secretary, while the cabinet cyber officer and NCO support government-wide coordination. Second, the sensitive authorities in Pillars 2 and 3 are reviewed by a commission separate from the agencies implementing them. Rather than requiring judicial warrants, the framework uses independent administrative review: the Japan Active Cyber Defense Oversight Commission approves nonconsensual communications acquisition and ordinarily approves neutralization measures, conducts continuing inspections, and receives notification of emergency measures. It may issue recommendations and must report annually to the National Diet through the prime minister and publish a summary. Pillar 4 does not establish a separate offensive cyber authority; cross-border neutralization remains governed by Pillar 3.

Key Limits on ACD Authority

The ACD framework expands Japan’s preventive cybersecurity authorities but does not provide an unrestricted mandate for surveillance or offensive cyber operations. Its principal statutory boundaries include:

• Communications analysis is not general content surveillance. Human review is limited to automatically selected mechanical information, including technical data such as IP addresses, timestamps, and computer commands, meeting statutory criteria. Purely domestic communications are not a category that the government may target without the parties’ consent. If included in data provided under a Party Agreement (当事者協定), they must be excluded through automated selection and deleted without human review. Separate laws continue to govern warrant-based interception for criminal investigations.
• Access and neutralization authority is tied to specific mission objectives outlined in the ACD, rather than blanket provisions for government operators. Measures must address communications or electronic records used or reasonably suspected of being used in malicious activity and must be urgently necessary to prevent serious harm to life, physical safety, or property. Overseas measures carry additional procedural and international-law requirements.
• The JSDF cannot independently initiate Communications Protection Measures. Its involvement is limited to highly organized and planned threats by a person outside Japan that present a high risk of serious, difficult-to-recover disruption, and requires a case-by-case finding that the JSDF’s technology or information is essential in preventing that disruption. Qualifying action requires a prime ministerial order, a request from or the consent of the National Public Safety Commission, and joint implementation with the police.
• Reporting obligations are not universal. They apply to designated critical-infrastructure operators and covered systems, not to every Japanese organization or local government. Local governments instead fall under the separate Local Autonomy Act, which has required them, since April 1, 2026, to establish cybersecurity policies and implement corresponding measures. Qualifying local-government systems may still receive protection under the ACD framework.

Tokyo’s Rationale For the ACD

The ACD framework originates in Japan's 2022 National Security Strategy (NSS), which identified a rapidly deteriorating cyber threat environment and concluded that Japan’s legal authorities and institutional capabilities required expansion. The NSS stated that the “threat of cyberattacks, in which the risk of exposure is relatively low and attackers have an advantage, is growing rapidly.” In essence, cyberattacks were seen as low-risk (for the attackers), potentially high-impact means of disrupting operations, stealing information, or advancing strategic and financial objectives while complicating detection, attribution, and timely government response. The NSS set the objective that Japan’s cybersecurity response capabilities should be “strengthened equal to or surpassing the level of leading Western countries.” Tokyo’s rationale can be organized around three overlapping pressures: a sharp increase in malicious cyber activity observed by Japanese authorities; several high-profile cyberattacks that disrupted Japanese public- and private-sector operations; and gaps in the government’s legal authorities and institutional capabilities for sharing information, analyzing threats, and taking preventive action.

First, Japanese authorities have identified an increase in foreign-origin cyberattacks against Japanese public- and private-sector entities. A September 2025 Japanese NCO briefing document reported, citing the NPA, that 99.4% of observed attack packets in 2024 originated from overseas IP addresses (Figure 1). The same document, citing the National Institute of Information and Communications Technology (NICT), reported an approximately elevenfold increase in cyberattack-related communications between 2015 and 2024, from 63.2 billion observed packets in 2015 to 686.2 billion in 2024. The briefing described this volume as equivalent to approximately one attempted attack per IP address every thirteen seconds, although the underlying measurement represents packets received by sensors rather than confirmed, discrete attacks. Neither dataset identifies actors or intent, and the same briefing explains why the overseas share does not establish that the actors themselves are specifically based overseas: attacks are routed through chains of compromised intermediary machines, so tracing even a domestic-looking source usually leads to an overseas relay. Nevertheless, these figures indicate sustained growth in hostile traffic reaching the Japanese address space.

Figure 1: Reported cyberattack frequency against Japan (machine-translated) (Source: Japanese National Cybersecurity Office)

Executive Summary

This report provides insights and analysis to better understand the role of third-party vendors and guarantee marketplaces from the perspective of Tajin Group, a third-party vendor that advertises and provides services on two Telegram-based Chinese-language guarantee marketplaces, Dabai Guarantee and Xinbi Guarantee. This includes operational challenges, perspectives regarding the competition from other threat groups, and how Tajin Group adapts to changes in its operating environment.

Additionally, we identified that Chinese-language guarantee marketplace users and third-party vendors are increasingly using third-party services to purchase and sell Telegram usernames and anonymous virtual numbers. Through these services, Chinese-speaking criminals can link multiple Telegram usernames and an anonymous virtual number (in lieu of SIM cards) to a single Telegram account. This activity indicates a continued evolution and adaptability among these threat actors, who are strengthening their operational security (OPSEC) measures through tactics such as using anonymous virtual numbers to create Telegram accounts to avoid detection and reach a wider audience.

The phishing, payment card theft, and money laundering activities of Tajin Group, guarantee marketplaces, and their third-party vendors can negatively impact banks, fund transfer services providers, cryptocurrency exchanges, and individuals vulnerable to scam and fraud-related campaigns. As Tajin Group is a single third-party vendor, the potential financial gains in the global payment industry are likely to incentivize other threat groups operating on Chinese-language guarantee marketplaces to conduct campaigns by replicating Tajin Group’s tactics, techniques, and procedures (TTPs) on a global scale.

Key Findings

• Tajin Group is mainly involved in phishing, payment card theft, and money laundering. The group actively targeted mainland Chinese citizens and Chinese banks and demonstrated a nuanced understanding of the prerequisites required to transfer funds overseas or use other payment cards remotely.
• Tajin Group conducts extensive testing involving payment cards belonging to multiple countries on the financial platforms CCAvenue and Geidea. They are well-versed in financial crimes and have listed multiple Bank Identification Numbers (BINs) for payment cards from twelve countries.
• Tajin Group constantly seeks cooperation with other threat groups to use direct payment channels that accept UnionPay, VISA, Mastercard, JCB, and Apple Pay; exploit 2D, 3D, and other payment gateways; and UAE Dirhams and electronic gift cards for their financial theft and money-laundering operations.
• Tajin Group has pivoted from Dabai Guarantee to Xinbi Guarantee, showcasing that third-party vendors do not necessarily stay loyal to a single guarantee marketplace platform. The threat group also detailed their operational challenges, intense competition from competitors, and trust issues with their previous payment card suppliers.
• Operators of Tajin Group have sold and bought at least 100 Telegram usernames and multiple phone numbers from Fragment Market, a platform that facilitates the buying and selling of virtual, anonymous phone numbers and Telegram usernames, further anonymizing their operations.

Background

Guarantee marketplaces have become increasingly popular among Chinese cybercriminals as viable alternatives to Chinese-language dark web marketplaces since Huione Guarantee and its business model gained prominence around 2021. Based on our research and previous reports, we have observed that multiple third-party vendors who are usually involved in advertising the sale of malware, databases, phishing kits, and money laundering services on dark web marketplaces have also begun to use Telegram-based guarantee marketplaces to advertise their services or seek cooperation on these platforms. These marketplaces act as a powerful force multiplier to strengthen cooperation among Chinese-speaking threat groups in recruitment, crowdsourcing information, sharing resources, and deploying personnel to commit crimes that require in-person interactions. For additional insights, see our previous report “Evolution of Chinese-Language Guarantee Telegram Marketplaces”.

We noted that these Chinese-language guarantee marketplaces typically consist of hundreds to thousands of third-party vendors, each operated by different Chinese-speaking threat actors (some syndicates) across the globe. To better understand how third-party vendors operate on these guarantee marketplaces and how they contribute to cybercriminal activities, Insikt Group analyzed the activities of Tajin Group, a threat group that conducts phishing campaigns, payment fraud, money laundering, carding, and exploits 3D and 2D payment gateways, among others. Chinese-language guarantee marketplaces typically follow a strict rule requiring that third-party vendors use only one guarantee marketplace at any given time, and we identified that Tajin Group complied with this rule by ceasing activities on Dabai Guarantee before pivoting to Xinbi Guarantee. Tajin Group observed Chinese etiquette and showed respect for the Chinese-language guarantee marketplace ecosystem, demonstrating that there is likely a common understanding between the operators of these guarantee marketplaces by having a system where no third-party vendors are allowed to make use of multiple platforms to advertise and conduct their campaigns.

Overview of Tajin Group

Tajin Group (踏金集团;踏金 [Tajin] translates to “stepping on gold” in Mandarin) is a Chinese-speaking threat group that focuses on phishing, carding, financial fraud, and money laundering. Insikt Group observed that Tajin Group used to be a third-party vendor operating on Dabai Guarantee from May 2025 to April 2026, but pivoted to Xinbi Guarantee around May 2026. Dabai and Xinbi guarantee marketplaces are known to be populated with third-party vendors that provide various services that facilitate cybercriminal activities, including money-laundering methods and services, the sale of compromised social media and e-commerce accounts, SIM cards, data containing personally identifiable information (PII), malware-as-a-service (MaaS), deepfake technology, know-your-customer (KYC) bypass services, and other illegal activities.

As guarantee marketplaces typically require their vendors to stake cryptocurrency as deposits, Tajin Group claimed to have deposited 208,848 in Tether (USDT) on Xinbi Guarantee. The deposit amount often indicates vendors’ scale of operations, where larger deposit amounts reflect larger-scale operations. By comparison, most vendors on Chinese-language Telegram guarantee marketplaces typically deposit only a few hundred to a thousand USDT. As shown in Figure 1, the deposit amount of 208,848 USDT is significantly larger than that of most other third-party vendors.

Figure 1: Tajin Group’s channel @ttjt claimed that the group is a vendor on Xinbi Guarantee with the corresponding channel @xb8848, and that the group has deposited 208,848 USDT into Xinbi Guarantee Marketplace (Source: Telegram)

Executive Summary

H1 2026 activity showed a continued adversary preference for abusing legitimate tools, trusted platforms, and routine workflows already present in enterprise and consumer environments. Threat actors used exposed software, developer tools, remote access utilities, payment workflows, and third-party services to gain access, steal credentials, move laterally, and monetize intrusions while blending into expected activity. This emphasis on evasion through normalcy rather than technical novelty increases the risk that malicious activity will progress through approved tools and trusted services before defenders recognize it, reinforcing the need for stronger exposure management, identity and credential governance, behavioral detection, developer-environment security, backup resilience, mobile fraud monitoring, and third-party oversight.

AI-enabled cyberattacks became more visible in H1 2026, but remained mostly additive to established intrusion tradecraft. In the vulnerability ecosystem, AI-assisted research increased the volume of vulnerability reports, which, moving forward, could further compress remediation timelines by accelerating exploit-path analysis and lowering exploit-development costs for skilled operators. In malware activity, observed AI-enabled capabilities largely aligned with lower-to-mid-level stages of Recorded Future’s AI Malware Maturity Model (AIM3), where AI supported discrete functions such as persistence, user interface (UI) interaction, malware development, and delivery rather than fully autonomous operations.

