An summary of the actions of chosen APT teams investigated and analyzed by ESET Analysis in Q2 2026 and Q3 2026
28 Oct 2026
•
,
6 min. learn
ESET APT Exercise Report Q2 2026–Q3 2026 summarizes notable actions of chosen superior persistent risk (APT) teams documented by ESET researchers between April and September 2026. The operations offered right here replicate the broader risk panorama noticed throughout this era and spotlight a few of its key developments and developments. They symbolize solely a subset of the cybersecurity intelligence made out there to prospects of ESET Menace Intelligence APT Stories.
Throughout the monitored interval, China-aligned teams performed intelligence-collection operations primarily towards governmental targets. FamousSparrow stored up its monitoring in South America, simply as within the earlier reporting interval. In Southeast Asia and Oceania, China-aligned risk actors ran campaigns that seem to assist Chinese language legislation enforcement efforts towards organized crime within the area. One risk actor focused inns in Palau, which appears to be more and more used as a base for fraud-related organized crime. SlippyNunchucks deployed its DarkVigil toolset in Sri Lanka towards Chinese language-speaking people related to fraud schemes, possible within the context of broader regional legislation enforcement efforts towards monetary crime. As rip-off compounds have turn out to be a problem for international locations neighboring China, with direct adverse results on China itself, it’s possible that China-aligned APT teams have supported legislation enforcement efforts on this space. One other, broader cluster of exercise focused Taiwanese organizations working within the semiconductor trade. This deal with Taiwan’s semiconductor sector is in keeping with long-running Chinese language industrial espionage priorities, and the strategic significance of semiconductor provide chains to each financial competitors and nationwide safety.
Center East-aligned exercise elevated in contrast with the earlier reporting interval, pushed primarily by the return of a number of established Iran-aligned teams. Within the earlier interval, exercise from these teams had declined, more than likely as a result of web restrictions imposed by the Iranian regime hindered their very own potential to function successfully. FilthyFeline, a subgroup of OilRig, and MuddyWater resumed operations after a quieter interval, with most exercise directed at entities in Israel throughout a number of sectors; a smaller variety of US firms have been additionally affected. FilthyFeline additionally seems to have taken over exercise towards a mobile information service supplier in Uzbekistan that had beforehand been compromised by BladedFeline, one other OilRig subgroup. In parallel, we analyzed new or up to date malware, suggesting renewed growth exercise inside components of the Iran-aligned ecosystem. We additionally found exercise by Arid Viper, a Hamas-affiliated risk actor, towards what seems to be the Palestinian Authority’s Ministry of Overseas Affairs and Expatriates or an affiliated governmental entity. Given the continued US-led peace course of, in addition to the long-standing rivalry between Hamas and the Palestinian Authority, this exercise was probably supposed to gather intelligence on the Palestinian Authority’s diplomatic place and inner pondering concerning negotiations to cut back hostilities within the area.
North Korea-aligned risk actors didn’t deviate considerably from the kinds of targets seen in earlier reporting durations. These embody primarily know-how and cryptocurrency firms, software program builders, and different opportunistic targets. Alongside South Korea, Ukraine has turn out to be more and more outstanding amongst North Korea-aligned targets. That is possible associated to rising ties between Russia and North Korea, and North Korea’s rising involvement in Russia’s battle towards Ukraine, not solely by oblique army assist (munitions, and so forth.) but in addition by the deployment of North Korean troopers. Alongside these broader developments, Lazarus resumed focusing on of the drone sector, sometimes utilizing recruitment-themed social engineering to realize preliminary entry. The possible motivation is the more and more necessary position that drone programs are taking part in within the battle in Ukraine, the place new techniques and capabilities are being examined. Entry to such data and manufacturing processes may present North Korea with useful know-how for creating its personal drone-production capabilities. We additionally detected ScarCruft focusing on an African nation, which was in all probability supposed both to keep up oversight of a North Korean employee scheme working within the nation or to observe Russian actions there. Individually, DeceptiveDevelopment moved from faux job-interview lures to broader software program supply-chain compromises, harvesting developer credentials and utilizing that entry to inject malicious code into private and non-private supply code repositories.
