ESET APT Activity Report Q4 2025–Q1 2026: Key Cyber Threats Unveiled
Between October 2025 and March 2026, ESET researchers observed significant activities from various Advanced Persistent Threat (APT) groups. China-aligned actors conducted espionage campaigns targeting maritime, energy, and political sectors, notably in Venezuela and Syria. Iran-aligned groups experienced a decline in activity due to domestic internet restrictions, while proxy and hacktivist actors increased attacks on Israel and the United States. North Korea-aligned groups focused on developers and the cryptocurrency ecosystem, employing social engineering tactics for financial gain and potential supply-chain compromises. Russia-aligned actors intensified operations against Ukraine, deploying new wipers and targeting critical infrastructure, with notable incidents extending to NATO member states like Poland. Lesser-known clusters also emerged, including browser-in-the-browser phishing attacks and Android spyware targeting Arabic-speaking users. This period underscores the evolving tactics of APT groups and the necessity for robust cybersecurity measures to counteract these sophisticated threats.
Kill Chain
