Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE2 IOCs
NSFOCUS Monthly APT Insights – April 2026
Threat Actors
Diamond Model
Adversary(2)
Infrastructure
Capability
Victim
Indicators of Compromise
Indicators of Compromise2
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-21509 aptespionageexploit | Medium | 57 | Jun 2, 26 |
| CVE | CVE-2026-21513 aptc2espionage | Medium | 56 | Jun 3, 26 |
IOC Relationship Graph
IOC Relationship Graph2 total IOCs
CVE