ESET APT Activity Report Q2 2025–Q3 2025 www.welivesecurity.com/en/eset-r…
ESET APT Activity Report Q2 2025–Q3 2025 summarizes notable activities of selected advanced persistent threat (APT) groups that were documented by ESET researchers from April through September 2025. The highlighted operations are representative of the broader landscape of threats we investigated during this period. They illustrate the key trends and developments and contain only a small fraction of the cybersecurity intelligence data provided to customers of ESET APT reports.
Sandworm, similar to Gamaredon, focused on Ukraine – albeit with motives of destruction rather than cyberespionage. The group deployed data wipers (ZEROLOT, Sting) against governmental entities, companies in the energy and logistics sectors, and, more notably, against the grain sector – the likely objective being the weakening of the Ukrainian economy.
