Executive summary
May’s reporting showed repeated attempts to turn trusted software, developer access and authenticated cloud sessions into routes for further compromise. The US Cybersecurity and Infrastructure Security Agency (CISA) added 21 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue, and the National Vulnerability Database (NVD) records 6,985 vulnerability publications during the month. Wiz reported another supply-chain wave affecting npm packages, GitHub Actions and a development extension, while Google Threat Intelligence Group (GTIG) described voice-phishing-led data theft and investigations involving artificial intelligence (AI). Law enforcement also disrupted First VPN, a service Eurojust says was marketed to cybercriminals. We assess it is likely (B2) that effective containment of the development and identity intrusions described this month requires both endpoint investigation and credential recovery, because the source reports describe access moving from an initial device or login into additional services and repositories.
The month in numbers
The CISA catalogue published on 29 May 2026, the final version before this review, contains 21 additions dated 1–31 May 2026. Two records, concerning Nx Console and TanStack, mark ransomware campaign use as known. Nineteen mark it unknown. These labels belong to the historical catalogue version; they should not be silently replaced by later updates or interpreted as an exhaustive inventory of attacker use.
The NVD publication-date query for May returns 6,985 Common Vulnerabilities and Exposures (CVE) records. The query covers timestamps from the start of 1 May 2026 to the end of 31 May 2026. It measures records published by NVD, not newly launched attacks, unique software products or vulnerabilities present in a particular organisation.
The same five ransomware.live group pages used in the April review contain 334 postings with May discovery dates. These are criminal claims recorded by the monitoring service. The sample is deliberately limited to the named pages and is not a global incident total, a list of confirmed breaches or a measurement of ransom payments. The date filter uses the service’s discovery field, rather than a claimed or estimated intrusion date.
| ransomware.live group label | May postings in the selected pages | Public source |
|---|---|---|
| Qilin | 114 | Qilin page |
| Thegentlemen | 90 | Thegentlemen page |
| Dragonforce | 55 | Dragonforce page |
| Akira | 43 | Akira page |
| Incransom | 32 | Incransom page |
Do not infer an overall rise or fall in ransomware from this small sample. Posting practices, collection coverage and delayed disclosure can change the observed numbers. For a repeatable management view, retain the group selection, date field and source snapshot, and keep these counts separate from independently confirmed incidents handled by the organisation.
Four themes
1. Compromised development tooling crossed several distribution routes
Wiz’s 19 May 2026 investigation describes malicious activity affecting npm packages, including the @antv namespace, GitHub Actions and a Visual Studio Code extension. The payload sought development credentials and included a Python backdoor. Wiz attributes the activity to TeamPCP with moderate confidence, citing technical and operational overlaps. Its report says the backdoor’s command infrastructure had not been observed active at that point; the existence of persistence code is not proof that its operators had used every capability.
This was not the month’s only supply-chain case. In its 5 May 2026 report, ESET attributed compromise of a gaming platform aimed at the Yanbian region to ScarCruft, which it describes as aligned with North Korea. ESET found trojanised Android games and evidence of an earlier malicious Windows update, deploying the BirdCall backdoor. It assessed that the attack probably began in late 2024. At publication, the Windows update was no longer malicious, and ESET had found no malicious code in the iOS game. Those platform and timing limits should remain attached to the finding.
Our recommendation is to inventory the software execution paths that a conventional application list can miss: editor extensions, automation actions, installation scripts and update channels. Investigate the version that executed at the relevant time, not simply the version visible today. When exposure is confirmed, preserve build and endpoint evidence before cleaning it, determine which secrets were reachable, and examine the use of those secrets in other systems. A current clean download does not establish that every earlier installation was safe.
For procurement and engineering leaders, the practical question is whether an owner can identify and remove a compromised dependency without losing the history needed for investigation. Exercise that process on a representative service. Record package sources, release provenance and emergency replacement procedures, and include the staff workstations and build workers that prepare releases. These are our suggested controls, rather than a claim that the two campaigns shared an operator or initial entry point.
2. Identity theft opened routes into cloud data and source code
GTIG’s 15 May 2026 BlackFile report tracks the operation as UNC6671. It describes voice phishing, imitation sign-in pages and stolen authenticated access used against Microsoft 365 and Okta environments, followed by scripted data collection and extortion. GTIG assesses that the operation is distinct from ShinyHunters’ UNC6240 cluster, even though UNC6671 had used the ShinyHunters name in one instance. A name appearing in a threat message is therefore not sufficient to merge the investigations.
