ESETPDF
eset-apt-activity-report-q4-2025-q1-2026.pdf
Excerpt
MONITORING OIL SHIPMENTS, TARGETING DRONE MAKERS
October 2025 – March 2026
Report
ESET APT ACTIVITY REPORT OCTOBER 2025 - MARCH 2026 | 2
Contents
Executive summary3
Attackers and targets5
China7
SteppeDriver: From Mongolia to Syria8
PhiliKit, a new implant in UNC5221’s SPAWN toolset9
NegativeGlimmer compromises governmental
organizations and an AI and robotics company9
Iran 11
Rusty Boots 12
MoKhargosh 13
MOØN Badr 13
North Korea 14
Andariel deploys Rook ransomware in South Korea 15
Operation DreamJob 16
Operation DangerousPassword and the axios
supply-chain attack 16
From fake recruiters to trusted code editors:
DeceptiveDevelopment updates its tradecraft 17
ScarCruft targets Yanbian in a multiplatform
su…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by ESET on web-assets.esetstatic.com.
Mentioned in the excerpt
More from ESET16
- FishMonger’s arsenal upgraded: SprySOCKS for WindowsESET · Added 25 Oct
- ceranakeeper.pdfESET · Added 17 Oct
- Killing me gently: Inside Gentlemen’s EDR killer frameworkESET · Added 23 Sep
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
