ESET Report Details APT Campaigns and Threat Trends From October 2025 to March 2026
Summary
ESET’s report reviews APT activity from October 2025 to March 2026, including espionage, destructive attacks, phishing, spyware, ransomware attempts, and the compromise of the axios JavaScript library.
Key points
- China-aligned groups targeted government, maritime, energy, and strategic-technology organizations; ESET also identified a new implant associated with UNC5221’s SPAWN toolset targeting Ivanti VPN appliances.
- Iran’s war-period activity shifted as internet restrictions hindered established groups, while proxy and hacktivist actors targeted Israel, the United States, and other states.
- North Korea-aligned groups pursued developers and cryptocurrency targets through social engineering; Andariel deployed TigerRAT and attempted to spread Rook ransomware at a South Korean engineering company.
- Attackers used a compromised maintainer account to publish malicious versions of the axios JavaScript library; the versions were detected and removed.
- Russia-aligned actors focused on Ukraine, with Sandworm deploying new wipers; ESET attributed a December 2025 destructive incident at a Polish energy company to Sandworm with medium confidence.
- Other campaigns included browser-in-the-browser phishing against a Japanese think tank, Android spyware targeting Arabic speakers, and a UAE defense-company compromise through a SmartOffice CRM server.
- ESET says the report is based mostly on proprietary telemetry and was verified by its researchers.
Article Details
- Publisher
- ESET
- Report Period
- 2025-10 through 2026-03
- Scope
- Selected APT group activity documented by ESET researchers, based mostly on proprietary ESET telemetry.
- Key Statistics
- The report covers six months, from October 2025 through March 2026.
- The axios library has over 100 million weekly downloads on the npm registry.
Threat Actors
AndarielReemerged in South Korea, deployed TigerRAT, and attempted to spread Rook ransomware within an engineering company.DeceptiveDevelopmentNorth Korea-aligned group that continued long-term relationship building with high-value targets.FamousSparrowTargeted a Venezuelan governmental entity connected to maritime affairs.KimsukyNorth Korea-aligned group that favored quicker, more opportunistic attacks.KonniNorth Korea-aligned group that favored quicker, more opportunistic attacks.LazarusNorth Korea-aligned group that continued long-term relationship building with high-value targets and was linked to Operation DreamJob and Operation DangerousPassword.MoKhargoshUnattributed activity cluster that demonstrated espionage capabilities and destructive potential, including deployment of a bootkit-style wiper.MOØN BadrUnattributed activity cluster that appears to have been limited to targeted espionage.NegativeGlimmerCompromised governmental entities in Cambodia and Panama, and an AI and robotics company in South Korea.Rusty BootsUnattributed activity cluster that demonstrated espionage capabilities and destructive potential, including deployment of a bootkit-style wiper.SandwormDeployed new wipers against targets in Ukraine; ESET attributed a December 2025 data destruction incident affecting a Polish energy company to the group with medium confidence.ScarCruftCompromised a gaming platform serving the Yanbian region in China, likely to collect intelligence on individuals of interest to North Korea.SednitDeployed Covenant and BeardShell implants against Ukrainian military personnel and other targets, and targeted logistics and transportation companies outside Ukraine.SteppeDriverTargeted a Syrian governmental network.UNC5221The report assesses that the PhiliKit implant is part of this group's SPAWN toolset targeting Ivanti VPN appliances.
