An summary of the actions of chosen APT teams investigated and analyzed by ESET Analysis in Q2 2025 and Q3 2025
06 Nov 2025
•
,
4 min. learn
ESET APT Exercise Report Q2 2025–Q3 2025 summarizes notable actions of chosen superior persistent menace (APT) teams that have been documented by ESET researchers from April via September 2025. The highlighted operations are consultant of the broader panorama of threats we investigated throughout this era. They illustrate the important thing traits and developments and comprise solely a small fraction of the cybersecurity intelligence information supplied to prospects of ESET APT reviews.
In the course of the monitored interval, China-aligned APT teams continued to advance Beijing’s geopolitical aims. We noticed an rising use of the adversary-in-the-middle method for each preliminary entry and lateral motion, employed by teams corresponding to PlushDaemon, SinisterEye, Evasive Panda, and TheWizards. In what seems to be a response to the Trump administration’s strategic curiosity in Latin America, and probably additionally influenced by the continued US‑China energy battle, FamousSparrow launched into a tour of Latin America, concentrating on a number of governmental entities within the area. Mustang Panda remained extremely lively in Southeast Asia, the US, and Europe, specializing in the governmental, engineering, and maritime transport sectors. Flax Storm focused the healthcare sector in Taiwan by exploiting public-facing net servers and deploying webshells to compromise its victims. The group incessantly maintains its SoftEther VPN infrastructure, and it additionally began utilizing an open-source proxy, BUUT. In the meantime, Speccom focused the power sector in Central Asia with the presumed goal of gaining larger visibility into Chinese language-funded operations and decreasing China’s dependency on maritime imports. One of many backdoors within the group’s toolset, BLOODALCHEMY, seems to be favored by a number of China-aligned menace actors.
We noticed a continued enhance in spearphishing actions of the Iran-aligned MuddyWater. The group adopted the strategy of sending spearphishing emails internally – from compromised inboxes throughout the goal group – with a notably excessive success price. Different Iran-aligned teams remained lively: BladedFeline adopted new infrastructure, whereas GalaxyGato deployed an improved C5 backdoor. GalaxyGato additionally launched an fascinating twist to its marketing campaign by leveraging DLL-search-order hijacking to steal credentials.
North Korea-aligned menace actors focused the cryptocurrency sector and, notably, expanded their operations to Uzbekistan – a rustic not beforehand noticed of their scope. In current months, we’ve documented a number of new campaigns carried out by DeceptiveDevelopment, Lazarus, Kimsuky, and Konni, with the goal of espionage, advancing Pyongyang’s geopolitical priorities, and producing income for the regime. Kimsuky experimented with the ClickFix method to focus on diplomatic entities, and South Korean assume tanks and academia, whereas Konni used social engineering with an uncommon deal with macOS methods.
Russia-aligned teams maintained their deal with Ukraine and international locations with strategic ties to Ukraine, whereas additionally increasing their operations to European entities. Spearphishing remained their main methodology of compromise. Notably, RomCom exploited a zero-day vulnerability in WinRAR to deploy malicious DLLs and ship quite a lot of backdoors. We reported this vulnerability to WinRAR, which promptly patched it. The group’s exercise was principally targeted on the monetary, manufacturing, protection, and logistics sectors within the EU and Canada. Gamaredon remained essentially the most lively APT group concentrating on Ukraine, with a noticeable enhance in depth and frequency of its operations. This surge in exercise coincided with a uncommon occasion of cooperation between Russia-aligned APT teams, as Gamaredon selectively deployed considered one of Turla’s backdoors. Gamaredon’s toolset, probably additionally spurred by the collaboration, continued to evolve, for instance, via the incorporation of latest file stealers or tunneling providers.
Sandworm, much like Gamaredon, targeted on Ukraine – albeit with motives of destruction reasonably than cyberespionage. The group deployed information wipers (ZEROLOT, Sting) in opposition to governmental entities, firms within the power and logistics sectors, and, extra notably, in opposition to the grain sector – the doubtless goal being the weakening of the Ukrainian financial system. One other Russia-aligned menace actor, InedibleOchotense, carried out a spearphishing marketing campaign impersonating ESET. This marketing campaign concerned emails and Sign messages delivering a trojanized ESET installer that results in the obtain of a authentic ESET product together with the Kalambur backdoor.
Lastly, notable actions by lesser-known teams included FrostyNeighbor exploiting an XSS vulnerability in Roundcube. Polish and Lithuanian firms have been focused by spearphishing emails that impersonated Polish companies. The emails contained a particular use and mixture of bullet factors and emojis, a construction harking back to AI-generated content material, suggesting potential use of AI within the marketing campaign. Delivered payloads included a credential stealer and an e mail message stealer. We additionally recognized a beforehand unknown Android adware household in Iraq, which we named Wibag. Masquerading because the YouTube app, Wibag targets messaging platforms corresponding to Telegram and WhatsApp, in addition to Instagram, Fb, and Snapchat. Its capabilities embody keylogging and the exfiltration of SMS messages, name logs, location information, contacts, display screen recordings, and recordings of WhatsApp calls and common cellphone calls. Apparently, the login web page for the adware’s admin panel shows the brand of the Iraqi Nationwide Safety Service.
Malicious actions described in ESET APT Exercise Report Q2 2025–Q3 2025 are detected by ESET merchandise; shared intelligence is primarily based on proprietary ESET telemetry information and has been verified by ESET researchers.
ESET APT Exercise Studies comprise solely a fraction of the cybersecurity intelligence information supplied in ESET Menace Intelligence APT Studies. For extra info, go to the ESET Menace Intelligence web site.