Vulnerability exploitation broadened across enterprise operating systems, application frameworks, and network and security management products. Insikt Group identified 215 actively exploited common vulnerabilities and exposures (CVEs), and the most consequential cases combined network reachability, few access prerequisites, and code execution. Campaign reporting also showed that threat actors reused established post-exploitation playbooks across both newly disclosed and long-standing vulnerabilities, making exposure and impact more informative indicators of operational risk than vendor ranking or severity score alone. Across phishing and malware-delivery operations, threat actors repeatedly relied on familiar execution, obfuscation, discovery, and payload-transfer techniques rather than novel capabilities. Supply-chain compromises targeted package managers and developer environments, including AI-enabled tooling, where compromised credentials, trusted integrations, and software distribution channels enabled propagation into downstream cloud and software ecosystems. Other prominent activities included mobile malware enabling payment fraud through Near Field Communication (NFC) abuse and early AI-assisted workflows, as well as Magecart campaigns leveraging trusted third-party services and checkout manipulation.

The common risk across these threats is that malicious activity can progress through legitimate tools, trusted services, and routine workflows before defenders recognize it as part of a broader intrusion. Defenders should therefore prioritize vulnerabilities that can be exploited remotely or enable code execution, focus detection on suspicious sequences of behavior rather than isolated events, and strengthen controls protecting developer credentials, backup infrastructure, company-owned mobile devices, and payment environments.

Key Findings

• Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025. 142 of the 146 vulnerabilities that could be exploited without prior authentication were also network-accessible, and 60 of the 82 remote code execution (RCE) vulnerabilities combined network access with no authentication requirement.
• Similar to H1 2025, Recorded Future Malware Intelligence data showed the continued prominence of remote access trojans (RATs) throughout H1 2026. RATs led Insikt Group malware reporting, and Recorded Future Malware Intelligence submissions identified AsyncRAT as the top submitted malware family by total unique hashes and command-and-control (C2) configurations. AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS RAT remained in the top ten across H1 2025 and H1 2026.
• H1 2026 AI-enabled malware activity was concentrated in AIM3 Levels 1 to 3, with threat actors using AI to augment existing malware and intrusion workflows rather than conduct fully autonomous attacks.
• Ransomware operators continued to refine payload capabilities while relying on established intrusion methods, including ClickFix-style social engineering; exploitation of public-facing applications; abuse of legitimate tools such as s5cmd, PsExec, and AnyDesk; and techniques intended to reduce victims’ recovery options.
• Android NFC malware was the most notable mobile malware trend in H1 2026, with families such as NFCShare and NGate abusing device NFC functionality to steal payment card data, relay contactless transactions, and facilitate ATM cash-outs.

AI-Enabled Cyberattacks

AI-enabled cyber threats became more visible in H1 2026, but the available evidence indicates that most observed activity still augmented existing tradecraft rather than replacing it with fully autonomous operations.

In the vulnerability ecosystem, the release of Anthropic’s Claude Mythos Preview reinforced the growing relevance of frontier models to offensive and defensive security research. Broader vulnerability reporting also increased following the model’s release under Project Glasswing: June National Vulnerability Database (NVD) disclosures were 43% above the previous six-month average, while Mozilla reported that Mythos Preview identified 271 vulnerabilities that it fixed in Firefox 150, compared with 22 security flaws fixed following its earlier testing with Claude Opus 4.6. Vendors, AI developers, and bug-bounty platforms like Microsoft, Anthropic, and HackerOne have also reported rising vulnerability discovery or submission volumes alongside broader adoption of AI-assisted research, adding pressure to validation, disclosure, and remediation workflows.

Despite the increase in vulnerability reports, AI has not changed the fundamentals of vulnerability management: Attackers still need to identify, validate, weaponize, and operationalize vulnerabilities that offer reach, reliability, and return on investment. This means that only a small proportion of newly discovered vulnerabilities are likely to be a threat.

Nonetheless, AI-enabled vulnerability research can still increase defender workload in three ways: It can produce more credible vulnerability reports that require triage; reduce the time available to mitigate exploitable vulnerabilities by accelerating exploit-path analysis and weaponization; and lower the cost of exploit development by helping skilled operators produce proof-of-concept (PoC) code, test attack paths, and iterate toward weaponizable exploits more quickly. For defenders, the near-term issue is therefore not a sudden flood of fully autonomous exploitation, but a narrower window to determine which vulnerabilities matter most and remediate them before threat actors operationalize them. Additionally, early H2 2026 reporting on the July 2026 Hugging Face incident demonstrated that autonomous agents can perform discovery, validation, weaponization, and operationalization with limited human intervention. Defenders should prepare by automating vulnerability enrichment, prioritization, and mitigation to reduce the gap between machine-speed attack development and defensive response.

Figure 1: How automated capabilities will likely impact reporting, exploit development, and impact (Source: Recorded Future)

Malware reporting in H1 2026 showed more direct experimentation with AI-enabled capabilities compared to H1 2025. ESET identified PromptSpy as the first known Android malware to use generative AI (GenAI), using Google’s Gemini to interpret on-screen UI elements and generate step-by-step instructions to improve persistence across device layouts. Reporting on CANFAIL also showed threat actors using LLM-generated decoy logic or AI-assisted development artifacts to complicate analysis and facilitate malware delivery against Ukrainian organizations. These examples suggest that threat actors are testing AI in ways that can solve narrow operational problems: adapting to user interfaces, generating code or decoy logic, improving obfuscation, and supporting analyst confusion.

Threat actors also used AI-related products and ecosystems as delivery mechanisms. In February 2026, VirusTotal reported malicious OpenClaw skills disguised as useful automation for a local AI agent ecosystem, while Malwarebytes reported fake OpenClaw installers hosted on GitHub and surfaced through search results to deliver infostealers and proxy malware. This activity shows that attackers are exploiting user interest in AI tools in the same way they have historically abused popular software brands, distributing trojanized installers, malicious extensions, fake repositories, and dependency-based payloads through otherwise familiar channels.

As of H1 2026, Insikt Group assesses that most observed AI-enabled malware activity aligns with the low-to-mid-level stages of Recorded Future’s AI Malware Maturity Model (AIM3), specifically experimentation, adoption, and optimization, rather than fully autonomous AI-driven malware operations. Per the Recorded Future’s AIM3 framework, most publicly observed “AI malware” remains concentrated in Levels 1 to 3, where AI supports discrete operational tasks such as UI interpretation, persistence guidance, transaction timing, or operator guidance. Therefore, the near-term risk is not primarily self-directed malware operating independently, but rather the use of AI to make existing intrusion workflows faster, more convincing, more adaptive, and harder to analyze. Defenders should not expect a single control, model, or endpoint detection layer to reliably identify all AI-enabled malware activity. Instead, organizations should use defense-in-depth controls that can detect or disrupt different parts of the attack chain, including endpoint detection for script or installer activity tied to suspicious AI-themed downloads, extensions, repositories, or packages, mobile device management for accessibility service abuse and automated UI interaction, and restrictions on unapproved AI tools and installers.

Vulnerability Exploitation Trends

Key Takeaways

• Network reachability and low access requirements compounded risk, as 142 of the 215 exploited CVEs were network-accessible and could be exploited without prior authentication; 60 of those also enabled RCE, while public exploits were available for 66 (31%).
• Defenders faced both newly exploited flaws and persistent patch backlogs, as 162 CVEs were disclosed in 2025 or 2026, 53 predated 2025, and seventeen were dated from 2020 or earlier.
• Threat actors reused post-exploitation playbooks across different initial vulnerabilities; StrikeShark applied the same six-tool stack across thirteen CVEs, while Storm-1175 linked credential theft, remote execution, data transfer, and ransomware tooling across ten. More broadly, stealware was the most common malware category, followed by offensive security tools, backdoors, remote access trojans, and ransomware.

Microsoft Remains the Leading Vendor for Exploited Vulnerabilities

In H1 2026, Insikt Group identified 215 actively exploited vulnerabilities, up 34% from 161 in H1 2025. From January to June, the number of exploited vulnerabilities increased by an average of seven vulnerabilities per month. Microsoft remained the vendor most frequently associated with exploited vulnerabilities, accounting for 40 unique CVEs, up from 28 in H1 2025, a 43% year-over-year increase. Red Hat ranked second with fifteen CVEs, Cisco third with thirteen, Vercel fourth with eleven, and Fortinet fifth with nine. By comparison, H1 2025’s top affected vendors after Microsoft were Apple with eight CVEs, Ivanti with seven, Linux with six, and SonicWall, Google, Fortinet, and Craft CMS with four each.

The exploited vulnerabilities affected products from 98 vendors, 67 of which were associated with only one CVE. This indicates that exploitation was not confined to the most frequently affected vendors. For defenders, this supports maintaining risk-based remediation across the full software inventory, including less common products that may receive less monitoring or slower patching than widely deployed enterprise platforms.

At the product-family level, Windows and Windows Server accounted for the largest H1 2026 concentration, with twenty unique CVEs, followed by Red Hat Enterprise Linux with thirteen, Vercel Next.js with eleven, Cisco Catalyst SD-WAN Manager with eight, and Apple iOS and iPadOS with seven. While Microsoft exploitation remained prominent, H1 2026 activity also increasingly involved enterprise Linux, application frameworks, and network management products. Several vendors’ vulnerabilities were also driven by concentrated exploitation of one product family rather than uniform interest across the vendor’s portfolio: all eleven Vercel CVEs centered on Next.js, eight of Cisco’s thirteen affected Catalyst SD-WAN, and thirteen of Red Hat’s fifteen affected Red Hat Enterprise Linux.

Figure 2: Most affected vendors (top ten, including ties) by number of actively exploited vulnerabilities in H1 2026 (Source: Recorded Future)

Executive Summary

Insikt Group has identified a series of BlueDelta initial access campaigns conducted between late September 2025 and early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye. The campaigns delivered a lightweight Windows batch-script backdoor, dubbed "HOOKEDGE," via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain's Ministry of the Presidency, Justice and Relations with the Cortes, created shortly after a September 2025 meeting between Spanish and Moldovan officials.

Insikt Group assesses with moderate confidence that this activity was conducted by BlueDelta (which overlaps with APT28, Fancy Bear, and Forest Blizzard), a Russian state-sponsored threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). This assessment is based on significant code and tradecraft overlap between HOOKEDGE and the HEADLACE backdoor used in prior BlueDelta campaigns, consistent infrastructure patterns, and targeting consistent with known Russian intelligence collection priorities.

HOOKEDGE shares HEADLACE's core architecture, abusing legitimate webhook services for command-and-control (C2), payload staging, and data exfiltration, enabling malicious activity to blend with legitimate network traffic while reducing the operational overhead of dedicated infrastructure. The implant has undergone continuous refinement between September 2025 and April 2026, likely to evade automated sandbox environments and adapt to reduced free-tier API limits on webhook[.]site.

