Threat reportAPTTL-2026-4705
ESET APT Activity Report Q2 2026–Q3 2026: China-, Iran-, North Korea-, Russia- and Belarus-aligned APT campaigns
ESET APT Activity Report Q2 2026–Q3 2026 (TL-2026-4705), also tracked as ESET APT Activity Report Q2 2026–Q3 2026, is a high-severity advanced persistent threat campaign, first published 2026-10-29. It is linked to a China, Iran, North Korea, Russia-nexus actor with medium confidence, affects MDaemon Technologies MDaemon mail server, maps to 22 MITRE ATT&CK techniques (T1005, T1036.005, T1053.005), and is covered by 9 detection rules and 32 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 32Indicators of compromise
Key facts for TL-2026-4705
- Threat ID
- TL-2026-4705
- Also known as
- ESET APT Activity Report Q2 2026–Q3 2026
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China, Iran, North Korea, Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, diplomatic, semi-conductors, technology, cryptocurrency, software development, defense, military, drone manufacturing, hospitality, telecoms, manufacturing
- Target regions
- ukraine, Europe, poland, lithuania, israel, united states of america, taiwan, 005 - South America, Southeast Asia, Oceania, sri lanka, palau
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in ESET APT Activity Report Q2 2026–Q3 2026
Malware and tooling: DarkVigil, HELLAGE, HELLTAG, NJRat, PicassoLoader, PrincessSpy, PteroBox, PteroPSDoor, Rezzuar, Cobalt Strike
How ESET APT Activity Report Q2 2026–Q3 2026 works
ESET's APT Activity Report for April–September 2026 summarizes campaigns by China-, Iran-, North Korea-, Russia- and Belarus-aligned groups, including DarkVigil, PteroBox, PteroPSDoor, Rezzuar, PrincessSpy, HELLAGE and HELLTAG malware. It also reports a first destructive attack by a Belarus-aligned actor in Europe and APT use of AI/LLMs for malware development, decoy sites and lures.
ESET Research (author Jean-Ian Boutin) published its APT Activity Report for Q2 2026–Q3 2026 on 2026-10-28, covering April to September 2026.
China-aligned activity: FamousSparrow continued monitoring operations in South America. SlippyNunchucks deployed the DarkVigil toolset in Sri Lanka and targeted Chinese-speaking individuals connected to fraud schemes. ESET ties part of the China-aligned activity to support for Chinese law enforcement efforts against organized crime in Southeast Asia and Oceania, including hotel targeting in Palau. An unnamed China-aligned cluster targeted Taiwanese semiconductor industry organizations, and intelligence collection against governmental targets continued.
Iran-aligned activity: FilthyFeline (an OilRig subgroup) resumed operations against Israeli entities across multiple sectors and some US companies, and took over the compromise of an Uzbekistan cellular data service provider previously associated with BladedFeline. ESET notes that internet restrictions imposed by the Iranian regime hindered the operators' own activity. MuddyWater resumed operations against Israeli and US entities after a decline in the previous period. Hamas-affiliated Arid Viper targeted the Palestinian Authority's Ministry of Foreign Affairs and Expatriates or an affiliated entity, likely to collect intelligence on diplomatic positions regarding negotiations. ESET also analyzed new or updated Iran-aligned malware.
North Korea-aligned activity: Lazarus resumed targeting of the drone sector with recruitment-themed social engineering, likely to gain knowledge and manufacturing processes for North Korean drone development. ScarCruft targeted an African country, likely to oversee North Korean worker schemes or monitor Russian activities. DeceptiveDevelopment moved from fake job-interview lures to software supply-chain compromises: it harvested developer credentials and injected malicious code into public and private source code repositories. Technology and cryptocurrency companies and software developers were targeted, with South Korea and Ukraine increasingly prominent.
Russia-aligned activity: Gamaredon activity declined significantly (suspected causes: Ukrainian attacks on Crimea, restructuring or other factors) and the group used updated tools including the PteroBox file stealer, PteroPSDoor and Turla's VBScript Rezzuar. PhantomCaptcha attempted to deploy the PrincessSpy spyware on Android devices while impersonating Ukrainian entities. An extensive campaign in Ukraine exploited MDaemon mail servers to deploy the HELLAGE and HELLTAG backdoors. Russia-aligned operations supported war objectives against governments, defense and military entities in Europe, with substantially more Ukrainian targets.
Belarus-aligned activity: FrostyNeighbor (Ghostwriter / UNC1151 / UAC-0057) carried out the first documented destructive attack by a Belarus-aligned actor in the European theater, against a manufacturing company in Ukraine's transportation sector, a significant escalation from espionage. Third-party 2026 reporting (The Hacker News, Security Affairs, CraftedSignal) describes the same actor's spearphishing since March 2026: PDFs impersonating Ukrtelecom, geofenced so non-Ukrainian IPs receive a benign decoy, delivering a RAR with a JavaScript PicassoLoader that profiles the host, awaits manual operator validation and then fetches a Cobalt Strike beacon, with persistence via scheduled task / Run key and rundll32.exe masquerading as ViberPC.exe, and C2 hidden behind Cloudflare on .icu/.buzz domains. ESET assesses Belarus-aligned actors as cyberproxies or force multipliers for Russia.
