ESET Report Details Q2-Q3 2026 APT Activities, Highlighting China, Iran, and North Korea-Aligned Threats
ESET's latest APT activity report for the second and third quarters of 2026 reveals a landscape dominated by China-aligned groups targeting governmental and semiconductor entities, Iran-aligned actors resuming operations, and North Korea focusing on technology and cryptocurrency sectors.
ESET's comprehensive "APT Activity Report Q2 2026–Q3 2026" provides a detailed look into the operations of various advanced persistent threat (APT) groups observed between April and September 2026. The report highlights key trends and developments in the cybersecurity threat landscape, offering insights into the evolving tactics, techniques, and procedures (TTPs) of sophisticated adversaries.
China-aligned threat actors were particularly active during this period, focusing primarily on intelligence-gathering operations against governmental targets. The group FamousSparrow continued its surveillance activities in South America, while other China-aligned actors in Southeast Asia and Oceania launched campaigns seemingly in support of Chinese law enforcement efforts against organized crime. Notably, these groups targeted hotels in Palau, an area increasingly used for fraud-related organized crime, and deployed the DarkVigil toolset in Sri Lanka against individuals involved in fraud schemes. The report also points to a sustained focus on Taiwanese organizations within the semiconductor industry, aligning with long-standing Chinese industrial espionage priorities and the strategic importance of semiconductor supply chains.
Activity from Iran-aligned groups saw a significant increase compared to the previous reporting period, driven by the resurgence of established actors such as FilthyFeline and MuddyWater. These groups primarily targeted entities in Israel, with a smaller number of U.S. companies also affected. FilthyFeline also appears to have taken over operations against a cellular data service provider in Uzbekistan previously compromised by another OilRig subgroup, BladedFeline. The report notes renewed malware development within the Iran-aligned ecosystem. Additionally, Arid Viper, a Hamas-affiliated actor, was observed targeting what appears to be the Palestinian Authority’s Ministry of Foreign Affairs and Expatriates, likely to gather intelligence on diplomatic positions amidst the ongoing U.S.-led peace process.
North Korea-aligned threat actors maintained their focus on technology and cryptocurrency companies, software developers, and other opportunistic targets. Ukraine has emerged as a significant target alongside South Korea, likely due to growing ties between Russia and North Korea and North Korea's increasing involvement in the war in Ukraine. Lazarus Group resumed targeting the drone sector, employing recruitment-themed social engineering to gain initial access, with the likely motivation of acquiring knowledge for its own drone-production capabilities. ScarCruft was detected targeting an African country, potentially for monitoring North Korean worker schemes or Russian activities. DeceptiveDevelopment shifted its focus from fake job lures to supply-chain compromises, harvesting developer credentials to inject malicious code into repositories.
Russia-aligned activity continued to support its war objectives, with a substantial increase in targets within Ukraine, including governmental, defense, and military entities. The report notes increasing operational convergence between Russia-aligned and Belarus-aligned campaigns. Gamaredon's operations saw a decline, possibly due to Ukrainian attacks on Crimea or internal restructuring, though the group updated its PteroBox malware and introduced new tools. PhantomCaptcha attempted to deploy Android spyware, PrincessSpy, by impersonating Ukrainian entities.
The report also touches upon other emerging trends and specific incidents, underscoring the dynamic nature of the APT landscape. The detailed analysis provided by ESET offers valuable intelligence for organizations to bolster their defenses against these persistent and evolving threats.