BlueDelta continues to invest in lightweight, easily adaptable initial-access tooling to support intelligence collection against European government and diplomatic targets. Rather than introducing new capabilities, the group has steadily refined its existing tradecraft, emphasizing operational resilience by adapting established tooling to evolving defensive measures and infrastructure constraints.

Organizations should prioritize blocking macro execution from internet-originated documents and implementing detection coverage for scheduled task abuse, headless Microsoft Edge execution, and outbound connections to webhook services.

Key Findings

• Between late September 2025 and early April 2026, BlueDelta conducted a series of initial access campaigns against defense manufacturing and diplomatic organizations in Romania, Spain, and Türkiye. BlueDelta used macro-enabled Word documents to deploy HOOKEDGE, a lightweight batch-script backdoor that shares significant code and tradecraft overlap with BlueDelta’s earlier implant, HEADLACE.
• The campaigns employed both diplomatic-themed and generic lures. Early activity impersonated Spanish government material, while later campaigns adopted generic macro-enablement lures. One diplomatic lure was created shortly after a meeting between Spanish and Moldovan officials, potentially reflecting an effort to collect intelligence relevant to Russia ahead of Moldova’s September 2025 parliamentary elections.
• BlueDelta continued to refine HOOKEDGE between September 2025 and April 2026, introducing changes to lure documents, execution methods, and beaconing intervals while maintaining the malware's core functionality and infrastructure model.
• For targets assessed as having higher intelligence value, BlueDelta deployed a second-stage HOOKEDGE payload with a much shorter beaconing interval. This gave operators more responsive tasking and follow-on activity, while keeping the webhook endpoints used for initial access from being exhausted.
• BlueDelta has historically demonstrated a preference for legitimate internet services (LIS) to facilitate C2, payload staging, and data exfiltration, with webhook[.]site’s free tier serving as the group’s exclusive choice across these campaigns.

Background

BlueDelta is a Russian state-sponsored threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), and overlaps with activity publicly tracked as APT28, Fancy Bear, and Forest Blizzard. The group has conducted espionage-focused cyber operations for more than a decade, consistently targeting government, diplomatic, defense, and policy-related organizations in support of Russian intelligence requirements.

BlueDelta has a well-documented history of obtaining initial access through spearphishing, credential theft, and lightweight custom tooling. Previous campaigns have employed malicious documents, Windows batch scripts, and living-off-the-land techniques (LotL), frequently abusing LIS and free web infrastructure for C2, payload staging, and data exfiltration. Insikt Group documented BlueDelta's 2023 use of the HEADLACE malware family, a lightweight, batch-based backdoor used during the early stages of intrusions to execute follow-on payloads and commands in initial access campaigns targeting organizations across Europe.

The activity detailed in this report represents a direct continuation of those operations. The HOOKEDGE backdoor shares significant code and tradecraft overlap with HEADLACE, demonstrating BlueDelta's continued preference for lightweight, easily modified malware that can be rapidly adapted to operational requirements. Similar activity has also been reported publicly by Lab52 under the name Operation MacroMaze.

Threat Analysis

Lure Documents and Targeting

BlueDelta's choice of lure documents across these campaigns reflects deliberate targeting of European diplomatic audiences and reveals collection priorities consistent with known Russian intelligence requirements. Between late September 2025 and early April 2026, Insikt Group identified several malicious macro-enabled Word documents likely used by BlueDelta in initial access campaigns targeting government or diplomatic personnel in multiple European countries.

The earliest identified lure, first seen on September 26, 2025, purported to be a September 15, 2025, meeting agenda from Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, as shown in Figures 1 and 2. Although the document’s authenticity could not be verified, BlueDelta has historically used authentic government documents, including publicly available material, as phishing lures.

Figure 1: Screenshot of Spain’s Ministry of the Presidency, Justice, and Relations with the Cortes document (Source: Recorded Future)

Executive Summary

Insikt Group has identified several clusters of activity linked to PurpleDelta, Recorded Future's designation for North Korean IT workers, comprising multiple operators likely based in China. Between late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors. PurpleDelta operators maintained at least 22 fabricated personas across multiple clusters, some of which were supported by AI-generated profile photos, custom-configured ChatGPT assistants, and identity documents sourced from an illicit ID-generation service, and were highly likely to be actively employed by at least ten organizations.

PurpleDelta operators demonstrate a high operational tempo to this day. In some cases, the operators have applied to at least 60 positions per day across multiple job platforms, used multi-account management browsers and separate Google Chrome profiles to manage distinct personas simultaneously, and maintained detailed tracking spreadsheets to coordinate applications across identities. During job interviews, they used screen recording software alongside AI transcription and chatbot tools to generate real-time answers, often repeating ChatGPT responses verbatim. Once employed, operators recorded internal meetings at victim organizations and used Google Translate to draft pre-written excuses to justify using personal devices and bank accounts for work. Evidence from recorded sessions also indicates that PurpleDelta operators coordinated via Telegram and Slack, and at least two individuals were identified as facilitators who maintained company-issued hardware for the PurpleDelta operators.

Insikt Group assesses that this cluster of activity is consistent with the broader North Korean IT worker threat and presents material risk to organizations hiring for remote technical roles. Companies that have observed indicators listed in Appendix A should treat this as a potential active compromise and review the employment history and access privileges of matching individuals.

Key Findings

• Insikt Group has identified at least 22 fabricated personas linked to multiple PurpleDelta clusters that submitted applications to over 1,100 companies across the software, staffing, healthcare, and financial sectors, with operators submitting as many as 60 or more applications per day across at least 8 job platforms.
• These clusters of PurpleDelta operators are highly likely to have been actively employed at ten or more organizations, with confirmed or probable placements at companies that pose an ongoing and material insider threat.
• PurpleDelta demonstrated a high degree of operational sophistication, using multi-account management browsers, multiple Chrome profiles, AI-generated profile photos, custom ChatGPT assistants, and real-time AI transcription tools to deceive hiring managers during interviews, sometimes repeating AI-generated responses verbatim.
• Once employed, PurpleDelta operators recorded internal meetings at victim organizations, used screen recording software during work sessions, and drafted pre-written Google Translate excuses to justify the use of personal devices and personal bank accounts.
• Video evidence indicates that PurpleDelta operators use identity-brokering services, account-renting via AnyDesk, and multi-accounting tools, and coordinate via Telegram and Slack, with support from facilitators who procure and maintain company-issued hardware on the operators' behalf.

Background

PurpleDelta is Recorded Future's designation for the cluster of activity associated with North Korean IT workers, a state-directed network of covert technology laborers operating across global freelancing platforms and corporate hiring pipelines. The group overlaps with threat actor designations used by other vendors, including Jasper Sleet, UNC5267, Wagemole, and Famous Chollima. PurpleDelta operators pose as independent contractors and job-seeking developers to secure remote employment at organizations worldwide, with earnings systematically funneled through layers of individual facilitators, shell companies, and money-laundering front companies, ultimately financing the North Korean regime's sanctioned military and nuclear programs.

PurpleDelta operators employ extensive persona management tradecraft to obscure their nationality and true affiliation. Each operator maintains multiple fabricated identities across platforms, including GitHub, LinkedIn, Medium, Upwork, and a range of smaller freelancing sites, with personas deliberately constructed to project credibility through aged accounts, curated technology stacks, and cross-platform social proof. These identities are reinforced through the use of AI tools, temporary phone number services, anti-detect browsers, and resume-building platforms. In addition to generating illicit revenue, Insikt Group has observed signs of overlap with several North Korean state-sponsored groups, including PurpleBravo, a related cluster of activity that deploys malware through fraudulent recruitment campaigns targeting software developers primarily in the cryptocurrency space, indicating the broader potential for intelligence collection, downstream compromise, and supply-chain risk.

Threat Analysis

As part of Recorded Future’s ongoing tracking of PurpleDelta, Insikt Group has documented multiple clusters of North Korean IT workers since 2025 that are likely based in China. Operators in one of these clusters applied to jobs at over 1,100 companies. Almost half of the companies (~41%) to which the operators applied were in the IT and software services space, followed by staffing and consulting (~26%), and healthcare and biotechnology (~10%). Roughly 80% of the companies are based in North America, but the operators applied to companies in every region of the world. Many of the operators have a nexus in Shenyang, China, as indicated by their professional profiles, social media presence, and artifacts observed on their systems.

Figure 1: Breakdown of industries of the companies applied to by PurpleDelta operators (Source: Recorded Future)

Executive Summary

Crypting services and products modify malicious payloads to help threat actors bypass detection, complicate analysis, and preserve malware usability after exposure. Although basic crypting consists of encrypting or obfuscating a customer-supplied payload, mature providers increasingly operate as broader malware-enablement services. Their offerings often combine payload wrapping, in-memory execution, anti-analysis checks, process injection, persistence options, delivery packaging, and post-detection “cleaning” or re-crypting services.

Insikt Group analyzed 24 threat actors advertising crypting services and products within the past year and identified a market that is competitive, reputation-driven, and heavily focused on Windows payloads. Providers advertise through underground forums, restricted communities, chat platforms, clearnet sites, and social media accounts. They compete through tiered pricing, antivirus (AV) detection scores of crypted samples, discounts, malware-developer partnerships, private or shared stubs, and promised turnaround times for re-crypting detected payloads.

Advertised crypter capabilities vary by provider, but the underlying objectives are consistent: reduce detection, delay or prevent analysis, and support stealthier payload execution. Because crypted payloads are designed to defeat both static and dynamic analysis, defenders should prioritize behavioral detection over static indicators. See the Outlook and Mitigations section for details.

Key Findings

• AV and endpoint detection and response (EDR) tools should not be treated as sufficient standalone protection against crypted payloads. Defenders should pair endpoint controls with behavioral detection, telemetry correlation, upstream hunting, suspicious process monitoring, and rapid triage of suspicious samples.
• Popular crypting service providers primarily advertise support for Windows payloads, with no identified advertising for macOS or Linux crypting services. However, although Windows environments were most frequently targeted by the services reviewed in this report, they are not inherently more susceptible to the execution of crypted payloads.
• Crypted payloads increase the likelihood of successful malware execution and delayed detection, but they do not independently provide end-to-end intrusion capability. Downstream activities, such as lateral movement, data theft, ransomware deployment, and follow-on compromise, depend on the embedded malware and the operator's objectives.
• Crypter risk varies significantly with provider maturity and technical capability: advanced crypters offer portability, anti-analysis, process injection, persistence, and security product bypass capabilities, whereas less-advanced crypters generally provide basic payload obfuscation techniques.
• Crypter capabilities are generally not novel individually, but their commercial packaging makes established defense-evasion tradecraft easier to access, reuse, and operationalize. The significance of crypters lies less in technical innovation than in making mature evasion methods available as paid services.

The Crypter Landscape

What Is a “Crypter”?

“Crypting” is what threat researchers generally refer to as a service or product wherein a file, almost exclusively a malicious executable of some kind, is encrypted to bypass malware detection technologies. The result of a crypting service is a malicious payload that modifies the supplied executable in ways that deter defenders and endpoint security solutions (namely, AV and EDR products) from detecting and analyzing it.

