ESET APT Activity Report Q2–Q3 2026: Belarus-aligned destructive attack in Ukraine, Iranian groups return, APTs adopt LLMs
ESET published its APT Activity Report covering April–September 2026, summarizing operations by China-, Iran-, North Korea-, Russia- and Belarus-aligned groups. The most significant development is the first documented destructive cyberattack by a Belarus-aligned actor in the European theater: FrostyNeighbor struck a Ukrainian manufacturing company important to the country's transportation sector. Iran-aligned activity rebounded with FilthyFeline (an OilRig subgroup) and MuddyWater resuming operations mainly against Israeli entities, while Arid Viper targeted what appears to be the Palestinian Authority's Ministry of Foreign Affairs. China-aligned groups focused on government targets, Taiwanese semiconductor organizations, and — unusually — operations seemingly supporting Chinese law enforcement against scam compounds in Southeast Asia and Oceania. ESET also observed APTs integrating AI/LLMs into malware development and decoy creation, but found no evidence that AI has substantially reshaped the APT landscape.
Detalhes técnicos
- FrostyNeighbor (Belarus-aligned) conducted a destructive attack on a Ukrainian transportation-sector manufacturer; ESET assesses Belarus-aligned groups are acting as cyberproxies for Russian intelligence priorities.
- Gamaredon activity declined sharply but the group updated its PteroBox file stealer and adopted new tools PteroPSDoor and Turla's VBScript Rezzuar.
- PhantomCaptcha attempted to deploy Android spyware named PrincessSpy, impersonating Ukrainian entities.
- An extensive campaign in Ukraine exploited MDaemon mail servers, deploying the HELLAGE and HELLTAG backdoors.
- SlippyNunchucks deployed the DarkVigil toolset in Sri Lanka against Chinese-speaking individuals tied to fraud schemes; FamousSparrow continued South American operations; hotels in Palau were targeted.
- FilthyFeline took over access to an Uzbek cellular data provider previously compromised by BladedFeline.
- Lazarus resumed targeting of the drone sector via recruitment-themed social engineering; ScarCruft targeted an African country; DeceptiveDevelopment shifted from fake job-interview lures to software supply-chain compromise, harvesting developer credentials to inject malicious code into public and private repositories.
- UAC-0099 embedded a decoy request for nuclear weapon instructions in a script comment, apparently to trigger LLM safety guardrails and block automated analysis of the malicious code.
Linha do tempo
-
ESET APT Activity Report Q2–Q3 2026: Belarus-aligned destructive attack in Ukraine, Iranian groups return, APTs adopt LLMs
ler a análise desta fonte ocultar
ESET published its APT Activity Report covering April–September 2026, summarizing operations by China-, Iran-, North Korea-, Russia- and Belarus-aligned groups. The most significant development is the first documented destructive cyberattack by a Belarus-aligned actor in the European theater: FrostyNeighbor struck a Ukrainian manufacturing company important to the country's transportation sector. Iran-aligned activity rebounded with FilthyFeline (an OilRig subgroup) and MuddyWater resuming operations mainly against Israeli entities, while Arid Viper targeted what appears to be the Palestinian Authority's Ministry of Foreign Affairs. China-aligned groups focused on government targets, Taiwanese semiconductor organizations, and — unusually — operations seemingly supporting Chinese law enforcement against scam compounds in Southeast Asia and Oceania. ESET also observed APTs integrating AI/LLMs into malware development and decoy creation, but found no evidence that AI has substantially reshaped the APT landscape.
Technical Details
- FrostyNeighbor (Belarus-aligned) conducted a destructive attack on a Ukrainian transportation-sector manufacturer; ESET assesses Belarus-aligned groups are acting as cyberproxies for Russian intelligence priorities.
- Gamaredon activity declined sharply but the group updated its PteroBox file stealer and adopted new tools PteroPSDoor and Turla's VBScript Rezzuar.
- PhantomCaptcha attempted to deploy Android spyware named PrincessSpy, impersonating Ukrainian entities.
- An extensive campaign in Ukraine exploited MDaemon mail servers, deploying the HELLAGE and HELLTAG backdoors.
- SlippyNunchucks deployed the DarkVigil toolset in Sri Lanka against Chinese-speaking individuals tied to fraud schemes; FamousSparrow continued South American operations; hotels in Palau were targeted.
- FilthyFeline took over access to an Uzbek cellular data provider previously compromised by BladedFeline.
- Lazarus resumed targeting of the drone sector via recruitment-themed social engineering; ScarCruft targeted an African country; DeceptiveDevelopment shifted from fake job-interview lures to software supply-chain compromise, harvesting developer credentials to inject malicious code into public and private repositories.
- UAC-0099 embedded a decoy request for nuclear weapon instructions in a script comment, apparently to trigger LLM safety guardrails and block automated analysis of the malicious code.