Overview of the Apr–Sep 2026 APT Landscape
ESET researchers documented a clear acceleration in advanced persistent threat activity between April and September 2026. Nation-aligned groups from China, Russia, Belarus, Iran, North Korea and Middle East–linked actors maintained or expanded campaigns. Attack patterns shifted toward intelligence collection against state bodies, resumed Iranian-linked operations in the Middle East, and closer operational alignment between Russian- and Belarus-aligned groups. Across campaigns, adversaries increasingly applied artificial intelligence and large language models to speed up routine but labor-intensive tasks.
How adversaries use AI and LLMs in operations
Threat actors adopted AI primarily to reduce development time and scale operations. ESET observed concrete use cases: automated draft generation for malware components, creation of convincing phishing webpages, and prompt engineering to evade automated analysis. In one analyzed case, operators embedded a deceptive LLM prompt inside script comments that asked for technical instructions about nuclear weapons—likely a tactic to trigger LLM-based analysis tools and alter their responses or behavior. While AI sped up workflows, ESET found no evidence that AI fundamentally changed APT tradecraft during this period; instead, it augmented existing processes.
China-aligned campaigns: semiconductor supply chain and enforcement support
Chinese-linked actors concentrated on Taiwan’s semiconductor industry, consistent with long-term industrial espionage priorities. Targeting focused on procurement records, design documentation and supplier communications to close technology gaps. Example tactics included credential harvesting via tailored spear-phishing, supply-chain reconnaissance through compromised vendor accounts, and selective data exfiltration timed around product development milestones. In parallel, some operations resembled support for law enforcement and anti-fraud efforts—campaigns that targeted individuals and organizations tied to organized crime and fraud networks, likely to support domestic investigations.
Middle East: resurgence of Iran-aligned operators
After a quieter period, Iran-aligned groups such as MuddyWater and a subgroup of OilRig dubbed FilthyFeline resumed operations. ESET observed campaigns mainly against Israeli institutions across multiple sectors, with limited impact on US firms. FilthyFeline also appears to have targeted a cellular data provider in Uzbekistan through custom phishing lures and follow-on backdoor deployments. Additionally, operators linked to Hamas, tracked as Arid Viper, carried out targeted activity against a Palestinian Authority foreign ministry asset or affiliated institution.
North Korea: persistent targeting with growing focus on Ukraine
Korean peninsula–aligned actors kept prioritizing technology firms, crypto companies and software developers, using recruitment-themed social engineering for initial access. Notably, Ukraine appeared more frequently among targets—likely reflecting closer ties and increased cooperation between North Korea and Russia. Lazarus resumed activity against the drone industry by leveraging job-offer lures to obtain credentials and implant reconnaissance tooling.
Russia and Belarus: converging operations and shared priorities
Russian-aligned activity continued to support wartime objectives, striking European state bodies, defense organizations and military institutions; targeting intensity in Ukraine rose significantly. ESET noted growing overlap between Russian and Belarusian campaigns: operational patterns, tooling similarities and synchronized target sets suggest Belarusian actors increasingly act as cyber proxies or force multipliers for Russian priorities. Belarusian groups elevated their tempo and ambition in several domains. Gamaredon, however, showed a marked decline in operations, potentially due to tactical restructuring or countermeasures focused on Crimea-related activity.
Common intrusion vectors and techniques observed
Across all actor classes, ESET documented repeatable intrusion chains:
1) Social engineering for initial access. High-value spear-phishing, job-offer lures, and contractor-targeted messages obtained credentials or convinced victims to run droppers.
2) Exploit and lateral movement. Operators chained public-facing exploits with living-off-the-land tools and custom implants to escalate privileges and move laterally.
3) Data collection and exfiltration. Campaigns prioritized targeted exfiltration windows—collecting specific datasets (design docs, procurement records, foreign-policy communications) and staging transfers to avoid detection.
4) Operational security via obfuscation. Use of LLM prompts to confuse analysis tools, custom packers, and time-based triggers reduced analysts’ ability to reproduce behaviors.
Steps defenders should prioritize (practical, actionable)
Organizations can reduce risk by hardening identified attack paths. Key steps include:
1) Harden email and identity. Deploy multi-factor authentication, enforce conditional access policies, and tune email gateways for spear-phish indicators (contextual sender checks, attachment sandboxing).
2) Monitor and restrict privileged access. Implement least privilege for service accounts, rotate credentials, and enable just-in-time admin elevation where possible.
3) Detect abnormal exfiltration. Baseline normal data flows, set thresholds for atypical large transfers, and inspect outbound connections for staging IPs and domains.
4) Vet vendors and supply chain access. Inventory third-party integrations, enforce MFA and segmentation for vendor connections, and require attestations for critical supplier security practices.
5) Integrate AI-aware detection. Because attackers use LLMs to craft evasive content, tune content-analysis engines for prompt-like artifacts and embed behavioral analytics that look beyond static signatures.
Examples and timelines that illustrate campaign behavior
Example: FilthyFeline targeted a cellular data provider in Central Asia with a multi-stage campaign—initial spear-phish with a staged document, follow-on deployment of a lightweight backdoor, and periodic exfiltration aligned with billing-cycle exports to blend with normal traffic. Example: A Russian-affiliated cluster used synchronized watering-hole sites on defense-related domains to serve customized payloads; LLM-generated landing pages helped speed creation and localization across languages.
What changed compared with prior reporting periods
Notable changes include an uptick in Middle East operations driven by Iran-aligned groups, expanded North Korea activity that now includes Ukraine among frequent targets, and increased operational alignment between Russia and Belarus. AI usage rose as an enabling technology but did not replace core human-driven targeting and decision-making.
Search-focused FAQ-style items for featured snippets
What APT groups used AI in 2026? Multiple APT groups from Russia, China and opportunistic actors used LLMs for code drafting, phishing page generation and analysis evasion.
Which sectors faced the most targeting? Government agencies, defense contractors, semiconductor firms, telecommunications providers and crypto/technology companies saw the most focused targeting.
How can organizations detect LLM-driven evasive tactics? Look for unusual comment strings or prompt-like payloads in scripts, monitor for novel page templates served from trusted domains, and correlate code-string anomalies with behavioral telemetry rather than relying solely on signatures.
Concluding operational takeaways
APT operators increased use of automation and LLMs to accelerate craftsmanship but retained human-led target selection and campaign orchestration. Defenders should combine identity controls, vendor hardening, behavioral data exfiltration detection and AI-aware inspection to reduce exposure. Tracking convergence between nation-aligned groups (for example, Russia and Belarus) helps prioritize threat models and anticipation of shared tooling or coordinated campaigns.
Be the first to comment