How Does Crypting Work?

While the core functionality of a crypting service or product is to encrypt a payload, services vary in the capabilities they provide. These capabilities can range from the encryption algorithms used, which are often proprietary, to behavioral adjustments for how the resultant payload will execute in a victim environment. For instance, many crypting services include execution guardrails or methods for indicator suppression, such as ensuring execution fails in virtual environments or performing environmental scanning before execution to determine whether the payload is running in an analysis or sandbox environment.

By using crypting services, threat actors can evade detection and prevent their malicious code from being easily exposed to researchers, an important consideration for those who wish to reuse payloads for extended periods without detection.

Who Is Selling Crypting Services?

The crypter landscape comprises a community of criminal threat actors that often operate on restricted or closed networks, including the dark web and underground forums, to market and sell their crypting services. Threat actors may also opt to market their services on clearnet websites they own and operate. In some instances, threat actors may be accessible only via messaging platforms, such as Telegram or TOX, which likely mask their exposure and reduce the likelihood of sensitive data leaking through forum chats. Finally, some threat actors have created social media accounts where they post updates on their services, partnerships, pricing, and links through which interested buyers can inquire about purchases.

Additionally, partnerships between malware developers and crypting service providers are not uncommon. For instance, a well-established crypting service provider on underground forums, “GoldenCrypt”, is reportedly affiliated (1, 2, 3) with multiple malware families, including FvncBot, Albiriox, and Mirax. The level of affiliation between a crypting service provider and a malware developer can range widely, from providers with loose reputational ties to developers who are mainly affiliated with one hacking group and will opportunistically provide services to third parties. However, these partnerships are often a marketing strategy that crypting service providers use to secure kickbacks and boost positive reputational sentiment.

All of these services come at widely varying costs, typically based on core factors. For instance, crypting service fees are often tied to the volume and types of files to be encrypted, as well as the duration of service, with almost all crypting service providers offering tiered payment options along these lines. The actual prices of these tiers are pegged to additional factors related to the provider and their product, including the reputation of the threat actor, the capabilities of their encryption service, the promise that a crypted payload is fully undetectable (FUD), and additional features provided to the buyer. Threat actors will support the assertion that their payloads are FUD by using multi-AV platforms, the most common of which is KleenScan, a service that allows threat actors to scan samples without storing and potentially exposing the samples to researchers. As with other legitimate services, service providers also advertise discounts and similar deals to remain competitive with their peers.

Who Is Using Crypting Services?

Many threat actors have been observed in the wild using crypting services due to their stealth capabilities. All malware types can be crypted, and the key factors determining whether a threat actor can use a crypting service are the targeted device’s operating system and the payload’s programming language. For instance, the most common crypting services are geared toward Windows .exe and .dll payloads. Still, considerations such as whether a payload is coded in .NET, C, or C++ can provide additional capabilities for crypted payloads or, in other instances, prevent certain payloads from being crypted.

While the use of crypting services is common among threat actors, it is by no means ubiquitous. Due to sometimes prohibitive pricing strategies and an environment that often relies on reputational checks before purchase, crypting services are often used only by well-established criminal threat actors or larger threat actor groups that have their own specialist or custom tooling for crypting payloads. Furthermore, as discussed previously in this report, not all crypting services support all types of payloads. While this does not expressly ensure that a payload cannot be crypted, threat actors seeking to crypt more unique types of executables may find their options limited or even nonexistent.

Nevertheless, crypting services are commonly marketed by threat actors and are commonly implemented by professional threat actor groups. Multiple open-source reports on high-impact cyberattack campaigns have supported this. For instance, in July 2025, eSentire reported an association between PureRAT, a remote access trojan (RAT) first advertised in January 2023, and GhostCrypt, a crypting service sold by an underground forum member of the same moniker, in an attack that impacted a public US accounting firm in May 2025.

Crypting Service Characteristics

Insikt Group investigated 24 crypting service or product providers active within the past year and identified the various capabilities advertised by each. This information helped determine the capabilities most commonly displayed by crypting services, products, and the payloads they create, and provided insight into the capabilities most desirable to customers buying these services and products. A heat map of the techniques advertised by these threat actors is shown in Figure 1, below. (The list of MITRE ATT&CK techniques shown in Figure 1 can also be found in Appendix B.)

Figure 1: MITRE ATT&CK Enterprise tactics and techniques described in crypting advertisements (Source: Recorded Future)

Summary

Neurotechnology is rapidly moving beyond clinical use cases, expanding the attack surface for sensitive neurological and biometric data: As adoption grows, larger volumes of brain activity, biometric, and behavioral data will be collected by commercial platforms, creating new opportunities for data theft, misuse, and exploitation.

China and the United States (US) are engaged in strategic competition in neurotechnology development: The US leads in the number of neurotechnology firms, and brain-computer interface (BCI) research has been a long-term research priority for the US military. At the same time, China’s five-year guidance for BCI development, subsidies for major wearable technology firms, and military research into human-machine integration suggest that neurotechnology is a strategic priority.

Leading neurotechnology companies are likely to face increased targeting for intellectual property (IP) theft: Because neurotechnology is costly to develop and strategically valuable, companies in this sector are likely to become attractive targets for state-sponsored espionage, insider threats, and cyber-enabled theft. Successful IP theft could erode the competitive advantage of companies that invest heavily in research and development (R&D). Military and higher education research laboratories are also likely to be targeted for access to R&D and related data.

Neurological and biometric data will become an increasingly valuable target for cybercriminals and state-linked actors: Attackers may seek to exfiltrate these datasets for extortion, surveillance, strategic intelligence, or model development. The sensitivity of this data could make breaches particularly damaging for affected individuals and companies, making it an attractive target for extortion-focused cybercriminals.

Regulatory and national security scrutiny of neurological data will likely intensify: Existing privacy frameworks in the European Union (EU) and several US states already provide heightened protections for neurological or biometric data, but rapid advances in neurotechnology may outpace consumer protection laws.

Figure 1: Key threats in neurotechnology and how they will evolve (Source: Recorded Future)

Executive Summary

The United States (US) will almost certainly remain at heightened threat from physical threat activities conducted by homegrown and domestic violent extremists (HVEs and DVEs, respectively) during the next twelve months. Since the last installation of this report in July 2025, there has been a substantial increase in mass-casualty attacks and attack plots by Islamic State (IS) supporters, assassinations and attempted assassinations of US government officials and high-profile public figures by anti-government and anti-authority violent extremists (AGAAVEs), and multiple plots by anarchist violent extremists (AVEs) to cause substantial damage to facilities using destructive devices.

Coinciding with these trends, the Iran War will almost certainly have significant ramifications for the violent extremism threat landscape in the US over the next twelve months, even if the war has concluded. Based on Insikt Group’s observations to date, Iranian external operations are less likely to be a significant cause of violent extremist threat activity in the US than HVEs and DVEs motivated by the second-order sociopolitical and economic effects of the war. Iran almost certainly intends to guide or inspire HVEs to conduct physical threats in the US on its behalf. However, Iran-nexus physical threat activities in the US during the war have been largely aspirational, reliant on low-sophistication, financially motivated threat actors, and disrupted by law enforcement in the early planning stages of attacks. This likely suggests Iran lacks the capabilities necessary to guide large-scale HVE attacks in the US at present.

In contrast, the second-order effects of the Iran War will almost certainly add to the list of grievances and causes for mobilization popular among a wide swath of US violent extremists, likely increasing the risk of violent extremist physical threat activities during the next twelve months. Specifically, the war surfaced salient domestic and international political issues that have historically mobilized US violent extremists. These controversies include US military involvement in the Middle East; the relationships among the US, Israel, and other Middle Eastern countries; the state of the US economy; and the involvement of specific US private-sector entities in US foreign policy planning and military operations. In addition to motivating violent extremists, these issues will almost certainly influence US political discourse during the 2026 midterm elections in the US; the election cycle itself will very likely drive additional US violent extremist threats in late 2026 and early 2027.

Public- and private-sector organizations face differing levels of violent extremist threats due to their sector, industry, role, associations, and attack surfaces. While different categories of violent extremists employ various TTPs depending on their ideology and objectives, Insikt Group continues to assess that targeted attacks against facilities and high-profile personnel constitute the predominant violent extremist risks to most organizations. Overall, entities associated with US foreign policy decision-making, immigration enforcement, the Israeli government and military, or the provision of critical infrastructure services very likely face heightened risks from violent extremists. Threat intelligence — including features within the Recorded Future Intelligence Operations Platform — can support organizations’ efforts to identify, analyze, and mitigate threats posed by US-based violent extremists.

Key Findings

During the next twelve months:

• Iran-nexus physical threat actors will very likely attempt to target facilities and personnel in the US that they associate with the US or Israeli government and military, although the sophistication, impact, and frequency of these plots will likely be limited by Iran’s capability gaps.
• HVE IS supporters will be the most likely violent extremist threat actors to conduct mass-casualty attacks in the US, particularly during the period between October 2026 and January 2027.
• Instructional and ideological material produced by the neo-Nazi accelerationist movement will very likely continue to drive mass-casualty attack plots and sabotage against critical infrastructure, despite the fragmentation of neo-Nazi accelerationist organizations and online networks.
• AGAAVEs motivated by partisan animus will almost certainly pursue targeted physical attacks against high-profile public officials; secondary effects of the Iran War and the 2026 US midterm election cycle will very likely exacerbate these risks.
• AVEs will likely employ increasingly sophisticated and destructive means of conducting attacks targeting facilities and property, particularly targets they associate with US immigration enforcement policies

Background

Insikt Group’s forecast is predicated on its assessments of open-source information on the activities of HVEs and DVEs in the US, including Recorded Future’s extensive index of HVE and DVE communications on various online platforms. During the past twelve months, Insikt Group researchers curated several hundred HVE and DVE sources, adding them to an extensive index of preexisting sources of this type.

This report defines “homegrown violent extremist,” “domestic violent extremist,” and several categories of HVEs and DVEs based on the US Intelligence Community’s definitions and categorizations of threat actors. Periodically, this report uses definitions adopted by Insikt Group subject-matter experts for analytic utility, or in instances where the US government has not officially defined a particular phenomenon or movement. A full list of terms and definitions used in this report is available in Appendix A.

Homegrown Violent Extremists

The HVE threat to the US is very likely at its most severe level since the mid-2010s, during the period following the Islamic State’s rise to power and 2014 offensive to seize territory in Syria and Iraq. Jihadist Salafi HVEs, specifically IS supporters, very likely remain the most likely HVE threat actors to conduct mass-casualty attacks, despite a very likely resurgent threat from HVEs tied to Iran and its “axis of resistance” groups. While both jihadist Salafi HVEs and Iran-nexus HVEs almost certainly have the intent to conduct attacks in the US, we judge Iran-nexus HVEs have more limited capability to do so, due to a very likely smaller number of HVEs who support Iran or its “axis of resistance.”

