A Look Back at 11 of the Red Report 2026 Featured Threats

Several state-sponsored and financially motivated threat actors leveraged widely used MITRE ATT&CK techniques identified in Picus Security’s Red Report 2026 to compromise target environments.

After reviewing the original materials, we analyzed 147 network-based IoCs¹ in total, comprising subdomains, domains, and IP addresses associated with 11 attacks linked to groups such as STATICPLUGIN, SadBridge Loader, XLoader, Operation BarrelFire, ClickFix, APT36, Chihuahua Stealer, Earth Ammit, PlushDaemon, and Earth Alux.

Using our homegrown tools to investigate the threat, we uncovered these findings:

• 616 unique client IP addresses communicated with five domains identified as IoCs
• 23 domains classified as IoCs were bulk-registered with 2–936 look-alike domains each
• 28 domains tagged as IoCs deemed likely to turn malicious 46–516 days before they were reported as such
• Three unique potential victim IP addresses communicated with two IP addresses named as IoCs
• 7,770 email-connected domains, 25 were confirmed malicious
• 56 additional IP addresses, 46 were confirmed malicious
• 186 IP-connected domains, 143 were confirmed malicious
• 2,106 string-connected domains, two were confirmed malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.picussecurity.com/red-report