# ESET APT Activity Report Q2 2026–Q3 2026: China-, Iran-, North Korea-, Russia- and Belarus-aligned APT campaigns

> ESET's APT Activity Report for April–September 2026 summarizes campaigns by China-, Iran-, North Korea-, Russia- and Belarus-aligned groups, including DarkVigil, PteroBox, PteroPSDoor, Rezzuar, PrincessSpy, HELLAGE and HELLTAG malware. It also reports a first destructive attack by a Belarus-aligned actor in Europe and APT use of AI/LLMs for malware development, decoy sites and lures.

- **Published:** 2026-10-29T05:29:18Z
- **Last reviewed:** 2026-10-29T05:29:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4705
- **ID:** TL-2026-4705
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ESET Research (author Jean-Ian Boutin) published its APT Activity Report for Q2 2026–Q3 2026 on 2026-10-28, covering April to September 2026.

China-aligned activity: FamousSparrow continued monitoring operations in South America. SlippyNunchucks deployed the DarkVigil toolset in Sri Lanka and targeted Chinese-speaking individuals connected to fraud schemes. ESET ties part of the China-aligned activity to support for Chinese law enforcement efforts against organized crime in Southeast Asia and Oceania, including hotel targeting in Palau. An unnamed China-aligned cluster targeted Taiwanese semiconductor industry organizations, and intelligence collection against governmental targets continued.

Iran-aligned activity: FilthyFeline (an OilRig subgroup) resumed operations against Israeli entities across multiple sectors and some US companies, and took over the compromise of an Uzbekistan cellular data service provider previously associated with BladedFeline. ESET notes that internet restrictions imposed by the Iranian regime hindered the operators' own activity. MuddyWater resumed operations against Israeli and US entities after a decline in the previous period. Hamas-affiliated Arid Viper targeted the Palestinian Authority's Ministry of Foreign Affairs and Expatriates or an affiliated entity, likely to collect intelligence on diplomatic positions regarding negotiations. ESET also analyzed new or updated Iran-aligned malware.

North Korea-aligned activity: Lazarus resumed targeting of the drone sector with recruitment-themed social engineering, likely to gain knowledge and manufacturing processes for North Korean drone development. ScarCruft targeted an African country, likely to oversee North Korean worker schemes or monitor Russian activities. DeceptiveDevelopment moved from fake job-interview lures to software supply-chain compromises: it harvested developer credentials and injected malicious code into public and private source code repositories. Technology and cryptocurrency companies and software developers were targeted, with South Korea and Ukraine increasingly prominent.

Russia-aligned activity: Gamaredon activity declined significantly (suspected causes: Ukrainian attacks on Crimea, restructuring or other factors) and the group used updated tools including the PteroBox file stealer, PteroPSDoor and Turla's VBScript Rezzuar. PhantomCaptcha attempted to deploy the PrincessSpy spyware on Android devices while impersonating Ukrainian entities. An extensive campaign in Ukraine exploited MDaemon mail servers to deploy the HELLAGE and HELLTAG backdoors. Russia-aligned operations supported war objectives against governments, defense and military entities in Europe, with substantially more Ukrainian targets.

Belarus-aligned activity: FrostyNeighbor (Ghostwriter / UNC1151 / UAC-0057) carried out the first documented destructive attack by a Belarus-aligned actor in the European theater, against a manufacturing company in Ukraine's transportation sector, a significant escalation from espionage. Third-party 2026 reporting (The Hacker News, Security Affairs, CraftedSignal) describes the same actor's spearphishing since March 2026: PDFs impersonating Ukrtelecom, geofenced so non-Ukrainian IPs receive a benign decoy, delivering a RAR with a JavaScript PicassoLoader that profiles the host, awaits manual operator validation and then fetches a Cobalt Strike beacon, with persistence via scheduled task / Run key and rundll32.exe masquerading as ViberPC.exe, and C2 hidden behind Cloudflare on .icu/.buzz domains. ESET assesses Belarus-aligned actors as cyberproxies or force multipliers for Russia.

AI/LLM use: threat actors used AI to accelerate malware development, decoy website creation and 'vibe coding', and phishing lures contained AI-generated images. UAC-0099 inserted a decoy request for instructions on building a nuclear weapon into a script comment, apparently to trigger safety guardrails. ESET assesses that AI has not substantially reshaped the APT landscape; hands-on-keyboard operations continue.

The public ESET article contains no CVEs and no network or file IOCs; full IOC data is in ESET's complete PDF report, subscription service and the eset/malware-ioc GitHub repository. Network and file IOCs recorded below come from third-party FrostyNeighbor reporting and are labelled as such. A BeaconBeagle config search for the first listed C2 domain returned no matches. Technique mappings are limited to behaviors stated in the report, the third-party FrostyNeighbor reporting, or cited ESET prior research on the same tools.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.003 Spearphishing via Service
- T1195.002 Compromise Software Supply Chain
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1204 User Execution
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1480 Execution Guardrails
- T1082 System Information Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1567.002 Exfiltration to Cloud Storage
- T1485 Data Destruction
- T1588.007 Artificial Intelligence
- T1589.001 Credentials

## Sources

- [ESET APT Activity Report Q2 2026–Q3 2026](https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/)
- [Gamaredon in 2025: Leveraging tunnels, workers, dead drops and new alliances (ESET Research)](https://www.welivesecurity.com/en/eset-research/gamaredon-2025-leveraging-tunnels-workers-dead-drops-new-alliances/)
- [Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset (ESET Research)](https://www.welivesecurity.com/en/eset-research/gamaredon-2024-cranking-out-spearphishing-campaigns-ukraine-evolved-toolset/)
- [PteroBox malware – analysis, campaigns and threat activity (ThreatCluster)](https://threatcluster.io/entities/malware/PteroBox)
- [Operation RoundPress: Sednit webmail XSS campaign incl. MDaemon (ESET)](https://www.welivesecurity.com/en/videos/sednit-xss-govt-entities-defense-companies/)
- [Ghostwriter targets Ukrainian government (The Hacker News)](https://thehackernews.com/2026/05/ghostwriter-targets-ukrainian.html)
- [Ghostwriter group resumes attacks on Ukrainian Government targets (Security Affairs)](https://securityaffairs.com/?p=192196)
- [FrostyNeighbor Ukraine brief (CraftedSignal)](https://feed.craftedsignal.io/briefs/2026-05-frostyneighbor-ukraine/)
- [ESET malware-ioc repository: FrostyNeighbor indicators](https://github.com/eset/malware-ioc/tree/master/frostyneighbor)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4705