Executive summary
April’s public reporting connected three defensive problems: exposed network infrastructure, stolen development credentials, and attackers exploiting trust in familiar services. The US Cybersecurity and Infrastructure Security Agency (CISA) added 31 entries to its Known Exploited Vulnerabilities (KEV) catalogue during the month, while the National Vulnerability Database (NVD) records 5,885 vulnerability publications in the same period. The UK National Cyber Security Centre (NCSC) warned about router hijacking attributed to APT28 and covert networks linked to China, while CISA and partner agencies described disruption of industrial controllers by Iranian-affiliated actors. Wiz’s supply-chain investigations and Google Threat Intelligence Group’s (GTIG) account of helpdesk impersonation showed different routes from trusted workflows to credential exposure. We assess it is likely (B2) that organisations will miss material exposure if they treat patch completion as the sole recovery measure: April’s reports separately describe persistent implants, altered router settings and stolen credentials, each requiring checks beyond a software version.
The month in numbers
The CISA catalogue published on 30 April 2026 contains 31 additions dated 1–30 April 2026. Three of these records mark ransomware campaign use as known; the remaining 28 mark it unknown. Unknown is an absence of a confirmed catalogue label, not proof that ransomware operators have avoided a flaw. This review uses that historical catalogue version, rather than applying later changes to an April assessment.
The NVD publication-date query returns 5,885 Common Vulnerabilities and Exposures (CVE) records, selecting publication timestamps from the start of 1 April 2026 to the end of 30 April 2026. That is a publication count, not a count of attacks or of distinct affected products. It should not be read as the workload of any particular organisation: applicability depends on its actual software and configuration.
For extortion, this review counts a deliberately bounded sample of five public ransomware.live group pages. Selecting their entries marked Discovered: 2026-04-… gives 348 postings. These are criminal claims recorded by the monitoring service; discovery dates are neither intrusion dates nor independent confirmation that the claims are true. The sample is not a global total and does not establish the five groups’ market share.
| ransomware.live group label | April postings in the selected pages | Public source |
|---|---|---|
| Qilin | 108 | Qilin page |
| Thegentlemen | 86 | Thegentlemen page |
| Dragonforce | 65 | Dragonforce page |
| Akira | 49 | Akira page |
| Incransom | 40 | Incransom page |
The three measures answer different questions. KEV identifies vulnerabilities CISA has admitted to its exploited-vulnerability catalogue; NVD measures vulnerability-record publication; the leak-site sample measures public extortion postings. Combining them into a single threat score would hide those differences. For operational reporting, retain the denominator and date definition beside each figure, and compare like with like.
Four themes
1. Network devices became both targets and intermediaries
The NCSC’s 7 April 2026 announcement attributes exploitation of vulnerable routers to APT28, which the UK links to Russia’s military intelligence service. It describes Domain Name System (DNS) hijacking used to redirect traffic and collect passwords and access tokens. The NCSC assesses that the operation casts a broad initial net before selecting targets of intelligence interest. Its protective advice includes securing management interfaces, maintaining devices and enabling two-step verification.
A separate NCSC announcement on 23 April 2026 describes networks of compromised routers and other internet-connected devices used to conceal China-linked activity. Produced with industry and 15 international partners, the advisory highlights rapid turnover in indicators of compromise. The NCSC presents these networks as infrastructure for hiding activity and maintaining access, not as a claim that every compromised router belongs to one campaign.
Our operational conclusion is to investigate both sides of a device’s role. A router may expose its own organisation while also supplying infrastructure used against others. Review resolver settings, management access and unexpected connections alongside firmware status. Record who approved a configuration change and whether it is consistent with the network design. An unfamiliar resolver merits investigation; it does not, by itself, establish the actor responsible.
2. An update did not necessarily remove an existing implant
The 23 April 2026 FIRESTARTER analysis from CISA and the NCSC describes a backdoor recovered from a Cisco Firepower device running Adaptive Security Appliance software. The agencies assess that it maintained access after patching. Although the report discusses both Firepower and Secure Firewall devices and relevant software families, CISA says its successful in-the-wild implant observation was on a Firepower device running that software; the wider technical scope should not be mistaken for observations on every platform.
