ESET APT Activity Report (April to September 2026): Iran-aligned groups return against Israel, Belarus-aligned actors work as Russia's force multipliers, and North Korea turns more toward Ukraine
ESET's six-month report says:
- Iran: FilthyFeline (an OilRig subgroup) and MuddyWater resumed operations, mostly against Israeli organizations across sectors, with a smaller number of US companies hit. Hamas-affiliated Arid Viper went after what appears to be the Palestinian Authority's foreign ministry or an affiliated body.
- Russia and Belarus: activity kept serving Russia's war aims in Ukraine and Europe, and Belarus-aligned campaigns increasingly mirror Russian intelligence priorities. Gamaredon's usually heavy activity dropped sharply.
- North Korea: still mostly technology, crypto and developer targets, but Ukraine is a growing target, and Lazarus resumed recruitment-themed attacks on the drone sector.
- China: intelligence collection against governments, a cluster aimed at Taiwan's semiconductor industry, and campaigns that seem to support Chinese law enforcement against fraud rings.
- AI: groups used LLMs to speed up malware and decoy-site work, sometimes in a "vibe coding" style. Russia-aligned UAC-0099 put a decoy request about building a nuclear weapon in a script comment, apparently to trip the guardrails of LLM-based code analysis. ESET says AI has not substantially reshaped the APT landscape yet.
Sources: ESET via GlobeNewswire: ESET Research APT Report, April to September 2026 (Oct 28)