MEDIUMApt
Global

ESET APT Activity Report Q2 2026–Q3 2026

·Source: WeLiveSecurity (ESET)

Updated:

Executive Summary

An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2026 and Q3 2026

Analysis

An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2026 and Q3 2026
Source Attribution

Originally published by WeLiveSecurity (ESET) on Oct 28, 2026.

Related Threats

MEDIUMApt

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...]

CVE-2026-20127
BleepingComputer
CRITICALApt

Siemens Mendix SAML Module

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-302-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has

CVE-2026-89209
CISA Advisories
CRITICALApt

Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls

Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the

CVE-2026-76418
The Hacker News