The report distinguishes evidence preservation from eradication. It recommends analysis of a core dump or disk image using the supplied YARA detection rules. It also separates instructions for US federal agencies, other US organisations and UK organisations. UK organisations are told to report a detection to the NCSC and await guidance before physically disconnecting power. A routine restart is not interchangeable with the response procedure in the advisory.
The implication for incident managers is practical: a closed patch ticket and a completed compromise assessment should be separate records. Preserve the evidence needed to determine whether an attacker arrived before remediation, then follow the vendor and relevant agency’s recovery process. This is our recommendation for interpreting the report, rather than a finding that any particular reader’s firewall is compromised. Device owners should also identify who can collect evidence and who can authorise an outage before an emergency occurs.
3. Development credentials remained a route to further compromise
In its 4 April 2026 prt-scan investigation, Wiz describes malicious pull requests that sought to trigger privileged continuous integration and continuous delivery (CI/CD) workflows. Its analysis spans six accounts and includes activity from March and early April. Wiz’s impact section reports a success rate below 10 per cent across more than 450 analysed attempts, with most successes affecting small projects and exposing short-lived workflow credentials. Its conclusion rounds the rate to 10 per cent and also reports verified theft of Amazon Web Services (AWS) keys, Cloudflare application programming interface (API) tokens and Netlify authentication tokens. It also reports compromise of two npm packages sharing a maintainer. These qualifications matter: automation at scale did not mean that every attempted technique worked or that every target lost production access.
At the end of April, Wiz’s SAP-package investigation, captured on 30 April 2026, described malicious installation scripts in packages from the SAP ecosystem. Wiz attributes this operation to TeamPCP with high confidence, citing a shared encryption key and other technical overlap. The reported payload collected development and cloud secrets and included propagation functionality. Wiz did not establish that the similarly named Shai-Hulud operations from 2025 were the same actor; the naming resemblance should not be used to merge them.
For defenders, package removal is only one part of containment. Our recommendation is to identify where an affected version actually executed, determine what credentials that environment could access, and investigate subsequent use of those credentials. Review package lockfiles and build records before assuming that a repository’s current manifest describes every historical installation. Where sensitive tokens were exposed, revoke or rotate them through their owning service and check for unauthorised changes. Keep the distinction between a malicious package being downloaded and its installation hook executing.
4. Operational technology and helpdesk workflows needed different controls
The 7 April 2026 joint US advisory, preserved in an April capture, describes Iranian-affiliated actors targeting internet-facing operational technology, including Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs). The agencies report malicious interactions with project files and altered information on operator displays. In a few cases, the activity caused operational disruption and financial loss. They recommend removing PLCs from direct internet exposure, examining historical logs and engaging the relevant agencies and manufacturer when targeting is suspected.
The important distinction is between the displayed state and the underlying process. Our recommendation is to involve engineering staff in validating both, using established safety procedures. A security team should not independently overwrite a controller programme or interrupt a physical process solely because an indicator matched. Preserve project versions and relevant logs, agree the safe operating state, and coordinate recovery with those responsible for the plant.
In an unrelated 23 April 2026 investigation, GTIG described UNC6692 impersonating helpdesk staff through an external Microsoft Teams account after flooding a target with email. The intrusion occurred in late December 2025; April is the reporting date. GTIG describes the SNOWBELT browser extension, SNOWGLAZE tunnelling component and SNOWBASIN backdoor, followed by movement towards backup infrastructure and domain controllers. This was not evidence that all three components first appeared in April.
For support teams, our recommendation is an independent callback or existing ticket check before following unsolicited repair instructions. For security teams, investigate the sequence linking message floods, external chat contacts, unusual browser extensions and endpoint execution. A familiar collaboration platform or cloud host should not end the investigation. These are recommended correlations, not indicators that every external Teams conversation is malicious.
Actors of the month
The reporting supports several distinct cases, with attribution retained at source level. The NCSC attributes router hijacking to APT28 and separately discusses China-linked covert networks. The US PLC advisory describes Iranian-affiliated actors. Wiz attributes the SAP-package operation to TeamPCP, while GTIG uses the tracking label UNC6692 for its social-engineering investigation. Their shared use of legitimate infrastructure does not establish cooperation or common ownership.
