> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # ESET Q2-Q3 2026 APT Report: Lazarus targets drones, DeceptiveDevelopment hits supply chains - URL: https://f4n6.co.uk/security-feed/eset-q2-q3-2026-apt-report-lazarus-targets-drones-deceptivedevelopment-hits-supply-chains/ - Published: 2026-10-29T10:51:07.000Z - Updated: 2026-10-29T10:51:07.000Z - Author: Jeff Davies - Tags: #security-feed, FamousSparrow, SlippyNunchucks, FilthyFeline, OilRig, MuddyWater ## 1\. Executive summary ESET's Q2-Q3 2026 APT report records a rise in Middle East-aligned activity, with FilthyFeline (an OilRig subgroup) and MuddyWater resuming operations after a quieter period, mostly against Israeli entities and a smaller number of US companies. The item most relevant to EMEA financial services is DeceptiveDevelopment, which moved from fake job-interview lures to software supply-chain compromise: it harvested developer credentials and used that access to inject malicious code into public and private source code repositories. Lazarus resumed targeting the drone sector through recruitment-themed social engineering, and a Belarus-aligned actor (FrostyNeighbor) carried out the first destructive attack by such an actor that ESET has documented in the European theatre, against a Ukrainian manufacturer in the transportation sector. No CVE, CVSS score, EPSS value or CISA KEV entry is associated with this item, and the report gives no atomic indicators, so the risk here is to supplier and developer pipelines rather than to a patchable product. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | DeceptiveDevelopment compromised developer credentials and injected malicious code into source code repositories, which is an ICT third-party and supply-chain exposure for any client whose software comes through those repositories | Clients must be able to show due diligence over the ICT third-party arrangements that touch their code pipeline, including the repositories and build tooling they depend on | | NIS2 Art. 21(2)(d) | The same supply-chain compromise of source code repositories | Supply chain security measures must extend to the software development and distribution path, not only to purchased services | No other article in the reference is engaged by the facts here. The report describes campaigns and tooling but no incident at a named client, so the DORA Art. 17-19 incident-management and reporting chain is not triggered by this item itself. ## 3\. Technical analysis & attack chain This is a periodic activity report, not a single intrusion, so the chain below is the DeceptiveDevelopment supply-chain sequence that ESET describes. It is the only operation in the item with a step-by-step progression, and ESET gives it at a summary level. 1. DeceptiveDevelopment previously used fake job-interview lures to reach software developers. In this period it moved to broader software supply-chain compromises. 2. The group harvested developer credentials. 3. It used that access to inject malicious code into public and private source code repositories. ESET does not state the credential-harvesting method, the repository platforms involved, the injected code's function, or any detection artefact. Treat the sequence as directionally accurate but thin on mechanics; an analyst cannot build a detection from it without the underlying ESET Threat Intelligence report, which is not public. Other operations in the item, in the detail ESET gives: Lazarus (North Korea-aligned, MITRE G0032) resumed targeting the drone sector, typically using recruitment-themed social engineering for initial access. ESET assesses the motive as access to drone know-how for North Korea's own production, tied to the role drone systems play in the war in Ukraine. No malware family, lure format or infrastructure is named. FilthyFeline, described as an OilRig subgroup, and MuddyWater (MITRE G0069) resumed operations, mostly against entities in Israel across multiple sectors, with a smaller number of US companies affected. FilthyFeline also appears to have taken over activity against a cellular data service provider in Uzbekistan previously compromised by BladedFeline, another OilRig subgroup. ESET reports new or updated malware in the Iran-aligned ecosystem but does not name the families here. FilthyFeline and BladedFeline have no MITRE ATT&CK profile, so their subgroup status rests on ESET's reporting alone. Gamaredon's operations declined significantly. It updated its PteroBox file stealer and began using new tools, PteroPSDoor and Turla's VBScript Rezzuar. PhantomCaptcha attempted to deploy Android spyware ESET names PrincessSpy while impersonating Ukrainian entities. A campaign in Ukraine exploited MDaemon mail servers and deployed two backdoor families, HELLAGE and HELLTAG. ESET gives no exploit detail for the MDaemon campaign, so whether it used a vulnerability or credential abuse is not stated. FrostyNeighbor, a Belarus-aligned actor, attacked a Ukrainian manufacturing company important to the country's transportation sector. ESET calls this the first destructive cyberattack by a Belarus-aligned actor it has documented in the European theatre, and notes that destructive operations in Ukraine had until now been Russia-aligned. The destructive mechanism is not described. On AI use, ESET reports APT groups using LLMs to speed malware development and decoy website creation, in some cases resembling prompt-driven drafting with human operators integrating the output. UAC-0099 inserted a decoy request for instructions on building a nuclear weapon into a script comment, apparently to trigger LLM safety guardrails and block automated inspection of the malicious code that followed. ESET states it has not seen AI substantially reshape APT operations and still observes hands-on-keyboard activity. Single-source caveat: every claim in this section comes from ESET's report and its proprietary telemetry. None is corroborated by a second source in this item. The actor-to-nation alignments (China, Iran, North Korea, Russia, Belarus) are ESET's assessments. ## 4\. Mitigation & containment P1 (within 24h) - Treat source code repositories that feed your build pipeline as an attack surface. Review recent commits and merges to repositories your teams depend on for unexpected changes, and check developer accounts for credential use from unfamiliar locations or at unusual times. This follows directly from the DeceptiveDevelopment credential harvest