Russia-aligned exercise continued to assist its battle targets, focusing on governments, the protection sector, and army entities in Europe, with a considerably increased variety of targets in Ukraine. Wanting extra carefully at these actions, similarities between Russia-aligned and Belarus-aligned campaigns stand out, additional supporting our speculation that risk actors aligned with the 2 international locations have gotten operationally nearer. Gamaredon’s operations, that are sometimes quite a few, noticed a big decline. We suspect that this might be associated to Ukrainian assaults on Crimea, the place the group is suspected to function, a broader restructuring of its operations, or different elements that we proceed to evaluate. Regardless of this decline in exercise, Gamaredon up to date its PteroBox file stealer and began utilizing new instruments resembling PteroPSDoor and Turla’s VBScript Rezzuar. PhantomCaptcha tried to deploy spyware and adware, which we named PrincessSpy, on Android gadgets whereas impersonating Ukrainian entities. We additionally recognized an in depth marketing campaign in Ukraine exploiting MDaemon mail servers, throughout which the attackers deployed two backdoor malware households, HELLAGE and HELLTAG.
North Korea’s increasing army cooperation with Russia has prompted expectations that North Korea-aligned cyberactivity is likely to be beginning to align extra carefully with Russian targets in Ukraine. Whereas a few of their focusing on pursuits overlap, notably across the drone sector, our telemetry extra clearly factors to Belarus-aligned teams appearing as cyberproxies or pressure multipliers for Russia. We noticed elevated and extra assertive exercise from Belarus-aligned risk actors, with their operations more and more reflecting Russia’s intelligence priorities in Ukraine in some areas. Most notably, we recognized the primary damaging cyberattack by a Belarus-aligned risk actor that now we have documented within the European theater, marking a big growth on this risk nexus. In accordance with our telemetry, FrostyNeighbor attacked a producing firm in Ukraine that performs an necessary position within the nation’s transportation sector. This marks a notable escalation, as risk actors with a well-established historical past of damaging cyberoperations in Ukraine have, till now, been Russia-aligned.
Lastly, we recognized a number of circumstances of APT teams utilizing AI and enormous language fashions (LLMs) at numerous phases of their operations. Menace actors used AI primarily to speed up duties that may in any other case require painstaking effort, together with malware growth and the creation of decoy web sites. In some circumstances, this resembled vibe coding: fast, prompt-driven drafting of code, with human operators adapting and integrating the outcomes into their toolchains. We additionally found phishing lures containing pictures that have been clearly AI-generated. In a single notable case, Russia-aligned UAC-0099 inserted a decoy request for directions on constructing a nuclear weapon right into a script remark, apparently trying to set off the security guardrails of LLM-based safety evaluation and forestall the inspection of the malicious code that adopted.
Regardless of these developments, now we have not observed AI considerably reshaping the APT panorama over the previous six months. Whereas we can’t decide whether or not some operations might contain a better diploma of AI-driven automation, our telemetry continues to point out hands-on-keyboard exercise and operations that aren’t absolutely automated. General, our observations recommend that APT teams are presently utilizing AI very like mainstream software program builders: to speed up software program growth, automate beforehand guide duties, and help with the evaluation of enormous volumes of information, relatively than to conduct absolutely autonomous malicious operations.
ESET merchandise defend our prospects’ programs from the malicious actions described on this report. Intelligence shared right here is primarily based on proprietary ESET telemetry information and has been verified by ESET researchers.
ESET APT Exercise Stories include solely a fraction of the cybersecurity intelligence information supplied in ESET Menace Intelligence APT Stories. For extra data, go to the ESET Menace Intelligence web site.