Malware
Asininclude a browser-in-the-browser phishing attack against a Japanese think tank, Android spyware we named Asin that targets Arabic-speaking users via apps claiming to offer conflict-tracking features, and theBeardShellSednit deployed its Covenant and BeardShell implants against Ukrainian military personnel, drone manufacturers, and organizations involved in drone research and development, while also targeting logistics andCovenantSednit deployed its Covenant and BeardShell implants against Ukrainian military personnel, drone manufacturers, and organizations involved in drone research and development, while also targeting logistics andPhiliKitOn VirusTotal we found PhiliKit, a new implant that we assess to be part of UNC5221’s SPAWN toolset targeting Ivanti VPN appliances, while our tracking of NegativeGlimmer revealed the group compromising governmentalRookthe reemergence of Andariel in South Korea, where the group deployed TigerRAT and attempted to spread Rook ransomware within an engineering company that appears to manufacture equipment relevant to liquid hydrogenSPAWNOn VirusTotal we found PhiliKit, a new implant that we assess to be part of UNC5221’s SPAWN toolset targeting Ivanti VPN appliances, while our tracking of NegativeGlimmer revealed the group compromising governmentalTigerRATWe also uncovered the reemergence of Andariel in South Korea, where the group deployed TigerRAT and attempted to spread Rook ransomware within an engineering company that appears to manufacture equipment relevant to
Vendors
ESETESET APT Activity Report Q4 2025–Q1 2026 summarizes notable activities of selected advanced persistent threat (APT) groups documented by ESET researchers from October 2025 through March 2026.Ivantiwe found PhiliKit, a new implant that we assess to be part of UNC5221’s SPAWN toolset targeting Ivanti VPN appliances, while our tracking of NegativeGlimmer revealed the group compromising governmental
Products
AxiosEuropean drone manufacturers; the latter led to the compromise of the widely used JavaScript library axios, which has over 100 million weekly downloads on the npm registry and is critical to web and mobileSmartOffice CRMfeatures, and the compromise of a defense company in the United Arab Emirates through a SmartOffice CRM server, followed by the deployment of custom post-exploitation and reverse proxy tools.
Countries
Cambodiawhile our tracking of NegativeGlimmer revealed the group compromising governmental entities in Cambodia and Panama, as well as an AI and robotics company in South Korea.IranThe war in Iran that began in late February 2026 was the defining event for Iran-aligned activity during this period.IsraelAt the same time, this environment appears to have favored the mobilization of proxy and hacktivist actors targeting Israel, the United States, and other states seen as hostile to Tehran.JapanPanamaour tracking of NegativeGlimmer revealed the group compromising governmental entities in Cambodia and Panama, as well as an AI and robotics company in South Korea.PolandGiven Poland’s role in helping stabilize Ukraine’s electricity supply, it is possible that the operation was intended to strain Ukraine’s power grid during the winter.South Koreacompromising governmental entities in Cambodia and Panama, as well as an AI and robotics company in South Korea.Syriatargeting a Syrian governmental network, activity that may reflect both Chinese commercial interest in Syria’s reconstruction projects and security concerns surrounding Uyghur fighters present in that country.UkraineRussia-aligned threat actors continued to focus overwhelmingly on Ukraine and entities connected to the country’s defense efforts.United Arab Emiratesapps claiming to offer conflict-tracking features, and the compromise of a defense company in the United Arab Emirates through a SmartOffice CRM server, followed by the deployment of custom post-exploitation andUnited StatesAt the same time, this environment appears to have favored the mobilization of proxy and hacktivist actors targeting Israel, the United States, and other states seen as hostile to Tehran.VenezuelaFollowing the US military operation in Venezuela and amid continuing instability in the Gulf region, we spotted signs that China-aligned groups were being mobilized to improve Beijing’s visibility into maritime, energy,
Industries
AI and roboticsrevealed the group compromising governmental entities in Cambodia and Panama, as well as an AI and robotics company in South Korea.CryptocurrencyMultiple groups continued targeting developers and the cryptocurrency ecosystem with social engineering schemes that can yield both direct financial gain and opportunities for software supply-chain compromise.DefenseRussia-aligned threat actors continued to focus overwhelmingly on Ukraine and entities connected to the country’s defense efforts.Drone manufacturingEnergysigns that China-aligned groups were being mobilized to improve Beijing’s visibility into maritime, energy, and political developments abroad.EngineeringMultiple groups continued targeting developers and the cryptocurrency ecosystem with social engineering schemes that can yield both direct financial gain and opportunities for software supply-chain compromise.GamingIn parallel, ScarCruft compromised a gaming platform serving the Yanbian region in China, likely to collect intelligence on individuals of interest to the North Korean regime, including refugees and defectors.GovernmentMaritimewe spotted signs that China-aligned groups were being mobilized to improve Beijing’s visibility into maritime, energy, and political developments abroad.SoftwareMultiple groups continued targeting developers and the cryptocurrency ecosystem with social engineering schemes that can yield both direct financial gain and opportunities for software supply-chain compromise.Transportationand organizations involved in drone research and development, while also targeting logistics and transportation companies outside Ukraine.