---
title: ESET APT Activity Report (April to September 2026): Iran-aligned groups return against Israel, Belarus-aligned actors work as Russia's force multipliers, and North Korea turns more toward Ukraine | ctxsec
url: https://ctxsec.com/items/eset-apt-activity-report-apr-sep-2026
description: ""
status: "official (ESET press release, Oct 28)"
published: 2026-10-28
---

> 

[← Industry News](/industry) · [markdown](/items/eset-apt-activity-report-apr-sep-2026.md)

official (ESET press release, Oct 28)

2026-10-28

### ESET APT Activity Report (April to September 2026): Iran-aligned groups return against Israel, Belarus-aligned actors work as Russia's force multipliers, and North Korea turns more toward Ukraine

ESET's six-month report says:

- **Iran:** FilthyFeline (an OilRig subgroup) and MuddyWater resumed operations, mostly against Israeli organizations across sectors, with a smaller number of US companies hit. Hamas-affiliated Arid Viper went after what appears to be the Palestinian Authority's foreign ministry or an affiliated body.
- **Russia and Belarus:** activity kept serving Russia's war aims in Ukraine and Europe, and Belarus-aligned campaigns increasingly mirror Russian intelligence priorities. Gamaredon's usually heavy activity dropped sharply.
- **North Korea:** still mostly technology, crypto and developer targets, but Ukraine is a growing target, and Lazarus resumed recruitment-themed attacks on the drone sector.
- **China:** intelligence collection against governments, a cluster aimed at Taiwan's semiconductor industry, and campaigns that seem to support Chinese law enforcement against fraud rings.
- **AI:** groups used LLMs to speed up malware and decoy-site work, sometimes in a "vibe coding" style. Russia-aligned UAC-0099 put a decoy request about building a nuclear weapon in a script comment, apparently to trip the guardrails of LLM-based code analysis. ESET says AI has not substantially reshaped the APT landscape yet.

Sources: [ESET via GlobeNewswire: ESET Research APT Report, April to September 2026 (Oct 28)](https://www.globenewswire.com/news-release/2026/10/28/3390357/0/en/eset-research-apt-report-iran-aligned-groups-targeting-expands-belarus-aligned-apt-activity-converges-with-russia-s-war-priorities.html)