Despite the June 17, 2026, memorandum of understanding (MoU) that established a ceasefire between the US and Iran, Iran’s military and intelligence agencies, proxy groups, and sympathizers in the US will very likely continue their efforts to guide physical threat activities on US soil, albeit with a greater focus on maintaining plausible deniability. The Iran War and the deaths of several notable members of Iran’s clerical and military leadership almost certainly removed most of the limits to Iran’s intent to target the US by proxy. However, Iran has not yet publicly demonstrated that it possesses sophisticated capacities to engage in physical threat activities on US soil. Observed plots during the Iran War involving Iran-nexus US-based physical threat actors have been largely aspirational, unsuccessful, and reliant on financially motivated (as opposed to ideologically motivated) threat actors.

While not direct participants in the conflict, IS, al-Qaeda, and other foreign terrorist organizations are likely to leverage second-order developments in the Iran War to further recruitment and radicalization of US HVEs. During the past three years, these groups have almost certainly positioned previous shifts in the Middle East’s geopolitical environment — notably Israeli military activity in Gaza and Lebanon following Hamas’s October 7, 2023, attack in Israel, the 2024 fall of the Bashar al-Assad regime in Syria, and diplomatic normalization of relationships between Israel and Muslim countries — to support influence narratives, generate propaganda, and reach a new generation of potential supporters. IS, which almost certainly remains at the forefront of the global jihadist Salafi movement, influenced a significant uptick in HVE threat activity in the US during the past twelve months, a dynamic that is very likely to continue in 2026 and early 2027.

HVEs of all varieties are very likely to target entities they associate with the US or Israeli government or military, private sector entities they associate with the US or Israeli government, Jewish communities, and large public gathering places. Most observed plots continue to use low-cost means, such as firearms, knives, incendiary devices, and vehicular attacks. Nevertheless, Insikt Group has monitored efforts by HVEs to share information on improvised explosive device (IED) manufacturing in online forums; there are additionally several known cases during the past year of HVEs successfully manufacturing IEDs for use in attacks. In addition, HVEs almost certainly will continue to experiment with novel tactics, techniques, and procedures (TTPs), including the use of 3D-printed weapons, unmanned aerial vehicle (UAV)-borne IEDs, and generative artificial intelligence (AI) for attack planning.

Iran and Axis of Resistance

The Iran War almost certainly increased Iran-nexus physical threat actors’ motivation to conduct attacks, sabotage, arson, and defacement in the US, as a form of Iran’s asymmetric retaliation against the US. The cessation of direct hostilities between Iran and the US is very unlikely to deter Iran-nexus threat actors from carrying out physical threat activities, although, post-MoU, these threat actors are very likely to pursue more covert and less destructive TTPs. In rank order, the most likely targets of these activities are:

• Targets perceived to be associated with Israeli or Jewish communities
• High-profile US, Israeli, and Western foreign policy and military officials
• Iranian dissidents residing abroad
• Private-sector organizations affiliated with the US or Israeli military, particularly defense contractors, insurance companies, banks and financial institutions, and critical infrastructure service providers

There are almost certainly few remaining strategic or ideological barriers to Iran’s aspirations to guide attacks on US soil, even after the June 2026 ceasefire agreement with the US. While the June 2026 MoU stipulates that Iran must “refrain from interfering in [the US’s] affairs,” it is unclear whether Iran would interpret non-interference to include Iran-nexus physical threat activities. Additionally, Iranian security agencies may choose not to abide by the clause, especially given how the conflict empowered hardliner elements within Iran’s security apparatus and granted them significant autonomy in operational decision-making. Tehran also very likely would not interpret the clause as applying to Iran’s “axis of resistance” groups. Regardless, Iran has attempted to solicit HVEs to conduct attacks in the US for decades, even during periods without direct military confrontation with the US. During the Iran War, the US killed several senior religious and military figures within Iran (including Ayatollah Ali Khamenei); the deaths of senior Iranian leaders have historically been harbingers of Iran-nexus physical threat activity in the US. Since the beginning of the Iran War, senior Shi’a Muslim clerics in Iran have issued rulings encouraging Muslims around the world to avenge Khamenei’s death by targeting the US and Israel. Iran has also leveraged online influence operations networks to recruit individuals to carry out attacks in the US, and has very likely inspired attack plots in the US. Iran will very likely attempt to ensure any post-MoU external operations in the US are deniable and avoid mass-casualty attacks or assassinations of high-profile public figures — to avoid provoking the US — but there almost certainly remain no significant ideological or strategic deterrents to Iranian external operations as a whole.

Regardless of its intent, however, Iran likely lacks access to a significant number of US-based, ideologically sympathetic HVEs, limiting its external operations capabilities in the US. During the last decade, Iranian operators predominantly tied to the Islamic Revolutionary Guard Corps (IRGC) attempted to pay members of transnational criminal organizations (TCOs), petty criminals, and other financially motivated threat actors to conduct attacks in the US. Insikt Group’s observations of Iran-nexus physical threat activity post-February 2026 indicate this threat model did not change due to the Iran War. For instance, in April 2026, a commander of the IRGC’s Iraq-based proxy Kataib Hezbollah (KH) and its external operations-focused persona Islamic Movement of the Companions of the Right (IMCR, also known as Ashab al-Yamin and HAYI) allegedly attempted to recruit a Federal Bureau of Investigation (FBI) undercover officer — whom he believed to be a US-based Mexican TCO member — to conduct attacks on several synagogues in the US, offering the undercover officer $10,000 in cryptocurrency.

Figure 1: April 20, 2026, IMCR statement threatening US President Donald Trump and his family. (Source: Recorded Future)

Executive Summary

Insikt Group identified four new TAG-195 ("Golden Chickens", “Venom Spider”) malware families through ongoing tracking of the TAG-195 MaaS ecosystem. We named two of the families "TinyEgg" and “ChonkyChicken"; the third is a modularized variant of ChonkyChicken. The fourth family, which includes a modified browser credential theft helper, we named “ChromEggscalator". TAG-195 is a financially motivated malware-as-a-service (MaaS) developer whose tooling Insikt Group has previously linked to TAG-127 as an operator and customer. (Insikt Group has directly observed TAG-127 deploying TinyEgg via “ClickFix”-style campaigns that use fake security verification pages to trick victims into manually executing malicious commands that download and install malware payloads via a legitimate Windows system utility.)

The four new families indicate an architectural transition and evolution in the TAG-195 MaaS ecosystem. TinyEgg is a lightweight initial-access backdoor providing host profiling, interactive shell access, and persistence management. ChonkyChicken substantially expands that capability with browser credential theft, browser session automation, credential-backed remote execution, network reconnaissance, and sustained surveillance. The modularized ChonkyChicken extends this design by introducing a controller-and-plugin architecture in which a base controller implant requests and loads discrete capability modules from attacker-controlled infrastructure on demand rather than embedding all functionality in the implant itself. TAG-195 also modified a publicly available Chrome encryption-bypass tool into a custom helper within the malware family that Insikt Group named ChromEggscalator. All four families share a common set of architectural traits: consistent command-and-control mechanisms, a shared persistence approach, string obfuscation, and execution via the same delivery model.

Insikt Group assesses that TAG-195’s transition to a modular architecture almost certainly reduces the base implant's static detection exposure, and likely also reflects commercial incentives inherent to the MaaS model, including the ability to provision capabilities selectively to operators, limit exposure if a customer is compromised, and serve a broader range of operational requirements. Defenders should prioritize detection of ClickFix-style clipboard execution chains, misuse of legitimate system utilities to load payloads from user-writable directories, suspicious startup persistence mechanisms, browser processes launched with remote debugging enabled, and unusual outbound communications to attacker-controlled infrastructure.

Key Findings

• Insikt Group identified four new TAG-195 malware families through its continued tracking of the TAG-195 MaaS ecosystem: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and ChromEggscalator. Their identification indicates sustained active development and a deliberate architectural transition toward modular, operator-driven tooling.
• The modularized ChonkyChicken variant uses a controller-and-plugin architecture in which a base controller implant requests and loads at least fourteen capability modules on demand. Insikt Group assesses that this design almost certainly reduces the base implant's static detection footprint while enabling operators to deploy only what each intrusion requires.
• All four malware families share four recurring architectural traits that indicate their origin within the same TAG-195 development ecosystem: filename execution gating, Run key persistence under a consistent value name, string obfuscation, and execution via a legitimate Windows binary.

Background

TAG-195, also known as “Golden Chickens” or "Venom Spider", is a financially motivated MaaS developer with a long-standing history of providing credential theft and remote access tooling to criminal operators. Insikt Group assesses TAG-195 as a MaaS provider based on the availability of its malware to multiple distinct threat actors and its sustained operation across successive generations of tooling. Public reporting by eSentire has previously linked TAG-195 tooling to FIN6, Cobalt Group, and Evilnum, three financially motivated criminal groups, suggesting the ecosystem serves a select customer base; however, details on sales models and access conditions remain unknown. Additionally, Insikt Group tracks TAG-127 as a threat group that uses the TAG-195 MaaS, with ClickFix or VenomLNK as delivery methods.

Figure 1: TAG-195 threat group associations (Source: Recorded Future)

Executive Summary

Between January and June 2026, Tehran survived unprecedented military, economic, and political pressure by relying on its longstanding hybrid warfare model: blending asymmetric military operations, cyber operations, information warfare, proxy attacks, and coercive state control. Artificial intelligence (AI) enhanced these capabilities, acting as a force multiplier and almost certainly increasing the speed, scale, and effectiveness of Iranian operations. Ultimately, Iran demonstrated that its strategic resilience does not depend on possessing the most advanced AI capabilities; rather, the source of Iranian power remains the asymmetric playbook itself.

During these crises, Iran compensated for conventional military and economic disadvantages through scalable, low-cost, and deniable asymmetric capabilities. Iran’s use of AI almost certainly improved its cyber capabilities, accelerated the production of propaganda and influence narratives, and expanded the reach of information campaigns. AI’s impact on Iranian military operations is less clear, as Iran’s battlefield use of AI has not been independently confirmed. However, the support Russia provided to Iranian military operations increases the likelihood that AI-enabled tactics and capabilities, refined in Ukraine, contributed to Iranian drone attacks against Israel and Persian Gulf states. Domestically, AI-driven surveillance systems deployed during and after the 2022 “Woman, Life, Freedom” protests likely facilitated the Iranian regime’s violent suppression of unrest in January 2026.

As low-level conflict persists and the risk of a return to war with the United States (US) and Israel remains heightened, Iran’s expanding use of AI-enabled cyber operations will likely pose an elevated threat to Western and regional critical infrastructure and vital industries. Iran’s rapid production and dissemination of AI-generated propaganda expose corporate and state entities to highly targeted influence operations (IOs), risking erosion of customer and citizen trust. As Iran rebuilds its military arsenal, its acquisition of Russian-backed drone capabilities will pose an ongoing risk to critical infrastructure and maritime logistics in the region. Across all sectors, Iran’s hybrid warfare capabilities will likely continue to pose a risk to digital and physical assets, requiring organizations to build resilience against AI-enhanced asymmetric threats that are more scalable and harder to attribute.

