ESET Research

#ESETresearch has uncovered Cereal, a previously undocumented modular .NET toolset used by the Russia-aligned #Turla #APTgroup to turn victims’ Microsoft Exchange servers into stealthy long-term collection points. welivesecurity.com/en/eset-resear… 1/6

#ESETresearch APT Activity Report (Apr–Sep 2026): Multiple 🇨🇳 operations appear to support efforts against scam compounds – the targeting of a hotel in 🇵🇼 Palau with a new backdoor, and #SlippyNunchucks deploying #DarkVigil against Chinese-speaking individuals in 🇱🇰 Sri Lanka. 1/3

#ESETresearch has uncovered a surveillance method used to target Chinese speakers abroad. The threat actor, 🇨🇳 China-aligned SlippyNunchucks, hijacked DNS resolution for Sogou Input Method traffic to facilitate malware delivery. welivesecurity.com/en/eset-resear… 1/7

#ESETresearch has identified #Gorbag, a Russia-aligned 🇷🇺 threat actor that uses simple infostealers and a reverse shell to harvest data from Ukrainian 🇺🇦 organizations near the front line: welivesecurity.com/en/eset-resear… 1/6

#ESETresearch APT Activity Report (Apr–Sep 2026): Russia-aligned APTs continued targeting 🇺🇦 Ukrainian defense, government, and infrastructure entities. #Gamaredon deployed #Turla’s new VBScript reconnaissance tool #Rezzuar – confirming continued FSB-linked collaboration. 1/4