ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
72
- Mentions · 7d1
- Mentions · 30d1
- All mentions4
- First seenAug 17, 2026
- Last mentioned2d ago
Timeline
4 articles · newest firstIranian APTs increased activity against US industries in late spring, researchers say
Nozomi Networks recorded 28 Iran-linked attacks on US customers in May-June, up 133%, mostly hitting transportation and manufacturing.
66
Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Kaspersky details Iranian Cavern Manticore's expanded C2 framework using DNS and Google Apps Script, plus APT42's TAMECAT spyware in nuclear-sector phishing.
58
New Python-Based Payload MechaFlounder Used by Chafer
Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.
44
Appears with
- MuddyWaterthreat actor · 3
- APT42threat actor · 1
- BladedFelinethreat actor · 1
- PteroPSDoormalware · 1
- Group-IBvendor · 1
- ESETorganization · 1
- FamousSparrowthreat actor · 1
- Rezzuarmalware · 1
- PrincessSpymalware · 1
- Cavernmalware · 1
- SlippyNunchucksthreat actor · 1
- Nozomi Networksvendor · 1
- ScarCruftthreat actor · 1
- APT33threat actor · 1
- FoxKittenthreat actor · 1
- Arid Viperthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.