Key Findings

• In 2026, AI technologies very likely accelerated existing Iranian capabilities across cyber, influence, military, and domestic repression domains, rather than creating new ones.
• AI’s clearest strategic impact for Iran has been in its information warfare, as AI content generation enables Iran to shape perceptions of the conflict by rapidly producing widely resonant propaganda and influence content.
• Iran’s AI advances appear tied to foreign partnerships — Russian military AI and drone innovations, as well as Russian and Chinese surveillance technologies; Tehran will likely seek to incorporate these foreign AI innovations into its established playbook.
• Organizations and governments should strengthen defenses against AI-enhanced Iranian tradecraft — including AI-assisted phishing, cyber intrusions targeting operational technology, and IO campaigns — while ensuring resilience against combined cyber and physical disruption efforts.
• Post-conflict, Iran is likely to prioritize rebuilding the missile, drone, and maritime capabilities that underpin its asymmetric deterrence model while integrating AI, where possible, to improve efficiency and effectiveness.

Following a directive issued by former Supreme Leader Ali Khamenei in 2021, Iran pursued a centralized national AI strategy intended to expand domestic research and development, reduce technological dependence on foreign actors, and position the country as a regional technological power. However, Tehran’s AI ambitions have faced severe economic constraints and technological limitations as a result of sanctions and isolation.

Background

Between the 2021 directive and the 2026 conflicts, Tehran prioritized developing AI for use in cyber operations, influence campaigns, intelligence and military systems, and domestic repression. Iranian threat actors incorporated generative AI and large language models (LLMs) into spearphishing, social engineering, and online IOs, while Iranian officials publicly emphasized AI-enabled drone, missile, and intelligence capabilities. More broadly, Iran appears to view AI not only as an economic and technological imperative, but also as a tool for preserving regime security and offsetting the strategic constraints imposed by its international isolation.

AI Enhancing Iran’s Asymmetric Capabilities

Insikt Group analyzed cybersecurity and AI threat reports, social media, Iranian state-run messaging and government/military statements, and activist investigations to illuminate Iran’s AI use, or lack thereof, during 2026. While Iran’s unprecedented internet blackouts create significant gaps in open-source understanding of Iran’s AI capabilities during domestic crises and wartime, one theme is clear: AI has almost certainly enhanced Iran’s asymmetric tactics and hybrid warfare doctrine, but has not fundamentally altered the strategic logic underpinning Iran’s approach to the conflict.

Cyber Operations

Iran’s use of AI to support the cyber dimension of its conflict with the US and Israel predates the January 2026 protest crackdown and the February 28, 2026, coordinated US-Israeli airstrikes, known as Operation Epic Fury / Roaring Lion. The 2026 crises likely prompted Iranian state-sponsored and state-aligned threat actors to leverage generative AI to gain productivity and tradecraft improvements across reconnaissance, code/malware development, social engineering, and translation. However, AI has not fundamentally shifted Iranian cyber capability. Iran's 2026 campaign has remained anchored in the same baseline TTPs — including spearphishing, wiper malware, credential theft, abuse of legitimate enterprise tooling, and hack-and-leak operations — that pre-date the AI era. The pattern is consistent with what Google, OpenAI, and other AI developers have documented since 2024: AI accelerates and scales what Iranian actors were already doing, rather than enabling new capabilities.

Reconnaissance and Operational Research

In October 2024, OpenAI reported that Iran-linked hacktivist persona “CyberAv3ngers” used ChatGPT to conduct reconnaissance on programmable logic controllers (PLCs), a use case that has continued to bolster Iranian capabilities against industrial control systems (ICS) during 2026. According to CloudSEK, AI is accelerating the research phase in ICS attacks: “An actor can move from intent to a list of accessible US ICS devices with known default credentials in under five minutes.” CloudSEK researchers recreated CyberAv3ngers's research on vulnerable US-based ICS systems in an unspecified AI LLM agent and identified an additional exposed ICS portal, highlighting a critical infrastructure “playbook that other groups can now replicate much more easily with the help of AI.” Using this research playbook, Iranian threat actors can not only identify vulnerable ICS systems but also understand the unique properties of the specific technologies they are targeting.

In May 2026, an attack attributed to “Cyber Isnaad Front” targeted an Israeli industrial refrigeration system, sabotaging the system by programming it to fail. While there is no direct evidence of AI use in this incident, the attack required expertise in both Windows internal coding and refrigerant physics to ensure maximum damage, suggesting in-depth research into the target system. The targeting selection demonstrates that Islamic Revolutionary Guard Corps (IRGC)-backed cyber personas are concentrated on identifying vulnerabilities in adversaries’ supply chains, logistics, industrial operations, and food production. By facilitating research, AI lowers the level of expertise required to target ICS systems across multiple critical industries.

Code Writing and Malware Development

Iranian-linked threat actor groups also use AI to accelerate their malware development capabilities. In February 2026, Google’s GTIG AI Threat Tracker reported that GreenBravo (also known as APT42, Charming Kitten, Mint Sandstorm) has been using Gemini “as an engineering platform to accelerate the development of specialized malicious tools,” including for debugging, code generation, and researching exploitation techniques. Another example is Operation Olalampo, first observed on January 26, 2026, and attributed to GreenGolf (also known as MuddyWater, Mango Sandstorm) in a Group-IB report. The campaign delivered four novel malware families (CHAR, GhostFetch, GhostBackDoor, HTTP_VIP) against MENA targets via spearphishing. Group-IB’s analysis of the Rust-based CHAR backdoor identified debug strings containing emojis — “a trait rarely seen in human-authored code” — across four separate instances. Group-IB assessed that the emojis indicate the operator used an AI model to generate code segments and failed to sanitize debug strings before compilation. Group-IB explicitly tied this to Google's earlier reporting that MuddyWater was already experimenting with Gemini for file transfer and remote execution code.

Figure 1: Emojis used in CHAR malware suggest AI use (Source: Group-IB)

Executive Summary

Insikt Group has identified new infrastructure associated with the TAG-182 threat cluster, used to disseminate MarkiRAT malware in support of Iranian government surveillance operations. It is highly likely that TAG-182 is targeting Iranians living inside and outside the country using different lures, including free download tools and fake VPN applications. The group’s operations are highly likely active across social media platforms like Instagram.

As the kinetic conflict with the United States and Israel has subsided since April 2026, Iran's security apparatus is likely redirecting its focus toward intensified cyber surveillance and digital enforcement operations targeting perceived dissidents and alleged foreign collaborators. TAG-182’s operations are consistent with these security objectives and are likely to continue following the partial restoration of internet access in Iran on May 26, 2026. The indicators of compromise (IoCs) for this report are viewable in Appendix A, while defensive signatures are located in Appendix C and Appendix D.

Key Findings

• TAG-182 is highly likely a component of Iran’s broader surveillance ecosystem, using MarkiRAT malware distributed through fake Android applications masquerading as legitimate services such as VPNs and media tools to collect intelligence from Iranian targets.
• The MarkiRAT sample identified during this research shares notable tradecraft overlaps with historical variants, including the use of the Background Intelligent Transfer Service (BITS), suggesting a credible relationship between TAG-182 and activity previously attributed to Ferocious Kitten. However, while these similarities support an operational connection, additional evidence is necessary to confidently assess that the two clusters are organizationally linked.
• Since Iran’s reconnection to the global internet, Iranian surveillance operations are highly likely to increase as authorities seek to identify and monitor perceived dissidents amid concerns over internal unrest and potential uprisings. The majority of Iranian intelligence and security organizations are likely to prioritize enhanced digital surveillance and intelligence collection to support domestic security objectives.

Threat Analysis

In early 2026, open-source information surfaced malware samples linked to MarkiRAT, which has historically been used by Ferocious Kitten for surveillance against anti-government networks, activists, and human rights advocates inside Iran. The IoCs, specifically the lures, suggest that threat actors custom-built a website that acts as a staging point for an application called “YESHICA” (Table 1). Other sample names also include “Pis2ray VPN”, which is not a legitimate application on either Google Play or Apple’s App Store (see Appendix A for additional IoCs).

In March 2026, Insikt Group identified a new sample associated with TAG-182’s updated infrastructure that uses an almost identical media player theme name, “YESHICA YEPlayer” (Figure 1).

Figure 1: TAG-182 continued to operate using similarly named applications despite open-source exposure of its tradecraft and infrastructure (Source: Recorded Future)

Executive Summary

Mexico recently unveiled a new National Cybersecurity Plan to be implemented over the remainder of this decade. The proposed plan lays the foundation to address the top cybersecurity threats Mexico has identified, including organized crime, geopolitical threats, and emerging artificial intelligence (AI) threats. The plan comes at a critical moment, as repeated cyber incidents across federal, state, and local institutions in Mexico have exposed the need for a more coordinated national response to reduce the risk of data theft, ransomware, service disruptions, and institutional reputational damage.

Insikt Group analysis of cyber trends from 2020 to 2026 found that Mexico has historically been primarily impacted by ransomware, financial malware and fraud, and hacktivism. Data breaches and theft, organized crime and money laundering, and state-sponsored cybercrime have also represented significant threats. The government, healthcare, and financial sectors have been the primary targets of cyber threat actors, and ransomware continues to be the top threat to Mexican organizations. Mexico also remains an attractive target for state-sponsored cyber activity due to its deep integration with United States (US) supply chains, nearshoring-linked manufacturing base, and underdeveloped cybergovernance.

Mexico is among the top five countries globally with the most documented victims of infostealers and stolen payment cards. Our research indicated that DarkForums is the most popular dark web special-access forum where threat actors discuss cyberattacks targeting Mexico. Mexican drug trafficking organizations (DTOs) are known to leverage Chinese money laundering networks (CMLNs) for their drug proceeds, relying on cryptocurrency to obfuscate their flow of illicit funds and soliciting cybercrime-as-a-service to evade arrests.

The ongoing 2026 FIFA World Cup, co-hosted by Mexico, will be an initial test of the country’s ability to maintain operations and access to digital services amid increased tourism and international scrutiny. Facing this dynamic, organizations in Mexico should enhance their ability to detect cyber threats, prioritize threat visibility, and strengthen incident response planning. They should also train staff and the public on basic cyber safety, with an emphasis on building a practical understanding of how to respond quickly and effectively when incidents occur.

Key Findings

• Mexico’s proposed National Cybersecurity Plan outlines a path to update the country’s cyber posture at a critical moment. While previous attempts to advance national cybersecurity policy failed to get political traction, the administration of President Claudia Sheinbaum has committed to fully implementing this initiative over the course of her term, facilitated by her party’s majority control of Congress.
• In addition to the threats outlined in the plan, Insikt Group assesses that Mexico faces significant challenges related to ransomware, financial malware and fraud, and hacktivism. Data breaches and theft, organized crime and money laundering, and state-sponsored cyber threats also continue to pose a major challenge.
• As Mexico advances its new cyber policy, organizations operating in the country should consider strengthening their threat posture by leveraging cyber threat intelligence solutions, adopting international cyber standards, conducting scenario-planning exercises to improve responses to ransomware, data breaches, cyber espionage, and other threats, and educating employees and the general public.

