ESET Report Tracks APT Activity and AI Use From April to September 2026
Summary
ESET’s Q2–Q3 2026 report summarizes selected APT activity from April to September, including regional targeting shifts, a destructive Belarus-aligned operation in Ukraine, supply-chain compromises, and AI use that has not substantially changed APT operations.
Key points
- The report covers selected APT activity from April through September 2026, based mostly on ESET telemetry and verified by ESET researchers.
- China-aligned groups targeted government, semiconductor, and other organizations; the report describes activity that may support regional law-enforcement priorities.
- Iran-aligned groups including FilthyFeline and MuddyWater resumed operations, mainly targeting entities in Israel; some targeting and intent assessments remain tentative.
- North Korea-aligned activity included Lazarus targeting the drone sector and DeceptiveDevelopment compromising software supply chains to steal developer credentials and inject code into repositories.
- Russia-aligned groups continued targeting Ukraine and other European government, defense, and military entities; ESET reported a decline in Gamaredon activity alongside new tools and malware.
- ESET documented FrostyNeighbor’s destructive attack on a Ukrainian manufacturing company important to the transportation sector, describing it as the first such Belarus-aligned attack ESET had documented in the European theater.
- APT groups used AI and large language models to assist tasks such as malware development and decoy creation, but ESET said its observations did not show AI substantially reshaping APT operations.
Article Details
- Publisher
- ESET
- Report Period
- 2026-04 to 2026-09
- Scope
- Selected APT group activity documented by ESET researchers, based mostly on ESET telemetry.
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainDeceptiveDevelopment reportedly carried out software supply-chain compromises, harvesting developer credentials and injecting malicious code into public and private source code repositories.T1566 · PhishingThe report describes phishing lures, including recruitment-themed social engineering used by Lazarus to gain initial access.
Threat Actors
APT37The report detected ScarCruft targeting an unspecified African country; it assesses that the activity was probably intended to monitor a North Korean worker scheme or Russian activities there.Arid ViperDescribed as Hamas-affiliated, Arid Viper conducted activity against what appears to be the Palestinian Authority’s Ministry of Foreign Affairs and Expatriates or an affiliated governmental entity. The report presents the target and possible intelligence-collection motive as uncertain.BladedFelineIdentified as an OilRig subgroup, BladedFeline had previously compromised a cellular data service provider in Uzbekistan; the report says FilthyFeline appears to have taken over activity against that provider.DeceptiveDevelopmentThe report says DeceptiveDevelopment expanded from fake job-interview lures to software supply-chain compromises, harvesting developer credentials and injecting malicious code into public and private source code repositories.FamousSparrowThe report says FamousSparrow continued monitoring activity in South America during the reporting period.FilthyFelineIdentified as an OilRig subgroup, FilthyFeline resumed operations, with most reported activity directed at entities in Israel. It also appears to have taken over activity against a cellular data service provider in Uzbekistan previously compromised by BladedFeline.FrostyNeighborAccording to ESET telemetry, FrostyNeighbor attacked a manufacturing company in Ukraine that plays an important role in the country’s transportation sector; the report characterizes this as the first destructive cyberattack by a Belarus-aligned actor documented by ESET in the European theater.GamaredonThe report describes a significant decline in Gamaredon operations and says the group updated its PteroBox file stealer. The cause of the activity decline remains under assessment.LazarusThe report says Lazarus resumed targeting the drone sector, typically using recruitment-themed social engineering to gain initial access.MuddyWaterThe report says MuddyWater resumed operations after a quieter period, with most activity directed at entities in Israel.OilRigThe report identifies FilthyFeline and BladedFeline as OilRig subgroups and describes operations by those subgroups.PhantomCaptchaThe report says PhantomCaptcha attempted to deploy spyware on Android devices while impersonating Ukrainian entities.SlippyNunchucksThe report says SlippyNunchucks deployed its DarkVigil toolset in Sri Lanka against Chinese-speaking individuals connected to fraud schemes; the broader activity may have supported regional law-enforcement efforts.UAC-0099The report says UAC-0099 inserted a decoy request about building a nuclear weapon into a script comment, apparently attempting to trigger LLM safety guardrails and prevent inspection of the malicious code that followed.
