China-aligned APT Groups Target Global Maritime and Tech Sectors Amid Geopolitical Tensions

Welivesecurity

China-aligned APT Groups Target Global Maritime and Tech Sectors Amid Geopolitical Tensions

First seen 28 May 2026, 13:42 UTC • •75.5

Article Content

1 / 9

Browse articles

ThreatCluster •May 29, 2026 at 13:26 UTC

•China-aligned APT groups targeted maritime and tech sectors in response to geopolitical events.
•FamousSparrow and UNC5221 were involved in espionage campaigns against Venezuela and South Korea.
•Iran-aligned activities decreased due to internet restrictions amid the ongoing war in Iran.

ESET's latest APT Activity Report reveals that from October 2025 to March 2026, China-aligned threat actors engaged in extensive espionage campaigns, particularly in Venezuela and the Gulf region. Following U.S. military operations, groups like FamousSparrow targeted Venezuelan maritime entities to monitor oil shipment resilience. Additionally, UNC5221's SPAWN malware was noted targeting governmental systems in Cambodia and Panama, as well as an AI and robotics firm in South Korea, aligning with China's strategic technology interests. Concurrently, North Korea-aligned groups like Andariel attacked the nuclear power sector, while Iran-aligned activities fluctuated due to internet restrictions amid ongoing conflict. ESET documented new clusters of activity against Israeli targets, indicating a rise in espionage and destructive capabilities. The report emphasizes the evolving nature of state-sponsored cyber threats in response to geopolitical developments.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 140d ago How this analysis works

Timeline

2025-10-01

Monitoring period begins

ESET researchers began tracking APT activities, focusing on geopolitical influences on cyber operations.

2026-02-28

War in Iran begins

The conflict initiated significant changes in cyber activity from Iran-aligned groups due to internet restrictions.

Markets.Businessinsider

2026-03-01

FamousSparrow targets Venezuelan entity

FamousSparrow conducted espionage against a Venezuelan governmental entity related to maritime affairs.

2026-03-15

UNC5221 targets South Korean tech

UNC5221's SPAWN malware targeted an AI and robotics company in South Korea, reflecting strategic interests.

2026-05-28

ESET APT Activity Report published

ESET released findings on APT activities from late 2025 to early 2026, highlighting geopolitical impacts on cyber threats.

2026-05-28

Increased activity against Israel

ESET documented a spike in cyber activity against Israeli targets, including new, unattributed threat clusters.

More articles in this cluster (8)

Threat Graph

16 entities, 57 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (7)

Andariel
FamousSparrow
Sandworm
Sednit
SteppeDriver
UNC5221
Rook

Technique (4)

Malware
Ransomware
T1485 - Data Destruction
T1566 - Phishing

Malware (3)

BeardShell
Spawn
TigerRAT

Affected Platform (1)

Android

Tool (1)

Covenant

Relationships

Andariel uses BeardShell
Andariel uses Spawn
Andariel uses TigerRAT
FamousSparrow uses BeardShell
FamousSparrow uses Spawn
FamousSparrow uses TigerRAT
Sandworm uses BeardShell
Sandworm uses Spawn
Sandworm uses TigerRAT
Sednit uses BeardShell
Sednit uses Spawn
Sednit uses TigerRAT
SteppeDriver uses BeardShell
SteppeDriver uses Spawn
SteppeDriver uses TigerRAT
UNC5221 uses BeardShell
UNC5221 uses Spawn
UNC5221 uses TigerRAT
Rook uses BeardShell
Rook uses Spawn
Rook uses TigerRAT
Andariel uses Covenant
FamousSparrow uses Covenant
Sandworm uses Covenant
Sednit uses Covenant
SteppeDriver uses Covenant
UNC5221 uses Covenant
Rook uses Covenant
Andariel uses Malware
Andariel uses Ransomware
Andariel uses T1485 - Data Destruction
Andariel uses T1566 - Phishing
FamousSparrow uses Malware
FamousSparrow uses Ransomware
FamousSparrow uses T1485 - Data Destruction
FamousSparrow uses T1566 - Phishing
Sandworm uses Malware
Sandworm uses Ransomware
Sandworm uses T1485 - Data Destruction
Sandworm uses T1566 - Phishing
Sednit uses Malware
Sednit uses Ransomware
Sednit uses T1485 - Data Destruction
Sednit uses T1566 - Phishing
SteppeDriver uses Malware
SteppeDriver uses Ransomware
SteppeDriver uses T1485 - Data Destruction
SteppeDriver uses T1566 - Phishing
UNC5221 uses Malware
UNC5221 uses Ransomware
UNC5221 uses T1485 - Data Destruction
UNC5221 uses T1566 - Phishing
Rook uses Malware
Rook uses Ransomware
Rook uses T1485 - Data Destruction
Rook uses T1566 - Phishing
Andariel related to Android

Following this threat?

Track Rook, Andariel and BeardShell in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…