Mexico’s Cybersecurity Positioning

On December 4, 2025, Mexico’s 2025–2030 National Cybersecurity Plan (hereinafter, the Plan) was published by the Mexican Digital Transformation and Telecommunications Agency (ATDT). The Plan is meant to update Mexican federal cyber policy for today’s threat environment and to create a more secure and resilient digital security policy ecosystem. While the Plan by itself does not create new cyber policies or legal frameworks, it outlines a series of benchmarks and indicators to guide progress toward that end. Ultimately, as the ATDT claims in the Plan, it is an attempt by Mexico to become a regional cyber-leader. Mexico was listed as a “Tier 2” nation in the International Telecommunication Union’s (ITU) 2024 Global Cybersecurity Index, placing it alongside Canada, Ecuador, and Uruguay in the upper ranks of Latin American nations for demonstrating a strong commitment to cybersecurity (Brazil and the US are the only countries in the Americas listed in Tier 1). However, the ITU identifies international cooperation as an area of growth, and Mexico is generally perceived by cyber experts as lagging behind international standards in institutional capacity-building. When implemented, the ATDT claims that the Plan will “position Mexico at the forefront of regional cybersecurity, contributing not only to the protection of its own digital assets and population but also to the strengthening of regional cybersecurity in Latin America and the Caribbean.

Executive Summary

Insikt Group assesses that government digital surveillance activities pose a high or very high risk in 31 countries, where state actors exploit telecommunications infrastructure, homegrown and commercial spyware, and artificial intelligence (AI)-powered tools to monitor foreign nationals and business travelers with little to no legal accountability. A further 55 countries categorized as medium risk frequently deploy less-sophisticated surveillance capabilities to target political opposition and dissent –– highlighting the need for organizations to adopt appropriate mitigation measures in jurisdictions with limited oversight mechanisms and track records of surveillance targeting foreign entities or supporting domestic repression.

Insikt Group has identified five broad categories of digital surveillance capabilities built in-house or acquired by governments: network interception, endpoint compromise, platform-level access, public space surveillance, and data aggregation. The risk of a government abusing these capabilities is almost certainly higher in jurisdictions lacking independent oversight mechanisms or clear delineations of the legal, necessary, and proportional use of these capabilities, in line with international standards.

Foreign nationals and business travelers who fail to adequately understand and prepare for digital surveillance risks prior to traveling or conducting operations in a given location can face significant personal and organizational damages, including sensitive data breaches, IP theft, targeted intelligence operations, reputational harm, and increased risks from physical threats or detention.

As such, individuals traveling abroad and their respective organizations should implement mitigation measures to protect sensitive data, commensurate with the level of state surveillance risk in the destination country. These measures range from maintaining standard security hygiene in lower-risk environments to using sterile, non-corporate devices when operating in high-risk jurisdictions.

Key Findings

• Insikt Group assesses that there are “high” or “very high” levels of digital surveillance risk in 31 countries due to their use of advanced surveillance capabilities against foreign businesses, travelers, and government critics, with limited to no oversight.
• A further 74 countries have “medium” levels of digital surveillance risk. While 55 of these countries are not known to have deployed advanced surveillance capabilities, there is evidence that their governments have deployed less sophisticated surveillance measures for a variety of purposes, which may include monitoring political opposition, human rights activists, and journalists. The remainder (19) of countries in this category possess advanced surveillance capabilities, but are not known to typically use them in violation of national or international laws.
• By exploiting control over telecommunications infrastructure and online platforms, governments can conduct mass, indiscriminate monitoring of traffic and user data. The risk of abuse of network interception and platform-level access is almost certainly greatest where judicial authorization requirements and procedural safeguards are weak.
• The proliferation of commercial spyware, AI-powered public security infrastructure, and increasing collection of biometric and personal data almost certainly enables governments to build comprehensive digital profiles of individuals and leverage them for targeted surveillance operations.
• Digital surveillance that is not subject to robust oversight and does not abide by the principles of legality, necessity, and proportionality very likely incurs heightened operational, reputational, and legal costs for organizations and individuals, including the loss of sensitive data, the proliferation of cyber vulnerabilities, and legal and physical risks.

Components of Surveillance Risk

Insikt Group regularly assesses risks to business travelers and foreign nationals from government-run digital surveillance operations in 193 countries using Recorded Future’s Country Risk analytic framework. Customers can access Country Risk analysis by querying for State Surveillance Notes in the Recorded Future Intelligence Operations Platform. State Surveillance Notes assess the overall level of state surveillance risk in a given country based on three primary categories:

• Surveillance Capabilities: The ability of intelligence services, law enforcement agencies, or other state-affiliated or directed entities to undertake digital surveillance, and the scope of these digital surveillance capabilities. This category includes the capabilities of a variety of state and state-nexus actors, including specialized surveillance agencies with broad access to digital infrastructure, state-affiliated groups that deploy spyware for cyber espionage, and individual law enforcement units that carry out traditional wiretapping.

• History of Digital Surveillance Operations: A government’s historical willingness to carry out unlawful, arbitrary, or overbroad digital surveillance operations. This can include surveillance that violates national law — such as government entities monitoring communications without appropriate authorization — but also covers surveillance that may be sanctioned under national legislation but violates international principles of legality, necessity, and proportionality.

• Oversight Mechanisms: The existence and efficacy of judicial, legislative, or independent oversight bodies that approve and monitor a government’s digital surveillance operations for compliance with domestic and international law.

A comprehensive evaluation of state surveillance risk in a country requires a composite assessment that takes into account all three categories. For example, a country purchasing high-profile spyware may not, by itself, indicate a high level of risk to business travelers or foreign nationals, provided that the government has a good track record of respecting domestic and international privacy protections and has strong judicial and legislative oversight of intelligence and security agencies. In contrast, a country with less advanced capabilities, but strict control over internet infrastructure and few restrictions on the government’s ability to collect user data, likely poses a greater risk to travelers’ and foreign nationals’ data security.

Insikt Group assesses whether a country’s history of digital surveillance constitutes a risk to foreign nationals and travelers based on its alignment with international principles on privacy and digital rights. Article 12 of the United Nations (UN) Universal Declaration of Human Rights establishes that no individual “shall be subjected to arbitrary interference with his privacy, family, home, or correspondence”. A 2022 UN General Assembly resolution on privacy in the digital age states that

“unlawful or arbitrary surveillance and/or interception of communications, as well as the unlawful or arbitrary collection of personal data, hacking and the unlawful use of biometric technologies, as highly intrusive acts, violate the right to privacy” and that states should ensure that any interference with this right is consistent with principles of “legality, necessity, and proportionality.”

“Legality,” in this formulation, requires that surveillance or interception be prescribed by “a legal framework, which must be publicly accessible, clear, precise, comprehensive and non-discriminatory.” Surveillance must also be necessary to further the purposes identified in corresponding law, take the least intrusive form required to do so, and be proportionate in scope to the interest being protected.

Key Components of State Digital Surveillance Risk

Table 1: State surveillance risk level is a function of not only a jurisdiction’s surveillance capabilities, but also its history of deployment of those capabilities and oversight mechanisms (Source: Recorded Future)

Applying these criteria, and based on data collected from 2024 to 2026, Insikt Group has assessed the level of risk associated with state digital surveillance in 193 countries:

• Six countries (3%) –– Belarus, China, Iran, Myanmar, North Korea, and Russia –– are “very high risk,” denoting evidence of advanced surveillance capabilities, a lack of independent oversight, regular surveillance targeting foreign businesses and travelers, and widespread suppression of political opposition or dissent.
• 25 countries (13%) are “high risk,” indicating evidence of moderate to advanced surveillance capabilities, limited independent oversight, and the use of surveillance tools to repress domestic political opposition, activism, or reporting critical of the government.
• 74 countries (38%) are “medium risk,” either indicating evidence of advanced surveillance capabilities that are not typically used in violation of national or international laws (19 countries), or evidence of less advanced capabilities that are frequently employed to suppress political dissent and activism (55 countries). While countries in this risk tier may have established systems for oversight or judicial review, government surveillance operations do not always abide by their purview.
• 65 countries (34%) are “low risk,” indicating evidence of moderate to advanced surveillance capabilities exercised under strong oversight with established records of avoiding unlawful or arbitrary surveillance (39 countries), or evidence of limited surveillance capabilities (26).
• 23 countries (12%) are “very low risk,” indicating minimal ability to conduct digital surveillance, well-established oversight mechanisms, and no indications of surveillance abuses.

Figure 1: State surveillance risks by country from medium to very high risk based on data collected from 2024 to 2026 (Source: Recorded Future)

Executive Summary

Iranian and Russian shadow fleet vessels, along with multiple sanctions evasion networks (SENs), are using online infrastructure likely designed to facilitate sanctions evasion. The infrastructure consists of inauthentic websites impersonating ship registries, national maritime administrations, seafarer training and certification organizations, protection and indemnity (P&I) clubs, and ship classification societies, effectively replicating key layers of the maritime compliance stack. The websites are likely being used to circumvent maritime compliance mechanisms by generating and corroborating false documents and certificates.

The online infrastructure is consistent with a service-provider model in which threat actors offer reusable digital infrastructure, documentation, and identities, rather than operating as centrally coordinated, country-specific networks. Three identified clusters of online activity –– designated as Alpha, Bravo, and Charlie for the purposes of this report –– have several technical overlaps, suggesting these clusters may form a broader, loosely connected ecosystem of online infrastructure supporting multiple SENs. This activity also aligns with prior reporting by Bellingcat and Lloyd’s List and demonstrates potential links between the two reports across these three clusters.

This infrastructure blends established sanctions evasion practices, such as exploiting weak jurisdictional oversight in under-resourced jurisdictions to conduct fraudulent ship flag registrations, with increasingly cyber-enabled tactics such as automated document generation and layered infrastructure to produce fraudulent documents and credible front companies, complicating detection and enforcement.

Cyber-enabled SENs almost certainly undermine sanctions compliance mechanisms by developing credible but fraudulent maritime organizations, increasing the risk of due diligence failures and regulatory exposure. Organizations in the maritime and shipping sectors should integrate independent verification and cyber threat intelligence into compliance workflows to proactively identify fraudulent online infrastructure. Governments whose authorities are regularly impersonated by SENs and associated service providers should prioritize coordinated identification and disruption of fraudulent infrastructure, particularly where threat actors claim multi-jurisdictional legitimacy.

Key Findings

• SENs tied to the Iranian and Russian shadow fleets are likely using over 36 inauthentic websites in three distinct clusters. Insikt Group identified explicit connections between these websites and seventeen vessels, the majority of which have already been sanctioned by the United States (US) Department of the Treasury (USDT)’s Office of Foreign Asset Control (OFAC) and by other countries.
• Inauthentic websites identified as part of these clusters routinely impersonate national maritime administrations and ship registries from countries such as the Comoros and Benin, as well as Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia.
• Other websites also aim to establish fictional ship classification societies as credible registered organizations (ROs), in addition to several websites acting as fictional seafarer training and certification organizations and P&I clubs.
• One website impersonates the Benin Maritime Administration and provides a self-service tool to generate fraudulent seafarer documents from the governments of Benin, the Comoros, and Nicaragua.
• Attribution for at least two of the clusters documented in this report includes Cluster Alpha, which is likely to have been at least partially developed by an Indian web development company, Oceaniek Technologies. Cluster Bravo is linked to two Syrian nationals, one of whom has previous historical involvement in illicit activity. Cluster Charlie remains unattributed, although it shares technical and design characteristics with Cluster Bravo.

