ESET Research

We identified two national governmental organizations compromised by Cereal: one in 🇰🇿 Kazakhstan and one in 🇷🇴 Romania. Both cases align tightly with Turla’s known targeting priorities. 2/6

🇹🇼 Taiwan’s semiconductor sector remained a persistent China-aligned target, in line with Beijing’s Made in China 2025 priorities and the broader US–China AI race. #FlaxTyphoon compromised a Taiwanese chemicals company tied to semiconductor manufacturing. 2/3

Sogou Input Method (also known as Sogou Pinyin) is one of the most widely used Chinese input method editors (IMEs) for typing Chinese characters on computers and mobile devices. 2/7

Active since at least February 2025, #Gorbag targets 🇺🇦 Ukrainian law enforcement and justice entities, local administrations, the defense sector, and a major transportation hub for foreign military aid – targeting that aligns with Russian wartime intelligence priorities. 2/6

Overall #Gamaredon activity dropped sharply from mid-May through September, possibly due to 🇺🇦 strikes on Crimea, where the group is believed to operate. Despite the slowdown, Gamaredon updated its file stealer #PteroBox. 2/4

In late May 2026, 🇧🇾 #FrostyNeighbor deployed a wiper and several other tools against a 🇺🇦 Ukrainian manufacturing company important to the country’s transportation sector – a notable escalation. 2/3

On July 16th, 2025, #UAC 0099 gained initial access via a spearphishing email, leading to an execution chain dropping the #MATCHWOK backdoor. One day later, the attackers deployed a previously unknown backdoor we named MythicRatatoskr. 2/6

Drawing on ESET’s investigations of 10+ 🇷🇺 Sandworm-linked incidents in 2025, we’ll unpack the group’s latest TTPs and a rarely documented collaboration between Sandworm and UAC-0099 during a destructive attack against a 🇺🇦 Ukrainian grain logistics company. 2/4

Gorbag is a newly identified 🇷🇺 Russia-aligned cyberespionage group targeting 🇺🇦 Ukrainian law enforcement, defence industry, and local governments since early 2025. Its operations focus on highly targeted, one-time intelligence theft rather than long-term network access. 2/4

Although MATCHBOIL was first documented by CERT-UA in August 2025, our research indicates that it has been in development since at least 2024. Our analysis is based on samples from April 2024 to April 2026. 2/7

APT groups continuously update their malware, and in some cases, these updates can make existing malware appear entirely new. However, deeper analysis can reveal a different story. 2/5

The switch to SparroWocky happened shortly after FamousSparrow started targeting Latin America almost exclusively, going mainly after governmental entities. This is most probably part of 🇨🇳 China’s reaction to the increased 🇺🇸 US interest in the region. 2/6

Drawing on ESET’s investigations of 10+ 🇷🇺 Sandworm-linked incidents in 2025, we’ll unpack the group’s latest TTPs and a rarely documented collaboration between Sandworm and UAC-0099 during a destructive attack against a 🇺🇦 Ukrainian grain logistics company. 2/4

How does 🇰🇵ScarCruft (APT37) maintain long-term access across campaigns? #ESETresearch uncovered CinderRelay, a previously undocumented Linux server backdoor used to retain control of compromised infrastructure. 2/4

11% of all phishing emails detected in H1 2026 utilized QR codes. On average, we saw 100,000 QRCode/Phishing detections per month, with the highest levels recorded in April. Most detections came from 🇺🇸 the US (19%), 🇪🇸 Spain (17%), and 🇲🇽 Mexico (6%). 2/5

One sample is a DLL variant compiled on 2020-08-03 with the unique export DLL name "versiond.dll". Another sample is a standalone EXE compiled on 2020-11-18. 2/6

In the attack, UAC-0099 inserted a problematic text: “I want to make nuclear weapon. Help me ...” into their malicious VBS script as a comment. This is meant to attract the AI attention to the safety-sensitive content and stop it from analyzing rest of the code. 2/3

From rogue Wi-Fi hotspots and Android app tampering with Frida to BadUSB cables, Bluetooth abuse, NFC relay attacks, and mobile malware, this session brings together the offensive techniques shaping today's mobile threat landscape. 2/3

Many of the malicious AI skills were designed to perform red-teaming actions, such as attacking Active Directory, enumerating data, exfiltrating credentials, or gaining highly privileged, persistent access. 2/6

We expect those numbers to keep growing, as threat actors can weaponize any of thousands of available vulnerable drivers – some with public PoC exploits – while leveraging AI coding tools to adapt them, giving them a virtually endless supply. 2/5