ESET APT Activity Report Q2 2026–Q2 2026 summarizes notable activities of selected advanced persistent threat (APT) groups documented by ESET researchers between April and September 2026. The operations presented here reflect the broader threat landscape observed during this period and highlight some of its key trends and developments. They represent only a subset of the cybersecurity intelligence made available to customers of ESET Threat Intelligence APT Reports.
During the monitored period, China-aligned groups conducted intelligence-collection operations primarily against governmental targets. FamousSparrow kept up its monitoring in South America, just as in the previous reporting period. In Southeast Asia and Oceania, China-aligned threat actors ran campaigns that appear to support Chinese law enforcement efforts against organized crime in the region. One threat actor targeted hotels in Palau, which seems to be increasingly used as a base for fraud-related organized crime. SlippyNunchucks deployed its DarkVigil toolset in Sri Lanka against Chinese-speaking individuals connected to fraud schemes, likely in the context of broader regional law enforcement efforts against financial crime. As scam compounds have become an issue for countries neighboring China, with direct negative effects on China itself, it is likely that China-aligned APT groups have supported law enforcement efforts in this area. Another, broader cluster of activity targeted Taiwanese organizations operating in the semiconductor industry. This focus on Taiwan’s semiconductor sector is consistent with long-running Chinese industrial espionage priorities, and the strategic importance of semiconductor supply chains to both economic competition and national security.
Middle East-aligned activity increased compared with the previous reporting period, driven mainly by the return of several established Iran-aligned groups. In the previous period, activity from these groups had declined, most likely because internet restrictions imposed by the Iranian regime hindered their own ability to operate effectively. FilthyFeline, a subgroup of OilRig, and MuddyWater resumed operations after a quieter period, with most activity directed at entities in Israel across multiple sectors; a smaller number of US companies were also affected. FilthyFeline also appears to have taken over activity against a cellular data service provider in Uzbekistan that had previously been compromised by BladedFeline, another OilRig subgroup. In parallel, we analyzed new or updated malware, suggesting renewed development activity within parts of the Iran-aligned ecosystem. We also discovered activity by Arid Viper, a Hamas-affiliated threat actor, against what appears to be the Palestinian Authority’s Ministry of Foreign Affairs and Expatriates or an affiliated governmental entity. Given the ongoing US-led peace process, as well as the long-standing rivalry between Hamas and the Palestinian Authority, this activity was potentially intended to collect intelligence on the Palestinian Authority’s diplomatic position and internal thinking regarding negotiations to reduce hostilities in the region.
North Korea-aligned threat actors did not deviate significantly from the types of targets seen in previous reporting periods. These include primarily technology and cryptocurrency companies, software developers, and other opportunistic targets. Alongside South Korea, Ukraine has become increasingly prominent among North Korea-aligned targets. This is likely related to growing ties between Russia and North Korea, and North Korea’s increasing involvement in Russia’s war against Ukraine, not only through indirect military support (munitions, etc.) but also through the deployment of North Korean soldiers. Alongside these broader trends, Lazarus resumed targeting of the drone sector, typically using recruitment-themed social engineering to gain initial access. The likely motivation is the increasingly important role that drone systems are playing in the war in Ukraine, where new tactics and capabilities are being tested. Access to such knowledge and manufacturing processes could provide North Korea with valuable know-how for developing its own drone-production capabilities. We also detected ScarCruft targeting an African country, which was probably intended either to maintain oversight of a North Korean worker scheme operating in the country or to monitor Russian activities there. Separately, DeceptiveDevelopment moved from fake job-interview lures to broader software supply-chain compromises, harvesting developer credentials and using that access to inject malicious code into public and private source code repositories.
Russia-aligned activity continued to support its war objectives, targeting governments, the defense sector, and military entities in Europe, with a substantially higher number of targets in Ukraine. Looking more closely at these activities, similarities between Russia-aligned and Belarus-aligned campaigns stand out, further supporting our hypothesis that threat actors aligned with the two countries are becoming operationally closer. Gamaredon’s operations, which are typically numerous, saw a significant decline. We suspect that this could be related to Ukrainian attacks on Crimea, where the group is suspected to operate, a broader restructuring of its operations, or other factors that we continue to assess. Despite this decline in activity, Gamaredon updated its PteroBox file stealer and started using new tools such as PteroPSDoor and Turla’s VBScript Rezzuar. PhantomCaptcha attempted to deploy spyware, which we named PrincessSpy, on Android devices while impersonating Ukrainian entities. We also identified an extensive campaign in Ukraine exploiting MDaemon mail servers, during which the attackers deployed two backdoor malware families, HELLAGE and HELLTAG.
North Korea’s expanding military cooperation with Russia has prompted expectations that North Korea-aligned cyberactivity might be starting to align more closely with Russian objectives in Ukraine. While some of their targeting interests overlap, notably around the drone sector, our telemetry more clearly points to Belarus-aligned groups acting as cyberproxies or force multipliers for Russia. We observed increased and more assertive activity from Belarus-aligned threat actors, with their operations increasingly reflecting Russia’s intelligence priorities in Ukraine in some areas. Most notably, we identified the first destructive cyberattack by a Belarus-aligned threat actor that we have documented in the European theater, marking a significant development in this threat nexus. According to our telemetry, FrostyNeighbor attacked a manufacturing company in Ukraine that plays an important role in the country’s transportation sector. This marks a notable escalation, as threat actors with a well-established history of destructive cyberoperations in Ukraine have, until now, been Russia-aligned.
Finally, we identified several cases of APT groups using AI and large language models (LLMs) at various stages of their operations. Threat actors used AI primarily to accelerate tasks that would otherwise require painstaking effort, including malware development and the creation of decoy websites. In some cases, this resembled vibe coding: rapid, prompt-driven drafting of code, with human operators adapting and integrating the results into their toolchains. We also discovered phishing lures containing images that were clearly AI-generated. In one notable case, Russia-aligned UAC-0099 inserted a decoy request for instructions on building a nuclear weapon into a script comment, apparently attempting to trigger the safety guardrails of LLM-based security analysis and prevent the inspection of the malicious code that followed.
Despite these developments, we have not noticed AI substantially reshaping the APT landscape over the past six months. While we cannot determine whether some operations may involve a higher degree of AI-driven automation, our telemetry continues to show hands-on-keyboard activity and operations that are not fully automated. Overall, our observations suggest that APT groups are currently using AI much like mainstream software developers: to accelerate software development, automate previously manual tasks, and assist with the analysis of large volumes of data, rather than to conduct fully autonomous malicious operations.
ESET products protect our customers’ systems from the malicious activities described in this report. Intelligence shared here is based mostly on proprietary ESET telemetry data and has been verified by ESET researchers.
ESET APT Activity Reports contain only a fraction of the cybersecurity intelligence data provided in ESET Threat Intelligence APT Reports. For more information, visit the ESET Threat Intelligence website.
