May 2026 Threat Trend Report on APT Groups

### Executive Summary The May 2026 APT Trends report documents widespread, sophisticated activity by multiple nation-state-linked groups (e.g., Lazarus, Famous Chollima, Gamaredon, MuddyWater, Nimbus Manticore) that increasingly exploit development workflows, open-source packages, CI/CD systems, legitimate cloud services, and runtime environments to distribute malware, perform credential and wallet theft, and maintain persistent access across government, energy, defense, crypto, education, and telecom sectors.