In a separate 27 May 2026 report, Wiz introduced JINX-0164, a cluster targeting cryptocurrency organisations. Wiz describes social engineering leading to macOS malware and stolen credentials, then changes to internal repositories that could spread the compromise to other developers. Its investigation links the activity to financial motives but says the evidence does not establish a sponsor. Similarities to tactics associated with North Korean groups are discussed in the report; they are not a basis for attributing JINX-0164 to North Korea.
The shared defensive issue is the movement from an apparently local event to services with wider reach. Our recommendation is to map that movement explicitly. Identify which sessions, application grants, repository credentials and administrative permissions were available to the compromised user. Review actions taken with those identities, rather than limiting the investigation to the malware file or phishing page. Where access was abused, revoke the relevant sessions and credentials through the affected service and verify that unauthorised changes have been reversed.
Support procedures should make independent verification routine. A caller asking for an urgent account repair should be checked through an established organisational channel. Security teams should examine unexpected bulk downloads alongside sign-in context and the privileges of the account involved. Developers should review unusual commits against service audit records and approved workflows. None of these signals alone establishes malicious intent; their value lies in correlating events and validating the explanation.
3. AI assistance changed some workflows without proving universal autonomy
The 11 May 2026 GTIG AI threat tracker reports observations of model-assisted vulnerability research, malware development and operational support. In one case, GTIG assessed with high confidence that AI helped develop a zero-day exploit. It says the actors planned mass exploitation and that its intervention may have prevented that use. The distinction matters: a planned campaign is not a confirmed mass compromise, and GTIG’s assessment of AI involvement is not direct proof of the tool used for every development step.
The report also treats AI software and dependencies as targets. For defenders, this suggests two separate workstreams: understanding how adversaries may use models, and protecting the software and credentials attached to the organisation’s own AI environment. Our recommendation is to apply existing controls for software provenance, secret handling, network access and change approval before adding speculative controls based only on an “AI-powered” label. A model-assisted script still leaves actions that can be investigated in the systems it accesses.
SentinelLABS’ 7 May 2026 PCPJack research provides a useful comparison. It describes a cloud credential-theft framework that spreads across exposed services and removes artefacts associated with TeamPCP. The toolsets analysed did not deploy cryptocurrency miners. SentinelLABS suggests a former TeamPCP operator could be responsible, but presents that as a possibility, not an established identity. Credential collection and propagation are the observed technical concerns; operator history and eventual monetisation remain separate assessments.
Our recommended triage is behaviour-led. Investigate unexpected automation against exposed administrative services, new persistence, unusual credential access and unauthorised outbound traffic. Do not require a cryptocurrency miner to be present before treating a cloud intrusion as serious. Likewise, do not infer the responsible group solely from a competitor’s files being removed: a technical interaction between toolsets is weaker evidence than a demonstrated operator relationship.
4. Ransomware response depended on what evidence survived
Huntress’ 21 May 2026 investigation describes two incidents involving The Gentlemen ransomware, one investigated in April and the other in May. Both included scheduled tasks, PowerShell activity and clearing of selected Windows event logs. Huntress deployed its agent after the incidents and explicitly notes the resulting visibility limits, including uncertainty about initial access. Its analysis found surviving logs that still helped reconstruct activity. The earliest observed connection should not be presented as the proven initial entry route.
Our operational recommendation is to preserve multiple evidence sources and verify collection outside the affected endpoint. Review security-agent health, log forwarding and administrative changes as part of incident response. Distinguish a detection from successful remediation: a product reporting a malicious file does not by itself establish that every execution was blocked or that the intrusion has ended. Reconcile the alert with subsequent host activity and service availability.
For continuity planning, agree how to isolate affected systems, maintain critical operations and restore trusted services. Keep the data-theft investigation separate from the encryption recovery task. Public leak-site claims may trigger investigation, but they cannot substitute for evidence of what was accessed. The five-group posting sample above is useful context for extortion reporting, not a substitute for organisation-specific findings.
