- Russia-aligned activity continued to support its war objectives, as Belarus-aligned threats actors are becoming operationally closer with Russia’s.
- Middle East-aligned activity increased due to Iran-aligned activity directed at entities in Israel across multiple sectors; a smaller number of US companies were also affected.
- North Korea-aligned threat actors did not deviate significantly from the types of targets seen in previous reporting periods; however, Ukraine is being increasingly targeted.
- APT groups are using AI and large language models at various stages of their operations. However, ESET has not noticed AI substantially reshaping the APT landscape over the past six months.
BRATISLAVA, Montreal, Oct. 28, 2026 (GLOBE NEWSWIRE) -- ESET Research has released its latest APT Activity Report, which highlights activities of select APT groups that were documented by ESET researchers between April and September 2026. During this period, China-aligned groups conducted intelligence-collection operations primarily against governmental targets. Middle East-aligned activity increased compared with the previous reporting period, driven mainly by the return of several established Iran-aligned groups. Russia-aligned activity continued to support its war objectives, targeting governments, the defense sector, and military entities in Europe, with a substantially higher number of targets in Ukraine; Belarus-aligned APT activity increasingly converges with Russia’s war priorities. Alongside South Korea, Ukraine has become increasingly prominent among North Korea-aligned targets.
“Throughout the busy six-month period ESET researchers identified several cases of APT groups using AI and large language models – LLMs - at various stages of their operations. Threat actors used AI primarily to accelerate tasks that would otherwise require painstaking effort, including malware development and the creation of decoy websites,” says Jean-Ian Boutin, Director of Threat Research at ESET.
“In some cases, this resembled vibe coding: rapid, prompt-driven drafting of code, with human operators adapting and integrating the results into their toolchains. In one notable case, Russia-aligned UAC-0099 inserted a decoy request for instructions on building a nuclear weapon into a script comment, apparently attempting to trigger the safety guardrails of LLM-based security analysis and prevent the inspection of the malicious code that followed,” he adds. Despite these developments, ESET has not noticed AI substantially reshaping the APT landscape over the past six months.
In the Middle East, Iran-aligned FilthyFeline, a subgroup of OilRig, and MuddyWater resumed operations after a quieter period. Most activity was directed at entities in Israel across multiple sectors; a smaller number of US companies were also affected. Additionally, FilthyFeline also appears to have taken over activity against a cellular data service provider in Uzbekistan. ESET also discovered activity by Arid Viper, a Hamas-affiliated threat actor, against what appears to be the Palestinian Authority’s Ministry of Foreign Affairs and Expatriates or an affiliated governmental entity.
North Korea-aligned threat actors did not deviate significantly from the types of targets seen in previous reporting periods. These include primarily technology and cryptocurrency companies, software developers, and other opportunistic targets. However, Ukraine is increasingly a target of North Korea-aligned actors. This is likely related to growing ties between Russia and North Korea, and North Korea’s increasing involvement in Russia’s war against Ukraine, not only through indirect military support (munitions, etc.) but also through the deployment of North Korean soldiers. Alongside these broader trends, Lazarus resumed its targeting of the drone sector, typically using recruitment-themed social engineering to gain initial access.
Russia-aligned activity focused again on Ukraine and European countries. Looking more closely at these activities, similarities between Russia-aligned and Belarus-aligned campaigns stand out, further supporting our hypothesis that threat actors aligned with the two countries are becoming operationally closer. Belarus-aligned groups are acting as cyberproxies or force multipliers for Russia. We observed increased and more assertive activity from Belarus-aligned threat actors, with their operations increasingly reflecting Russia’s intelligence priorities in Ukraine in some areas. Gamaredon’s operations, which are typically numerous, saw a significant decline. This could be related to Ukrainian attacks on Crimea, where the group is suspected to operate, a broader restructuring of its operations, or other factors that ESET continues to assess.
With regards to China-aligned threat groups, one broader cluster of activity targeted Taiwanese organizations operating in the semiconductor industry. This focus on Taiwan’s semiconductor sector is consistent with long-running Chinese industrial espionage priorities, and the strategic importance of semiconductor supply chains to both economic competition and national security. Additionally, China-aligned threat actors ran campaigns that appear to support Chinese law enforcement efforts against organized crime and against individuals connected to fraud schemes, likely in the context of broader regional law enforcement efforts against financial crime.
ESET products protect our customers’ systems from the malicious activities described in this report. Intelligence shared here is based mostly on proprietary ESET telemetry data and has been verified by ESET researchers, who prepare in-depth technical reports and frequent activity updates detailing activities of specific APT groups. These threat intelligence analyses assist organizations tasked with protecting citizens, critical national infrastructure, and high-value assets from criminal and nation-state-directed cyberattacks.
More information about ESET Threat Intelligence, which deliver high-quality, strategic, actionable, and tactical cybersecurity threat intelligence, is available on the ESET Threat Intelligence page.
For more details about the mentioned and other APT groups’ activities, read the full APT Activity Report, “From espionage to destruction: Belarus-aligned APT activity converges with Russia’s war priorities,” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.
Targeted sectors statistics.
About ESET®
ESET protects organizations, critical infrastructure, and individuals, helping them build digital resilience and confidence in an increasingly AI-driven world. With more than 35 years of cybersecurity expertise, over 25 years of AI innovation, and 11 global R&D centers, ESET develops proprietary technologies designed to protect against evolving cyber threats and secure the broader AI ecosystem. Grounded in scientific rigor and taking a preemptive approach to security, ESET delivers effortless protection that remains under expert human oversight. Headquartered in the European Union and privately owned, ESET protects millions of users and more than 500,000 organizations across 178 countries. Committed to responsible AI and customer trust, ESET protects the progress that technology enables. For more information, visit www.eset.com, or follow ESET’s social media, podcasts, and blogs.
A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/eb222a15-d7e3-4e99-a087-725cc8095087
Media contact: Jessica Beffa jessica.beffa@eset.com 720-413-4938
