ESET Report: APT Groups Use AI in Cyber Espionage Activities

iguru.gr

ESET Report: APT Groups Use AI in Cyber Espionage Activities

First seen 6 Nov 2026, 12:45 UTC • •59.3

Article Content

1 / 4

Browse articles

ThreatCluster •November 6, 2026 at 12:46 UTC

•APT groups are increasingly using AI in cyber operations.
•Significant activity from Chinese, Iranian, Russian, and North Korean APT groups reported.
•Ukraine remains a primary target for multiple state-linked threat actors.

ESET's latest report details the activities of Advanced Persistent Threat (APT) groups from April to September 2026, highlighting the increasing use of artificial intelligence in their operations. APT groups linked to China focused on intelligence gathering against state entities, while Iranian groups re-emerged with heightened activity in the Middle East. Russian APT groups targeted European defense organizations and military entities, particularly in Ukraine, aligning closely with Russian strategic goals. Belarusian APT activities are increasingly synchronized with Russia's priorities. North Korean APT groups are also intensifying their focus on Ukraine and South Korea. The report emphasizes the use of AI in various stages of cyber operations, including malware development and phishing site creation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 4h ago How this analysis works

Timeline

2026-11-06

ESET releases APT activity report

ESET's report outlines APT group activities and the role of AI in cyber espionage from April to September 2026.

More articles in this cluster (3)

Threat Graph

10 entities, 21 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (7)

Arid Viper
FilthyFeline
Gamaredon
Lazarus
MuddyWater
OilRig
UAC -0099

Technique (3)

Malware
T1566.002 - Spearphishing Link
T1566 - Phishing

Relationships

Arid Viper uses Malware
Arid Viper uses T1566.002 - Spearphishing Link
Arid Viper uses T1566 - Phishing
FilthyFeline uses Malware
FilthyFeline uses T1566.002 - Spearphishing Link
FilthyFeline uses T1566 - Phishing
Gamaredon uses Malware
Gamaredon uses T1566.002 - Spearphishing Link
Gamaredon uses T1566 - Phishing
Lazarus uses Malware
Lazarus uses T1566.002 - Spearphishing Link
Lazarus uses T1566 - Phishing
MuddyWater uses Malware
MuddyWater uses T1566.002 - Spearphishing Link
MuddyWater uses T1566 - Phishing
OilRig uses Malware
OilRig uses T1566.002 - Spearphishing Link
OilRig uses T1566 - Phishing
UAC -0099 uses Malware
UAC -0099 uses T1566.002 - Spearphishing Link
UAC -0099 uses T1566 - Phishing

Following this threat?

Track Arid Viper in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which APT groups are active?

The report identifies active groups linked to China, Iran, Russia, and North Korea.

What methods are being used by these groups?

APT groups are using AI for malware development and creating phishing sites.

What regions are most affected?

Ukraine and South Korea are highlighted as significant targets for these APT activities.

Continue Reading

Increased APT Activity from Iran-aligned Groups Targeting Israel ESET's APT Activity Report indicates a resurgence of Iran-aligned groups, specifically FilthyFeline and MuddyWater, targeting multiple sectors in Israel and some US companies. This activity aligns with Russia-aligned operations supporting wartime objectives, particularly in Ukraine. Belarus-aligned actors are…

Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…