Top 10 Critical Threat Actors to Watch in 2026: Ransomware, APTs & Defensive Strategies

A Viettel Cyber Security analysis of the current trend of APT groups combining their operations with ransomware attacks.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.

Viettel Threat Intelligence tracks Goblin Panda (aka Hellsing, 1937CN) campaigns exploiting COVID-19 themes, using RTF exploits and PlugX/NewCoreRAT to breach government targets and evade most AVs.

Kaspersky's Holy Water campaign analysis: compromised religious and charity websites in Asia served staged JavaScript that profiled visitors and delivered fake Flash updates installing backdoors.

Viettel researchers walk through a Mustang Panda APT sample disguised as a job CV that targeted a Vietnamese provincial government via an @edu.vn phishing email.