Summary
- ESET covers advanced persistent threat activity observed between April and September 2026.
- Researchers report closer alignment between Belarus-linked operations and Russian wartime objectives.
- ESET finds increased use of AI tools but no fundamental six-month transformation of the APT landscape.
ESET has identified closer alignment between Belarus-linked cyber operations and Russia’s wartime priorities in its latest review of advanced persistent threat activity. The research covers operations its analysts observed between April and September 2026, with Ukraine and other strategically relevant organisations continuing to face espionage and disruption attempts attributed to state-aligned groups.
The convergence does not establish that every operation associated with Belarus is controlled directly by Moscow. Attribution in this field depends on combinations of malware, infrastructure, targeting, operational behaviour and intelligence about earlier campaigns. Overlap in objectives can reflect cooperation, shared priorities or imitation. ESET presents the development as a change in the observed operating landscape, not as a public disclosure of a single unified command structure.
The report also describes Russia-aligned activity supporting the war against Ukraine and North Korea-linked groups increasingly targeting Ukrainian entities. These operations can serve different intelligence requirements even when they affect the same geography. An actor seeking diplomatic communications, military-related information or access to a supplier may behave differently from one preparing disruptive operations against an operational network. The distinction limits the usefulness of treating all hostile activity as one campaign.
ESET recorded an increase in Iran-aligned operations targeting Israeli organisations across multiple sectors, with some US targets also affected. While much of that activity lies outside Europe, the reporting gives context to the way state-backed groups can expand or redirect targeting in response to regional political and military events. Changes in focus are not necessarily evidence of new malware capabilities; target selection and persistence techniques can be consequential even when familiar tools are used.
ESET identifies threat groups through observed techniques, infrastructure, targeting and other intelligence, while the government directing any particular operation may remain less certain. A malware sample can be reused, infrastructure can be rented or shared and public attributions may reflect varying levels of confidence. Targeting patterns and technical links become stronger evidence when they persist across more than one campaign. This is especially relevant to Belarusian and Russian groups because geopolitical alignment does not, by itself, prove common operators, shared infrastructure or an instruction chain from one intelligence service to another.
ESET’s April-to-September observation window captures changes in target selection and campaign techniques without establishing that every group’s activity increased across the whole period. A single intrusion or new malware label can attract attention without demonstrating a lasting change in operational scale. Repeated patterns across targets and tools provide stronger grounds for ESET’s assessment of priorities. Its conclusions therefore concern documented behaviour during April to September, not an assertion that every future Belarusian or Russian campaign will follow the same trajectory.
Ukraine’s continued prominence within the report also reflects the range of information held outside formal military networks. Businesses can store logistics schedules, procurement decisions, engineering correspondence or employee contacts useful to intelligence collection. A malicious document sent to a contractor can therefore be part of a state-linked campaign without carrying an obvious military label. ESET’s report samples activity visible through its research and telemetry; it cannot capture operations that produced no detections or those conducted entirely outside the products and sources to which investigators have access.
Artificial intelligence appears in the reporting as an operational aid rather than a decisive new category of attack. ESET observed advanced groups using large language models during different phases of their work, but says it did not see AI substantially reshape the APT landscape over the six-month period. That is a narrower conclusion than claiming state actors do not use AI, or that automated assistance cannot reduce the cost of reconnaissance, translation or content production.
European organisations can be exposed through supply relationships, shared service providers and research collaborations even when the initial cyber operation targets a counterpart elsewhere. A contractor, logistics provider or technology supplier may be of interest because its systems hold communications or support services connected to another country. The report covers both direct attacks on Ukrainian targets and attempts against organisations whose access, documents or infrastructure can advance broader intelligence objectives. ESET’s findings remain observations within the visibility of its research and should not be represented as a census of all state operations.
