02.11.2026 21:50
ESET APT report focuses on semiconductors and geopolitical targets
Security
Hits: 2
ESET’s APT report for April–September 2026 examines activity by state-linked threat groups. It highlights the semiconductor industry, diplomatic targets and the use of AI during attack preparation.
Dji Banner Inside Article - 728x90
Semiconductor businesses among the targets
ESET’s observations point to interest in Taiwan’s semiconductor ecosystem from groups it assesses as China-linked. The findings concern specific campaigns and activity monitored by the company. They do not mean every business in the sector has been breached or that all attacks are directed from one centre.
Chip design and manufacturing combine commercial information with strategically important technical knowledge. Cyberespionage against the sector therefore extends beyond the security of an individual computer. Supply chains, partners and remote-access processes also matter.
Regional tensions reflected in threat activity
The report discusses Iran-linked groups including OilRig, FilthyFeline and MuddyWater. AridViper and campaigns associated with North Korea-linked Lazarus also feature. Recruitment-themed communications and targets connected with the drone industry are among the social-engineering examples discussed.
ESET also considers closer connections between Russia- and Belarus-linked activity. Actor attribution should be read as an assessment based on researchers’ technical findings. A group name alone does not establish definitive responsibility for an individual incident; campaign details and the research confidence level matter.
AI accelerates preparation while familiar risks remain
The company assesses that AI can speed up steps such as code production and deceptive-content creation. It does not conclude that the underlying logic of APT activity has completely changed. Compromised privileges, persistence, credentials and movement inside organisations remain important risks.
For organisations, the practical issue goes beyond tracking new tool names. Restricting access, examining unusual sessions and preparing staff for targeted communications need to be considered together. This report describes a six-month threat landscape from April to September, rather than events all occurring on 2 November.
Sources and further information: ESET threat reports.