Jena – November 02, 2026 -- State-backed hacking groups from Russia, Iran, North Korea and China are expanding their activity and tailoring campaigns to global conflicts, according to ESET's latest APT Activity Report. Targets include governments, defense contractors, critical infrastructure, technology providers and institutions in geopolitical crisis regions.
Attackers use AI for malware, phishing and fake websites
Threat actors increasingly use AI tools to develop malicious code, build convincing phishing campaigns and generate fraudulent websites. Jean-Ian Boutin, Director of Threat Research at ESET, says AI makes individual attacks more efficient and partly lowers entry barriers for criminals. Strategic planning, target selection and execution still happen largely by hand, and the expected revolution in cybercrime has not materialized so far.
Russian and Belarusian groups coordinate more closely against Ukraine and Europe
Russia-aligned attacks again focused on Ukraine and other European countries. Belarusian groups often play a supporting role that amplifies Russian operations. They are also becoming more confident and increasingly follow the goals of Russian intelligence services in Ukraine.
Activity by Gamaredon, normally highly active, has dropped markedly. ESET names Ukrainian attacks on Crimea, where the group presumably operates, as one possible cause. Internal restructuring and other factors are still under investigation.
Iran-aligned groups resume attacks in the Middle East
After a comparatively quiet phase, several Iran-aligned groups stepped up operations in the Middle East. Israeli organizations across various economic and social sectors were the main focus, and some US companies were hit in isolated cases.
FilthyFeline apparently extended its activity to a mobile data services provider in Uzbekistan. ESET also recorded attacks by Hamas-aligned Arid Viper on Palestinian Authority institutions, apparently including the foreign ministry.
North Korea turns toward Ukraine while China targets semiconductors
North Korea-aligned groups largely keep their established pattern of targeting technology companies, crypto firms and software developers. Ukraine is increasingly in their sights, which observers link to closer Moscow-Pyongyang ties and North Korea's growing support for Russia's war.
Chinese actors continue espionage campaigns aimed at strategic industries such as semiconductors, with technological know-how and supply chain information in particular demand. For European states and companies, ESET expects a persistently tense threat environment and rising pressure to build cyber resilience continuously. Boutin warns that organizations with inadequate protection can be drawn into geopolitical disputes even without direct involvement.