and code injection. - Enforce phishing-resistant MFA on developer accounts and on repository and CI/CD access, and rotate credentials for any developer account showing anomalous activity. - Brief recruitment-facing staff and developers that Lazarus uses recruitment-themed social engineering. Verify unsolicited job or interview approaches through an independent channel before any file, call or meeting link is opened. P2 (within 72h) - Inventory the third-party repositories, package registries and build tools your software depends on, and confirm which of them you can audit for injected code. This is the practical form of the DORA Art. 28 and NIS2 Art. 21(2)(d) supply-chain duty for this item. - Restrict CI/CD pipeline credentials to least privilege and separate build signing keys from developer accounts, so a harvested developer credential does not reach release signing. - For any MDaemon mail server in estate, review logs for the HELLAGE and HELLTAG deployment pattern. ESET gives no exploit detail, so treat this as log review rather than a patch instruction, and confirm the server is on a current MDaemon release from the vendor. P3 (within 7 days) - Add the DeceptiveDevelopment supply-chain pattern to supplier risk reviews: ask software suppliers whether they can detect injected code in their repositories and how they protect developer credentials. - Track the Iran-aligned resumption (FilthyFeline, MuddyWater) for clients with Israeli or US operations, and the Belarus-aligned destructive shift (FrostyNeighbor) for clients with Ukrainian manufacturing or transport exposure. No vendor fix, version number or patch is named in the source for any item, because the report describes campaigns rather than a specific vulnerable product. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ESET names malware families (PteroBox, PteroPSDoor, Rezzuar, PrincessSpy, HELLAGE, HELLTAG, DarkVigil) and tooling but gives no hashes, domains, IP addresses, file paths or registry keys. Behavioural indicators, from the report's descriptions: | Behaviour | Where to observe | Confidence | | ---------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | ------------------------------------------------ | | Developer credentials used to push or merge code into public or private repositories outside normal pattern (DeceptiveDevelopment) | Repository audit logs, VCS access logs, CI/CD pipeline logs | Single-sourced (ESET); verify before enforcement | | Recruitment or job-interview themed contact preceding a malicious file or link (Lazarus) | Email gateway, endpoint, user reports | Single-sourced (ESET) | | Backdoor deployment following activity on an MDaemon mail server (HELLAGE, HELLTAG) | Mail server logs, endpoint process telemetry | Single-sourced (ESET); no exploit detail given | | Android spyware installation following impersonation of Ukrainian entities (PrincessSpy, PhantomCaptcha) | Mobile device management, endpoint telemetry on Android | Single-sourced (ESET) | ## 6\. Detection The source gives no file hashes, command-line flags, mutex names, file paths or registry keys, so a string-based YARA rule cannot be built from genuine artefacts. The only named artefacts are malware family names, which are reporting labels, not strings that appear in the malicious files. Writing a rule to grep for them would detect reporting about the threat, not the threat. Insufficient indicators to author detection rules. ## Threat actor context **OilRig** · [G0049](https://attack.mitre.org/groups/G0049?ref=f4n6.co.uk) · aka COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens [OilRig](https://attack.mitre.org/groups/G0049?ref=f4n6.co.uk) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014\. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. … **MuddyWater** · [G0069](https://attack.mitre.org/groups/G0069?ref=f4n6.co.uk) · aka Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros [MuddyWater](https://attack.mitre.org/groups/G0069?ref=f4n6.co.uk) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, [MuddyWater](https://attack.mitre.org/groups/G0069?ref=f4n6.co.uk) has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saud … **APT-C-23** · [G1028](https://attack.mitre.org/groups/G1028?ref=f4n6.co.uk) · aka Mantis, Arid Viper, Desert Falcon, TAG-63, Grey Karkadann [APT-C-23](https://attack.mitre.org/groups/G1028?ref=f4n6.co.uk) is a threat group that has been active since at least 2014\. [APT-C-23](https://attack.mitre.org/groups/G1028?ref=f4n6.co.uk) has primarily focused its operations on the Middle East, including Israeli military assets. [APT-C-23](https://attack.mitre.org/groups/G1028?ref=f4n6.co.uk) has developed mobile spyware targeting Android and iOS devices since 2017. **Lazarus Group** · [G0032](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY [Lazarus Group](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [Lazarus Group](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. … *No MITRE ATT&CK profile for: FamousSparrow, SlippyNunchucks, FilthyFeline, BladedFeline.* ## 7\. Sources - ESET, "ESET APT Activity Report Q2 2026-Q3 2026", https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/, 2026-10-28. ## 8\. Adverse Trace position We assess this item as a strategic activity report rather than a directly actionable vulnerability or incident. No CVE, CVSS score, EPSS value or CISA KEV entry applies, and the report carries no atomic indicators, so there is nothing to patch or block from it alone. The material risk to EMEA financial services is indirect: DeceptiveDevelopment's shift to harvesting developer credentials and injecting code into source repositories is a supply-chain exposure that reaches any client whose software passes through those repositories, and it engages the DORA Art. 28 and NIS2 Art. 21(2)(d) supply-chain duties. The Iran-aligned resumption and the Belarus-aligned destructive shift are relevant to clients with Israeli, US or Ukrainian exposure. All of this is single-sourced to ESET's telemetry, and the subgroup and nation alignments are ESET assessments, so we will not treat them as confirmed attribution. We will pull the underlying ESET Threat Intelligence report for the DeceptiveDevelopment mechanics and any repository or credential artefacts, and reissue this advisory with concrete indicators and detection content if that detail is obtainable. --- [Read the original source →](https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*