ESET maps APT activity from April through September 2026
Original title: ESET APT Activity Report Q2 2026–Q3 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
ESET Research summarizes selected APT operations documented between April and September 2026. China-aligned groups focused on governments, hotels in Palau, Chinese-speaking fraud suspects in Sri Lanka, and Taiwan’s semiconductor sector. Iran-aligned groups including FilthyFeline and MuddyWater resumed activity mainly against Israel, while North Korea-aligned actors continued targeting technology, cryptocurrency and, increasingly, Ukraine. Russia-aligned campaigns concentrated on European governments, defense and military targets, especially in Ukraine.
Unconfirmed: Motives for Gamaredon decline and several targeting judgments are ESET assessments; the MDaemon campaign description is cut off.
- SlippyNunchucks used DarkVigil in Sri Lanka against Chinese-speaking people tied to fraud.
- FilthyFeline and MuddyWater mainly targeted Israeli entities, plus some US companies.
- Arid Viper targeted what appears to be a Palestinian Authority foreign-affairs body.
- Lazarus used recruitment-themed social engineering against the drone sector.
- DeceptiveDevelopment shifted to software supply-chain compromises to steal developer credentials.
Impact: Espionage, credential theft, spyware deployment and supply-chain code injection
| Product | Affected |
|---|---|
| MDaemon | — |
From the original article
6 min read at welivesecurity.com
An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2026 and Q3 2026
welivesecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.