Malware
HELLAGEWe also identified an extensive campaign in Ukraine exploiting MDaemon mail servers, during which the attackers deployed two backdoor malware families, HELLAGE and HELLTAG.HELLTAGWe also identified an extensive campaign in Ukraine exploiting MDaemon mail servers, during which the attackers deployed two backdoor malware families, HELLAGE and HELLTAG.PrincessSpyPhantomCaptcha attempted to deploy spyware, which we named PrincessSpy, on Android devices while impersonating Ukrainian entities.PteroBoxDespite this decline in activity, Gamaredon updated its PteroBox file stealer and started using new tools such as PteroPSDoor and Turla’s VBScript Rezzuar.
Vendors
Products
Tools
DarkVigilSlippyNunchucks deployed its DarkVigil toolset in Sri Lanka against Chinese-speaking individuals connected to fraud schemes, likely in the context of broader regional law enforcement efforts against financial crime.PteroPSDoorDespite this decline in activity, Gamaredon updated its PteroBox file stealer and started using new tools such as PteroPSDoor and Turla’s VBScript Rezzuar.RezzuarDespite this decline in activity, Gamaredon updated its PteroBox file stealer and started using new tools such as PteroPSDoor and Turla’s VBScript Rezzuar.
Countries
BelarusLooking more closely at these activities, similarities between Russia-aligned and Belarus-aligned campaigns stand out, further supporting our hypothesis that threat actors aligned with the two countries are becomingChinaDuring the monitored period, China-aligned groups conducted intelligence-collection operations primarily against governmental targets.IranMiddle East-aligned activity increased compared with the previous reporting period, driven mainly by the return of several established Iran-aligned groups.Israeland MuddyWater resumed operations after a quieter period, with most activity directed at entities in Israel across multiple sectors; a smaller number of US companies were also affected.North KoreaNorth Korea-aligned threat actors did not deviate significantly from the types of targets seen in previous reporting periods.PalauOne threat actor targeted hotels in Palau, which seems to be increasingly used as a base for fraud-related organized crime.RussiaThis is likely related to growing ties between Russia and North Korea, and North Korea’s increasing involvement in Russia’s war against Ukraine, not only through indirect military support (munitions, etc.) but alsoSouth KoreaAlongside South Korea, Ukraine has become increasingly prominent among North Korea-aligned targets.Sri LankaSlippyNunchucks deployed its DarkVigil toolset in Sri Lanka against Chinese-speaking individuals connected to fraud schemes, likely in the context of broader regional law enforcement efforts against financial crime.TaiwanThis focus on Taiwan’s semiconductor sector is consistent with long-running Chinese industrial espionage priorities, and the strategic importance of semiconductor supply chains to both economic competition and nationalUkraineAlongside South Korea, Ukraine has become increasingly prominent among North Korea-aligned targets.United Statesperiod, with most activity directed at entities in Israel across multiple sectors; a smaller number of US companies were also affected.UzbekistanFilthyFeline also appears to have taken over activity against a cellular data service provider in Uzbekistan that had previously been compromised by BladedFeline, another OilRig subgroup.
Industries
CryptocurrencyThese include primarily technology and cryptocurrency companies, software developers, and other opportunistic targets.DefenseRussia-aligned activity continued to support its war objectives, targeting governments, the defense sector, and military entities in Europe, with a substantially higher number of targets in Ukraine.droneAlongside these broader trends, Lazarus resumed targeting of the drone sector, typically using recruitment-themed social engineering to gain initial access.ManufacturingAccess to such knowledge and manufacturing processes could provide North Korea with valuable know-how for developing its own drone-production capabilities.Militaryand North Korea’s increasing involvement in Russia’s war against Ukraine, not only through indirect military support (munitions, etc.) but also through the deployment of North Korean soldiers.semiconductorAnother, broader cluster of activity targeted Taiwanese organizations operating in the semiconductor industry.Software developmentthat APT groups are currently using AI much like mainstream software developers: to accelerate software development, automate previously manual tasks, and assist with the analysis of large volumes of data, ratherTechnologyThese include primarily technology and cryptocurrency companies, software developers, and other opportunistic targets.TransportationAccording to our telemetry, FrostyNeighbor attacked a manufacturing company in Ukraine that plays an important role in the country’s transportation sector.