Background

Three partially overlapping clusters of online infrastructure are likely being used by both the Iranian and Russian shadow fleets to evade sanctions (Figure 1). The three clusters (designated Alpha, Bravo, and Charlie) are connected through shared infrastructure, consistent domain registration patterns, and recurring operational security (OPSEC) mistakes.

The activity described in this report also overlaps with two previously unconnected activity clusters described by Bellingcat and Lloyd’s List –– the first tied to Indian web development company Oceaniek Technologies, and the second to a cluster of fraudulent ship registries centered around the domain marinegov[.]net. This activity also aligns with prior reporting from independent researcher Christian Panton, who collaborated with both Bellingcat and Lloyd’s List.

Unlike traditional intrusion sets, these websites enabling maritime fraud and sanctions evasion form a complex network involving front companies, individuals, and vessels. However, Insikt Group has established initial attribution to one of the clusters to two Syrian nationals, with one individual having a record of previous involvement in illicit activities.

Figure 1: Clusters identified by Insikt Group (Source: Recorded Future)

Executive Summary

Since Russia’s full-scale invasion of Ukraine in February 2022, and the subsequent increase in Western sanctions on Russian individuals and firms, Russia’s economy has become increasingly skewed toward the defense sector. This has very likely led Russian political elites to increasingly draw patronage flows from defense-related expenditures. The wide range of sanctions has likely made it difficult for elites to diversify the sources of their graft, leaving them increasingly dependent on defense contracts for illicit funds.

As Russian President Vladimir Putin uses the distribution and withdrawal of patronage flows as a key way to maintain elite loyalty, a steady stream of defense expenditures has likely become an increasingly important cornerstone for Putin’s ability to maintain domestic political stability. Since maintaining domestic political stability is critical to Putin’s political survival, he very likely sees maintaining current defense expenditures as not only a foreign policy priority, but also a domestic political imperative. A decrease in defense expenditures would likely result in a decline in patronage flows to elites, thereby raising the prospect of elite discontent and greater difficulty in maintaining political stability.

Insikt Group therefore assesses that Putin is likely incentivized to engage in conflict abroad, not only for geopolitical purposes, but also to maintain high levels of defense spending. Should the war in Ukraine end without sanctions abatement –– and thus without providing a pathway for economic and patronage flow diversification –– Putin would likely seek alternative venues for mobilization to ensure defense-related patronage flows continue. Likely target states include non-NATO states close to Russia, including Moldova.

Public- and private-sector entities based in Europe and those with investment in Russia or users there are therefore likely to face a high-risk, unpredictable Russia-nexus cyber, physical, and economic threat environment, as long as sanctions preclude diversification of patronage flows beyond the defense sector.

As such, political settlement in Ukraine, coupled with sanctions rollbacks and security guarantees for Ukraine and other non-NATO states close to Russia, such as Moldova, likely would raise the cost of starting a conflict elsewhere while providing Putin with a pathway to diversify his elites’ patronage flows, thereby reducing his incentive to fund Russia’s patronage networks via mobilization.

Key Findings

• Since the 2022 invasion of Ukraine, Russia’s economy has become increasingly dependent on military spending, with defense expenditures reaching an estimated 7.2% of GDP and 32% of the federal budget by 2025.
• The military-industrial complex now employs approximately 3.5 million Russians, accounting for roughly 5% of the total labor force, while the production of civilian goods, such as cars and home appliances, has stagnated or declined.
• Systematic Western sanctions have limited the avenues Russian elites have to accumulate illicit wealth, forcing Russian political and business elites to rely increasingly on defense contracts for patronage and graft.
• As a decrease in defense spending would likely reduce the patronage flows necessary to maintain elite loyalty and domestic stability, Putin is likely incentivized to maintain high levels of military mobilization, even if the war in Ukraine were to end.
• Putin’s likely domestic political motivation to maintain military mobilization –– whether in Ukraine or elsewhere –– means that dissuading Putin from pursuing further interventions abroad likely would require not only negotiating a peace in Ukraine and providing security guarantees for Kyiv, but also alleviating sanctions on Russia, thereby providing Putin a pathway to diversify the sources of elite patronage

Executive Summary

The 2026 FIFA World Cup, which takes place across sixteen host cities in the United States (US), Mexico, and Canada, presents a complex threat environment across multiple security domains. The tournament’s global visibility creates opportunities for both financially and geopolitically motivated threat actors to target attendees, affiliated organizations, sponsors, vendors, and event-supporting infrastructure.

Physical security will almost certainly remain the highest priority for event coordinators and local government officials, given the high levels of international attention and the concentration of large crowds in host cities spanning three countries and multiple, distinct security environments. Mexico’s host cities face the highest physical risk due to the persistent presence of local and transnational criminal organizations (TCOs), with elevated concerns around theft, extortion, kidnapping, and fraud. US and Canadian host cities likely face a more limited threat from violent extremists, with greater risks to soft targets such as fan zones, watch parties, transit hubs, and other crowded public areas.

Civil unrest and disruptive protests are also very likely in a majority of host cities. Localized travel disruptions are especially likely in Mexico, where prior demonstrations have already blocked roads near World Cup venues. Large police or military deployments near event sites will likely increase the risk of confrontation.

The most immediate risk to corporate sponsors and affiliates is likely cybercriminal exploitation of World Cup demand and branding. Recorded Future’s Payment Fraud Intelligence team has already identified World Cup-themed purchase scams, fake FIFA-branded stores, and spoofed FIFA and host city domains. Carders are also likely to leverage stolen payment card credentials to fraudulently purchase event tickets and travel-related services for rapid resale and monetization. Efforts to use individuals’ interest in the World Cup to deliver malware or carry out data extortion or fraud will likely accelerate as the tournament approaches. Threat actors will likely continue to use AI-generated content to scale fraud, impersonation, phishing, smishing, and social engineering campaigns.

The concentration of senior government officials, diplomats, security personnel, corporate executives, and media at World Cup events also very likely increases the risk of cyber espionage and disruptive cyber incidents. Russian, Chinese, and Iranian state-sponsored threat groups will likely use the tournament as an intelligence collection opportunity, targeting executives, VIP attendees, national delegations, media partners, telecommunications providers, airlines, hotels, event logistics firms, and commercial affiliates. China is most likely to pursue targeted espionage, while Russia and Iran pose a higher risk of more disruptive attacks through proxy hacktivism.

Influence activity related to the tournament remains largely overt, driven by state media and diplomatic messaging from Russia, China, and Iran. These narratives focus on host-country legitimacy, Iran’s conditional participation, visa and access issues, public safety, immigration, ticketing, and alleged politicization of the event. Covert influence activity has so far been limited and opportunistic, but could increase as the tournament approaches, particularly around geopolitical flashpoints or viral news events.

Organizations involved in or exposed to the World Cup should prioritize proactive monitoring of location-specific physical security risks, protest activity, cybercriminal infrastructure, phishing and credential exposure, malicious traffic, ransomware indicators, and influence operations. Cyber indicators such as increased scanning activity or newly registered domains linked to FIFA or host cities may indicate an expansion of criminal or espionage activity. Developments around geopolitical flashpoints such as the war in Iran may increase the likelihood of attempts to disrupt the tournament through cyber or physical attacks.

Key Findings

• World Cup crowds will likely elevate physical security risks around match venues and fan areas, exacerbated by factors such as TCO activity in Mexico and impending primary elections and 250th Independence Day celebrations in the US.
• Opportunistic criminal activities tied to organized crime very likely constitute the largest physical security risks to Mexico’s World Cup host cities, while US venues face very likely less substantial (but nonetheless tangible) threats from violent extremists, particularly homegrown violent extremists (HVEs).
• Cybercriminal threat actors are exploiting World Cup-themed branding via purchase scams and phishing infrastructures, with AI-generated content likely enabling operations to surpass volumes observed during prior World Cups. Carders frequently use fraudulent ticket purchases and resale schemes as a rapid monetization method for stolen payment card credentials.
• Russian, Chinese, and Iranian state-sponsored threat groups will likely use the World Cup as an intelligence collection opportunity, while Russia and Iran pose additional risks of disruptive cyber operations, particularly from proxies and hacktivist personas.
• World Cup-related influence activity from Russia, China, and Iran is driven overwhelmingly through overt state media and diplomatic messaging, while observed covert activity remains limited, opportunistic, and largely secondary to broader geopolitical narratives about Iran, host-country legitimacy, and US access and security policies.

Country Risk

Insikt Group assessed four categories of country-level risk in World Cup host countries: security and crime data; network intrusion activity, which measures Malicious Traffic Analysis events targeting each country; ransomware attacks targeting victims in each country; and data privacy and surveillance-related risks, accessible in the Recorded Future Intelligence Operations Platform as State Surveillance risk. While public reporting indicates declining crime rates in many World Cup host cities, violent crime risks are almost certainly greatest in Mexico; opportunistic crime, such as theft, likely presents the greatest physical security risk in Canadian and US host cities. By comparison, threats to data security and privacy are likely greatest in the US and Canada, given the higher volume of malicious cyber activity targeting US and Canadian entities. Factors complicating the security environment across World Cup host nations include TCO operations in Mexico; 250th anniversary celebrations in the US; and the lead-up to the US midterm elections in November 2026, including summer primary elections.

Figure 1: Composite Country Risk Scores for Canada, Mexico, and the US (Source: Recorded Future)

Executive Summary

Iran’s Ministry of Intelligence (MOIS) has likely broadened the use of its “Handala” brand to encompass MOIS’s external physical and influence operations targeting US and Israeli interests. Since the beginning of the Iran War, Insikt Group has observed significant overlaps in the online activities of Handala Hack Team, a newly created, Handala-branded persona referring to itself as the “Handala Popular Resistance Front” (HPRF), and three influence operations networks previously identified by Insikt Group. Based on frequent amplification and cross-posting of claims and content between Handala Hack Team and these four additional entities, we now attribute these groups to MOIS, with varying degrees of confidence.

The nexus between these personas and MOIS, as well as their multidomain tactics, techniques, and procedures (TTPs) and targeting, likely reflects how MOIS’s external operations have shifted in response to the Iran War. Notably, the HPRF and the three influence operations networks all almost certainly share a modus operandi: their administrators solicit individuals to conduct physical attacks and espionage targeting US and Israeli entities, on behalf of Iranian intelligence agencies, for a financial reward. By encompassing these groups under the Handala brand, MOIS likely seeks to take advantage of Handala’s global recognition to amplify its solicitation efforts.

MOIS’s likely coordination of distinct cyber, physical, and influence personas under a single brand very likely amplifies physical and cyber threats to targeted individuals and facilities. Handala-linked physical threat actors could almost certainly leverage the recognition of the brand’s hacktivist personas to recruit individuals to conduct targeted violent attacks, espionage, sabotage, or other physical threat activities. Shared resources, intelligence, and coordination efforts from a centralized source likely increase the impact of an attack. This very likely entails heightened risks for US and Israeli law enforcement, military, and intelligence agencies and their personnel, in addition to energy, transportation, and research organizations operating in the region.