Image: web-assets.esetstatic.com · rights & removal

ESET APT Activity Report Q2 2026

Reporting by ESET WeLiveSecurityRead the original at welivesecurity.com

Executive Summary

China-aligned groups conducted intelligence collection operations targeting governmental entities in South America, Southeast Asia, and Oceania, including monitoring hotels in Palau used for fraud and deploying tools against Chinese-speaking individuals connected to fraud schemes in Sri Lanka. Activity also targeted Taiwanese organizations within the semiconductor industry. Middle East-aligned activity increased due to the return of established Iran-aligned groups like FilthyFeline and MuddyWater targeting entities in Israel and some US companies, and an action by Arid Viper against the Palestinian Authority's Ministry of Foreign Affairs or an affiliated entity. North Korea-aligned actors targeted technology, cryptocurrency, software developers, and other opportunistic targets, with increased focus on Ukraine, drone sectors, and African countries. Russia-aligned activity continued targeting governments, defense sectors, and military entities in Europe, showing similarities with Belarus-aligned campaigns. Some groups, like Gamaredon, showed a decline in activity but updated tools. Threat actors utilized AI and LLMs to accelerate tasks like malware development and decoy website creation, though hands-on keyboard activity was still observed.

Facts Only

* China-aligned groups conducted intelligence collection against governmental targets in South America.
* Threat actors operated in Southeast Asia and Oceania supporting Chinese law enforcement against organized crime.
* One threat actor targeted hotels in Palau used for fraud-related organized crime.
* SlippyNunchucks deployed DarkVigil toolset in Sri Lanka against Chinese-speaking individuals connected to fraud schemes.
* Activity targeted Taiwanese organizations in the semiconductor industry.
* Middle East-aligned activity increased due to the return of Iran-aligned groups FilthyFeline and MuddyWater, targeting entities in Israel and some US companies.
* Arid Viper targeted what appears to be the Palestinian Authority’s Ministry of Foreign Affairs or an affiliated governmental entity.
* North Korea-aligned actors targeted technology, cryptocurrency, software developers, and other opportunistic targets.
* Lazarus resumed targeting the drone sector using recruitment-themed social engineering.
* ScarCruft targeted an African country.
* DeceptiveDevelopment compromised software supply chains by harvesting credentials for code injection.
* Gamaredon updated PteroBox file stealer and used tools like PteroPSDoor and Turla’s VBScript Rezzuar.
* PhantomCaptcha attempted to deploy PrincessSpy spyware on Android devices impersonating Ukrainian entities.
* Attackers deployed HELLAGE and HELLTAG backdoor malware families on MDaemon mail servers in Ukraine.
* FrostyNeighbor attacked a manufacturing company in Ukraine in the transportation sector.
* Russia-aligned actors targeted governments, defense sectors, and military entities in Europe with higher numbers in Ukraine.
* Threat actors used AI and LLMs to accelerate tasks like malware development and decoy website creation.

Full Take

The data reveals a complex, geopolitically layered operational landscape where distinct threat actor groups are aligning their focus based on regional power dynamics and strategic interests. The diversification of targets—from specific industrial supply chains (semiconductors) to localized law enforcement support against transnational crime (fraud schemes) to high-level governmental intelligence gathering (Middle East/PA)—suggests that APT activity is less about purely ideological objectives and more about extracting actionable geopolitical leverage from diverse actors simultaneously. The observed convergence between Russia-aligned and Belarus-aligned groups, particularly in the context of Ukraine's conflict, indicates that state-sponsored cyber operations are rapidly integrating to serve unified military and intelligence goals, moving beyond simple proxy roles toward shared offensive capabilities, evidenced by the destructive attack attributed to a Belarus-aligned actor in Europe. Furthermore, the shift from traditional espionage models to integrating generative AI into operational tactics—using LLMs for code generation and decoy creation—points to an evolution where technical efficiency is being leveraged as a primary feature of advanced operations rather than merely an ancillary benefit. This suggests that the current trend is driven by the pragmatic necessity to maximize intelligence advantage within shifting conflict zones, positioning technical automation not as an end goal, but as an accelerator for existing geopolitical objectives. What does this synchronization imply about the future of cyber conflict when state actors pursue overlapping strategic goals?

From the original · ESET WeLiveSecurity

Q2 2026 summarizes notable activities of selected advanced persistent threat (APT) groups documented by ESET researchers between April and September 2026. The operations presented here reflect the broader threat landscape observed during this period and highlight some of its key trends and developments.

Read the full story at welivesecurity.com

Sentinel unavailable

The automated check of the source article's wording did not complete, so no result is shown.

This looks only at the wording of the original source article, not at this page's AI-written sections. A small local AI model made this estimate. It has not been checked against known human and machine texts, so treat it as provisional. It cannot show who wrote an article.