ESET Reports on APT Group Activities in Q2 and Q3 2026
The ESET APT Activity Report for the second and third quarters of 2026 provides an in-depth analysis of the activities of selected advanced persistent threat (APT) groups. This report summarizes notable operations documented by ESET researchers from April to September 2026, reflecting the evolving threat landscape and key trends in cybersecurity.
During this period, China-aligned groups primarily focused on intelligence-collection operations targeting governmental entities. Notably, the group FamousSparrow continued its surveillance efforts in South America, while other actors engaged in campaigns that appeared to support Chinese law enforcement against organized crime in Southeast Asia and Oceania. One specific operation involved targeting hotels in Palau, which has become a hub for fraud-related activities. Additionally, the SlippyNunchucks group utilized its DarkVigil toolset in Sri Lanka, targeting Chinese-speaking individuals linked to financial fraud schemes. This activity aligns with broader regional law enforcement initiatives aimed at combating financial crime, particularly as scam operations have proliferated in neighboring countries, adversely affecting China itself. Furthermore, a significant focus was placed on Taiwanese organizations within the semiconductor industry, consistent with China's long-standing industrial espionage objectives.
In the Middle East, there was a noticeable increase in activity from Iran-aligned groups, which had previously seen a decline due to internet restrictions imposed by the Iranian government. Groups such as FilthyFeline and MuddyWater resumed operations, primarily targeting entities in Israel and, to a lesser extent, U.S. companies. FilthyFeline also took over operations against a cellular data service provider in Uzbekistan, previously compromised by another subgroup. New malware developments were observed within the Iran-aligned ecosystem, indicating a resurgence in operational capabilities. Additionally, the threat actor Arid Viper, affiliated with Hamas, targeted the Palestinian Authority’s Ministry of Foreign Affairs, likely to gather intelligence on diplomatic positions amid ongoing tensions in the region.
North Korea-aligned threat actors maintained their focus on technology and cryptocurrency sectors, with an increasing number of targets in Ukraine, reflecting the growing ties between North Korea and Russia amid the ongoing conflict. Lazarus, a prominent North Korean group, resumed its targeting of the drone sector, employing social engineering tactics to gain access. This interest is likely tied to the strategic importance of drone technology in the Ukraine conflict. Moreover, ScarCruft was detected targeting an African nation, potentially to monitor North Korean operations or Russian activities in the region. The group DeceptiveDevelopment shifted its tactics from fake job interviews to broader software supply-chain compromises, highlighting the evolving nature of their operations.
Russia's Cyber Operations in Ukraine Intensify
Russia-aligned activities continued to align with the country’s military objectives, particularly in Ukraine, where the number of targets increased significantly. The operations of Gamaredon, a group known for its extensive campaigns, saw a decline, possibly due to Ukrainian countermeasures. However, the group updated its malware tools and attempted to deploy spyware on Android devices while impersonating Ukrainian entities. An extensive campaign exploiting MDaemon mail servers was also identified, involving the deployment of multiple backdoor malware families.
The report also notes that North Korea's military cooperation with Russia may be influencing its cyber activities, with Belarus-aligned groups increasingly acting as cyber proxies for Russia. This trend was underscored by the first documented destructive cyberattack by a Belarus-aligned actor in Europe, targeting a critical manufacturing company in Ukraine.
Final Brief
Additionally, several APT groups have begun utilizing artificial intelligence and large language models to enhance their operations. This includes accelerating malware development and creating decoy websites. While AI has not fundamentally transformed the APT landscape, it is being used to streamline processes similar to mainstream software development practices.
ESET's findings underscore the ongoing threats posed by APT groups and the necessity for robust cybersecurity measures to protect against these evolving tactics. ESET products are designed to safeguard systems from the malicious activities outlined in this report, which is based on proprietary telemetry data verified by ESET researchers.
