ESET’s latest APT Activities Report reviews selected advanced persistent threat (APT) operations documented by its researchers between April and September 2026. The report describes continued intelligence-gathering campaigns, renewed activity by several Iran-aligned groups, and Russian- and Belarus-aligned operations that increasingly reflect shared priorities. It also highlights how threat actors are using artificial intelligence (AI) to speed up parts of their work, while noting that AI has not fundamentally reshaped the APT landscape.
How APT groups are using AI
ESET researchers observed APT actors using AI and large language models (LLMs) during several stages of their operations. Their main purpose was to accelerate labor-intensive tasks, including malware development and the creation of fake websites. In some cases, attackers used prompt-based coding to produce an initial draft, then adapted the output and incorporated it into their own toolsets.
One notable case involved the Russia-aligned group UAC-0099. The group inserted a fake prompt about building a nuclear weapon into a script’s comments. The apparent goal was to trigger safeguards in LLM-powered security analysis tools and obstruct examination of the malicious code that followed. Despite such examples, ESET says AI had not fundamentally changed APT operations during the reporting period.
Iran-aligned activity returns in the Middle East
Iran-aligned groups FilthyFeline, a subgroup of OilRig, and MuddyWater resumed operations after a quieter period. Their campaigns primarily targeted organizations across multiple sectors in Israel, with a smaller number of US companies also affected. FilthyFeline also appears to have taken over activity against a cellular data services provider in Uzbekistan.
ESET also identified activity by Arid Viper, a Hamas-linked threat actor, against a target believed to be the Palestinian Authority’s Ministry of Foreign Affairs and Expatriates or one of its government-affiliated organizations.
North Korea-aligned groups add Ukraine to their targets
North Korea-aligned actors continued to target technology and cryptocurrency companies, software developers, and other opportunistically selected victims. Ukraine has become a more frequent target, a trend that may reflect closer ties between North Korea and Russia. North Korea’s involvement in Russia’s war against Ukraine has expanded from indirect military support, such as ammunition, to the deployment of troops.
Lazarus also resumed targeting the drone sector. The group commonly seeks initial access through recruitment-themed social engineering, using job-related approaches to engage potential victims.
Russian and Belarusian cyber operations show growing alignment
Russian-aligned campaigns continued to focus on Ukraine and European countries, with activity supporting wartime objectives. ESET also recorded a notable increase in the number of targets in Ukraine. Researchers identified similarities between Russian- and Belarusian-aligned campaigns, supporting the assessment that actors serving the interests of both countries are becoming more closely aligned operationally.
Belarus-aligned groups appear to act as cyber proxies or force multipliers for Russia. ESET observed that these actors have become more active and assertive, and that some of their operations increasingly reflect Russian intelligence priorities in Ukraine.
By contrast, activity from Gamaredon, a group that typically conducts numerous operations, declined noticeably. Possible explanations include Ukrainian attacks on Crimea, where the group is suspected of operating, or a broader restructuring of its operations. ESET continues to assess the causes of the decline.
China-aligned groups target Taiwan’s semiconductor sector
A broad cluster of activity attributed to China-aligned groups targeted organizations in Taiwan’s semiconductor industry. The focus aligns with China’s longstanding industrial espionage priorities and the strategic value of semiconductor supply chains to both economic competition and national security.
China-aligned actors also ran campaigns that appeared to support Chinese law enforcement efforts against organized crime and fraud networks. These operations may form part of broader regional initiatives to combat financial crime.
Key APT trends from April to September 2026
- AI accelerated selected tasks: APT groups used AI and LLMs to assist with malware development, fake websites, and other labor-intensive work, but ESET did not observe a fundamental change in the threat landscape.
- Iran-aligned activity increased: FilthyFeline and MuddyWater resumed operations, particularly against Israeli organizations.
- Ukraine faced a wider range of threats: Russian-aligned activity continued, Belarus-aligned operations increasingly echoed Russian priorities, and North Korea-aligned actors targeted Ukrainian organizations more often.
- Strategic industries remained in focus: China-aligned groups targeted Taiwan’s semiconductor sector, while Lazarus returned to the drone industry.
Be the first to comment