A comprehensive overview of Global APT activity, uncovered through ESET telemetry and expert analysis from ESET’s leading threat researchers.
Belarus-aligned activity converges with Russia's war priorities
Russia-aligned actors continued supporting wartime objectives by targeting governments, defense organizations, and military entities, primarily in Ukraine. ESET also observed Belarus-aligned groups increasingly acting as cyberproxies, including the first documented destructive attack by a Belarus-aligned actor.
China-aligned groups target Taiwan’s semiconductor industry, pursue anti-scam operations
China-aligned actors targeted Taiwanese semiconductor organizations while continuing to collect intelligence on government entities. ESET also observed campaigns linked to broader efforts against fraud networks in Southeast Asia, including state-linked anti-scam operations in Palau and Sri Lanka.
North Korea-aligned actors target drone technology and software supply chains
North Korea-aligned groups continued targeting technology, cryptocurrency, and developer ecosystems. Ukraine emerged as a growing focus, while Lazarus resumed attacks on drone-related organizations and DeceptiveDevelopment expanded its focus on software supply chains.
Iran-aligned groups return, driving increased activity across Israel
Middle East-aligned activity increased as Iran-aligned groups resumed operations after a quieter period. FilthyFeline and MuddyWater targeted organizations across Israel, while Hamas-affiliated Arid Viper conducted intelligence collection against a Palestinian governmental entity.
Read the ESET APT Activity Report.
Latest ESET Threat Report
Threat Intelligence Best Practice Report
Actionable Threat Intelligence For Your SOC Teams
Enrich your cyber threat intelligence strategy (CTI) with actionable insights to fortify your organization's defense systems effectively.
Frequently asked questions
What can I learn from the ESET APT Activity Report?
The ESET APT Activity Report provides an expert-led analysis of notable activities conducted by advanced persistent threat (APT) groups. It offers a snapshot of the global threat landscape, based on ESET telemetry and original research.
How often is the ESET APT Activity Report published?
The report is published biannually, providing insights into APT activity and trends across two distinct six-month periods each year.
What regions does the ESET APT Activity Report cover?
The report highlights APT campaigns and threat activity affecting regions around the globe, with a focus on key geopolitical hot spots. Coverage reflects where ESET researchers observed significant operations during the reporting period.
How does ESET collect the data represented in the reports?
The findings are based on proprietary ESET telemetry, expert analysis, and real-world investigations conducted by ESET’s global network of threat researchers. Other sources used in the reports’ analyses may include honeypots and external security feeds as well as data from other cybersecurity vendors. All intelligence shared is carefully verified before publication.
What is unique ESET APT Activity Reports when compared with those of other cybersecurity providers?
ESET APT Activity Reports offer in-depth analyses of the global threat landscape, enriched with and recommendations by ESET’s diverse team of cybersecurity specialists – many of whom are frequent speakers at prestigious industry conferences, like RSA, Black Hat, and Virus Bulletin, and renowned for their expertise.
With ESET’s R&D centers spanning Europe, Asia, and North America, ESET’s analysts provide around-the-clock coverage, leveraging diverse time zones and locations to address the evolving threat landscape.
How does the ESET APT Activity Report differ from the ESET Threat Report?
ESET APT Activity Reports provide an overview of activities of selected advanced persistent threat (APT) groups investigated and analyzed by ESET Research within the reporting period. APT groups are typically highly sophisticated threat actors, often backed by nation states, engaging in targeted cyberattacks and espionage. In contrast, the threat reports focus on widespread cyberthreats – so-called crimeware – that typically aren’t targeted in nature, and thus, can affect anyone.
What kind of threat activity is included?
The report focuses on documented campaigns by threat actors in key geopolitical hot spots around the globe. It includes espionage campaigns, financially motivated attacks, destructive operations, and exploitation of zero-day vulnerabilities.
Who is this report intended for?
Cybersecurity professionals, threat analysts, decision-makers in IT and security, and anyone interested in understanding the evolving tactics, techniques, and procedures (TTPs) of global threat actors.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
