ESET APT Activity Report Q4 2025-Q1 2026: Analysis of China/Iran/NK/RU Threat Groups

Vulnerability Overview The ESET APT Activity Report Q4 2025–Q1 2026 reports on the activities of multiple Advanced Persistent Threat (APT) groups, including threat actors supported by China, Iran, North Korea, and Russia. China-supported threat actors are highly active globally, particularly in Venezuela and the Gulf region, involving espionage and the monitoring of oil transportation. Iran-supported threat actors have seen significant activity starting in February 2026 amid the Iran war, targeting Israel, the United States, and other countries perceived as hostile to Tehran. North Korea-supported threat actors continue to target developers and the cryptocurrency ecosystem, utilizing social engineering techniques for software supply chain attacks. Russia-supported threat actors continue to focus on Ukraine and its defense efforts, using Covenant and BeardShell implants to target Ukrainian military personnel, drone manufacturers, and logistics companies. Impact Scope China-supported threat actors: - Venezuelan government entities - Syrian government networks - Government entities in Cambodia and Panama - Artificial intelligence and robotics companies in South Korea Iran-supported threat actors: - Israel - The United States - Other countries perceived as hostile to Tehran North Korea-supported threat actors: - Developers and the cryptocurrency ecosystem - European drone manufacturers - Andariel and TigerRAT targets in South Korea - Rook ransomware targets in Poland Russia-supported threat actors: - Ukraine and its defense efforts - Energy companies in Poland Remediation ESET Products: Protect customer systems against the aforementioned malicious activities. Recommended Measures: - Enhance cybersecurity awareness training - Regular updates and patch management - Use multi-factor authentication - Monitor and detect anomalous activities - Strengthen supply chain security measures POC Code or Exploit Code No specific POC code or exploit code was provided on the page. Summary The ESET APT Activity Report Q4 2025–Q1 2026 provides a detailed description of activities by multiple APT groups, involving threat actors supported by China, Iran, North Korea, and Russia. These activities have impacted various countries and industries, including government, energy, technology, and defense sectors. ESET products provide protection, and users are advised to implement multiple security measures to address these threats.

Goal Reached Thanks to every supporter — we hit 100%!

ESET APT Activity Report Q4 2025-Q1 2026: Analysis of China/Iran/NK/RU Threat Groups