Actors of the month
The main attribution boundaries are as consequential as the names. Wiz gives moderate confidence for TeamPCP in the 19 May 2026 development-tool campaign and leaves JINX-0164’s sponsor unresolved. ESET attributes its gaming-platform case to ScarCruft. GTIG separates BlackFile’s UNC6671 from UNC6240, while SentinelLABS treats PCPJack’s possible personnel overlap as a hypothesis. Keeping those qualifications prevents a monthly review from turning several independent findings into one unsupported campaign narrative.
For intelligence production, retain the vendor’s tracking label and confidence alongside the activity. Similar target industries, hosting providers or social-engineering themes are useful research leads but do not demonstrate shared control. Where two publishers use different names, record the source of any claimed equivalence rather than resolving it by resemblance. This is particularly important when criminals reuse another group’s branding.
The vulnerability landscape
The May KEV snapshot shows additions spanning operating systems, network appliances, development components and web applications. Linux kernel CVE-2026-31431 was added on 1 May 2026; PAN-OS CVE-2026-0300 followed on 6 May 2026. Later additions include Nx Console and TanStack on 27 May 2026 and another PAN-OS flaw on 29 May 2026. Their addition dates are dates of catalogue inclusion, not necessarily first exploitation.
CERT-EU’s 6 May 2026 advisory describes CVE-2026-0300 in the PAN-OS User-ID Authentication Portal. Its scope is PA-Series and VM-Series firewalls configured to use that service. CERT-EU reports that Palo Alto Networks had observed limited exploitation and recommends restricting access to trusted zones or disabling the feature when unnecessary, alongside applying vendor fixes when available. Its statement that patches were not yet available applies to that advisory’s publication time, not to every day remaining in May.
Mandiant’s 25 May 2026 KnowledgeDeliver investigation describes a different failure: shared ASP.NET machine keys across deployments. Mandiant says an unknown actor exploited this to execute code and modify the learning-management platform so visiting users would encounter malicious content. The incident response began in late 2025; May is the report’s publication month. The flaw is tracked as CVE-2026-5426. Mandiant recommends unique, strong keys for each instance and investigation of possible exploitation. It also cautions that an invalid-ViewState event can show attempted deserialisation without proving that the payload executed.
Our recommended patch report therefore includes configuration and investigation status as separate fields. Confirm the vulnerable feature is present, identify the applicable vendor remediation, and document whether evidence suggests prior compromise. For a shared-secret issue, verify replacement of the secret itself. For an exposed appliance, verify the access policy as well as the software change. Record the evidence supporting closure, rather than assuming that one action resolves every part of the incident.
Law enforcement and coordinated disruption
Eurojust announced on 21 May 2026 that French and Dutch authorities, supported by Eurojust and Europol, disrupted First VPN in coordinated action on 19–20 May 2026. The release reports the dismantling of at least 33 servers and a search and interview of a suspect in Ukraine. It says investigators gained access to the service before it went offline, providing traffic information relevant to further investigations. This is a disruption announcement, not a conviction of the interviewed suspect or proof that every related investigation is complete.
For defenders, the practical follow-up is to preserve relevant records and assess any notification through an authenticated official channel. Avoid treating an address once associated with the service as permanently malicious without checking its timeframe and context. A disruption can create investigative opportunities, but it does not establish that a victim organisation’s credentials have been revoked or its affected systems restored.
What to watch
Our assessment is that June follow-up should focus on the downstream use of credentials and on persistence left by May’s intrusions. Check whether containment covered development machines, build environments and connected services, rather than closing an investigation after removing the first malicious component. Track new primary evidence about the @antv campaign and the identity-focused operations without upgrading attribution merely because the same branding reappears.
Use explicit evidence thresholds for AI-related claims. A publisher’s assessment that a model helped write an exploit is distinct from observed autonomous exploitation, and both differ from an organisation being compromised through an AI dependency. Keeping those categories separate makes the resulting defensive priorities easier to test and prevents a broad technology label from obscuring the actual access path.
May’s briefings
The companion weekly periods are 27 April 2026–3 May 2026, 4–10 May 2026, 11–17 May 2026, 18–24 May 2026 and 25–31 May 2026. Published entries are collected in the weekly briefing index. This monthly review covers 1–31 May 2026, including developments disclosed near the end of the month; the count definitions and five-group ransomware sample match the April review.