For intelligence teams, maintain these as separate investigative records. Link a new observation to an actor only when the supporting evidence justifies that step. Generic features such as cloud hosting, credential collection or remote access may help identify behaviour but are weak grounds for an attribution decision on their own. Record the publisher making the attribution and the date on which it made it.
The vulnerability landscape
April’s historical KEV entries include both recently assigned identifiers and older vulnerabilities. Examples include Google Dawn on 1 April 2026, Ivanti Endpoint Manager Mobile on 8 April 2026, Apache ActiveMQ on 16 April 2026 and cPanel-related products on 30 April 2026. The three entries labelled as used in ransomware campaigns concern PaperCut NG/MF, JetBrains TeamCity and Microsoft Exchange Server. These are catalogue additions during April, not claims that exploitation began during April.
CERT-EU’s 30 April 2026 advisory also highlighted the Linux kernel vulnerability known as Copy Fail, CVE-2026-31431. It describes local privilege escalation, a public proof of concept and an upstream fix. In that dated assessment, CERT-EU reported no shipped distribution fixes, while its table listed Red Hat’s status as unknown and Ubuntu 26.04 as unaffected. The identifier is also present in NVD’s record. CERT-EU recommends prioritising systems that run untrusted workloads, including Kubernetes nodes and CI/CD runners, and provides temporary mitigation guidance. That guidance should be assessed against workload requirements; a local flaw is not automatically an unauthenticated remote entry point.
Our recommended triage separates four questions: whether the installed product is affected, whether the vulnerable feature is reachable, whether exploitation is evidenced, and whether compromise checks are required after remediation. A numerical severity score cannot answer all four. For appliances and build infrastructure, assign an owner to the investigation as well as to the software change, and record exceptions with an expiry date.
The ransomware landscape
The five-group sample above shows substantial posting activity but supports no reliable estimate of April’s total incident count or financial losses. It also cannot establish whether encryption took place in every claimed case. Avoid using a criminal group’s publication as the sole basis for naming a victim, or interpreting a posting spike as a same-day surge in intrusions.
GTIG’s 15 April 2026 analysis of Germany provides useful historical context: its dataset showed German leak-site listings rising 92 per cent in 2025 compared with 2024. That is a prior-year finding published in April, not an April growth rate. GTIG explicitly warns that posting counts are shaped by extortion negotiations and payment behaviour. Its analysis also describes risk to suppliers and medium-sized businesses, reinforcing the need to distinguish public visibility from the full incident population.
For response planning, our recommendation is to test the ability to restore services and to investigate data access as separate exercises. An organisation may need to address operational disruption, credential exposure and potential data theft through different workstreams. Evidence of one does not automatically establish the others. Keep communications tied to confirmed findings and update them as the investigation develops.
Policy and coordinated response
The international covert-network warning and the joint PLC advisory were concrete examples of coordinated government guidance this month. They addressed different populations and technical problems. Neither should be reduced to a generic instruction to block a list of addresses indefinitely; the sources call for contextual investigation and protective controls.
Our suggested management action is to turn applicable guidance into named responsibilities: the network owner checks exposure, the security team assesses evidence, and the service or engineering owner agrees recovery constraints. Record which advisory version informed the decision. This is particularly useful when later updates expand an advisory’s scope; a retrospective review should not quietly attribute those later findings to April.
What to watch
Our assessment is that follow-up work should concentrate on credentials and persistence after initial containment. Prioritise verification of device settings, investigation of exposed build credentials, and evidence collection on appliances with suspected compromise. Track new primary reporting separately from new attack activity: both the FIRESTARTER and UNC6692 reports demonstrate why the date an investigation becomes public is not necessarily the date of intrusion.
For May reporting, retain the same counting definitions and sample boundaries. A change in monitored group coverage, a retrospective addition to a dataset, or a revised advisory can change what is visible without demonstrating a corresponding change in attacker activity. Explain those changes before drawing a trend line.
April’s briefings
The companion weekly periods are 30 March 2026–5 April 2026, 6–12 April 2026, 13–19 April 2026 and 20–26 April 2026. This monthly review also includes the final four days of April. Published entries are collected in the weekly briefing index.