AI/LLM use: threat actors used AI to accelerate malware development, decoy website creation and 'vibe coding', and phishing lures contained AI-generated images. UAC-0099 inserted a decoy request for instructions on building a nuclear weapon into a script comment, apparently to trigger safety guardrails. ESET assesses that AI has not substantially reshaped the APT landscape; hands-on-keyboard operations continue.
The public ESET article contains no CVEs and no network or file IOCs; full IOC data is in ESET's complete PDF report, subscription service and the eset/malware-ioc GitHub repository. Network and file IOCs recorded below come from third-party FrostyNeighbor reporting and are labelled as such. A BeaconBeagle config search for the first listed C2 domain returned no matches. Technique mappings are limited to behaviors stated in the report, the third-party FrostyNeighbor reporting, or cited ESET prior research on the same tools.
MITRE ATT&CK techniques used in TL-2026-4705
Collection
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1480 Execution Guardrails
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059.001 PowerShell; T1059.005 Visual Basic; T1059.007 JavaScript; T1204 User Execution; T1204.002 Malicious File
Command and Control
Initial Access
T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.003 Spearphishing via Service
Impact
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Resource Development
T1588.007 Artificial Intelligence
Reconnaissance
Affected products and versions in ESET APT Activity Report Q2 2026–Q3 2026
- MDaemon Technologies — MDaemon mail server
Vulnerable versions: Instances exploited in Ukraine campaign (versions not stated in public article) - Google — Android
Vulnerable versions: Devices targeted by PrincessSpy - Various — Source code repositories (public and private)
Vulnerable versions: Repositories of developers targeted by DeceptiveDevelopment - Microsoft — Windows
Vulnerable versions: Hosts targeted by FrostyNeighbor PicassoLoader / Cobalt Strike chain
Remediation for ESET APT Activity Report Q2 2026–Q3 2026
Patches
- Keep MDaemon mail server fully patched
- Keep Android devices and apps updated and avoid sideloading apps from unofficial sources
Immediate actions
- Hunt for the named malware families (DarkVigil, PteroBox, PteroPSDoor, Rezzuar, PrincessSpy, HELLAGE, HELLTAG, PicassoLoader) using ESET's published IOC set (github.com/eset/malware-ioc)
- Audit internet-facing MDaemon mail servers for compromise and apply vendor updates
- Review developer credentials and source repositories (public and private) for unauthorized commits
- Alert on PowerShell/VBScript activity that uploads files to cloud storage services
- Block the FrostyNeighbor C2 domains listed in the IOCs and hunt for rundll32.exe running as ViberPC.exe
Workarounds
- Restrict outbound access to unneeded cloud storage services from servers and sensitive workstations
- Disable or restrict script hosts (wscript/cscript) where not required
- Block execution of .js files delivered inside archives from email
Longer-term hardening
- Train staff in drone, defense, technology and cryptocurrency sectors to recognize recruitment-themed social engineering
- Enforce MFA and short-lived tokens for source code hosting and CI/CD
- Maintain offline backups to withstand destructive attacks on manufacturing and transport networks
- Deploy EDR with behavioral detection for script-based backdoors
Timeline of ESET APT Activity Report Q2 2026–Q3 2026
- PteroBox, a PowerShell file stealer resembling PteroPSDoor that exfiltrates to Dropbox, was first discovered (November 2024; day approximate), per ESET's earlier Gamaredon research
- FrostyNeighbor (Ghostwriter) spearphishing against Ukrainian and Polish/Lithuanian organizations begins (March 2026; day approximate); lure filenames carry a 7.03.2026 date
- Start of the ESET APT Activity Report reporting period (Q2 2026)
- The Hacker News, Security Affairs and CraftedSignal publish reporting on the FrostyNeighbor/Ghostwriter Ukrtelecom-themed PDF campaign delivering PicassoLoader and Cobalt Strike
- CraftedSignal updates its FrostyNeighbor Ukraine brief, last revision noted on this date
- End of the reporting period (Q3 2026); during it Belarus-aligned FrostyNeighbor conducted a destructive attack on a Ukrainian transportation-sector manufacturer, and Lazarus resumed drone-sector targeting
- ESET Research published the APT Activity Report Q2 2026–Q3 2026 on WeLiveSecurity
Sources cited for ESET APT Activity Report Q2 2026–Q3 2026
- ESET APT Activity Report Q2 2026–Q3 2026
- Gamaredon in 2025: Leveraging tunnels, workers, dead drops and new alliances (ESET Research)
- Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset (ESET Research)
- PteroBox malware – analysis, campaigns and threat activity (ThreatCluster)
- Operation RoundPress: Sednit webmail XSS campaign incl. MDaemon (ESET)
- Ghostwriter targets Ukrainian government (The Hacker News)
- Ghostwriter group resumes attacks on Ukrainian Government targets (Security Affairs)
- FrostyNeighbor Ukraine brief (CraftedSignal)
- ESET malware-ioc repository: FrostyNeighbor indicators
Detection coverage for TL-2026-4705
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4705 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.