Despite takedowns, law-enforcement efforts and geopolitical effects, Advanced Persistent Threats had continued to wreak damages and losses on the world.
Based on its internal research* on Advanced Persistent Threat activities from the Oct 2024 to March 2025 period, a cybersecurity firm has reported some findings to the public.
First, during the monitoring period, Russia-aligned threat actors such as Sednit and Gamaredon, had maintained aggressive campaigns primarily targeting Ukraine (critical infrastructure and governmental institutions) and EU countries. The Russia-aligned Sandworm group had intensified destructive operations against Ukrainian energy firms, deploying a new wiper named ZEROLOT.
Second, China-aligned threat actors were noted to have continued engaging in persistent espionage campaigns, with a focus on European organizations.
Other telemetry findings
In Asia, China-aligned APT groups had continued campaigns against governmental and academic institutions. Also:
- North Korea-aligned threat actors had significantly increased their operations directed at South Korea, placing particular emphasis on individuals, private companies, embassies, and diplomatic personnel. Mustang Panda remained the most active, targeting governmental institutions and maritime transportation companies via Korplug loaders and malicious USB drives. DigitalRecyclers continued targeting EU governmental entities, employing the KMA VPN anonymization network and deploying the RClient, HydroRShell, and GiftBox backdoors. PerplexedGoblin had used its new espionage backdoor against a Central European government entity, while Webworm had targeted a Serbian government organization using SoftEther VPN, a popularity tool among China-aligned groups.
- Elsewhere in Asia, North Korea-aligned threat actors were particularly active in financially motivated campaigns. DeceptiveDevelopment significantly broadened its targeting, using fake job listings primarily within the cryptocurrency, blockchain, and finance sectors. The Bybit cryptocurrency theft, attributed by the FBI to the TraderTraitor APT group, had caused losses of approximately US$1.5bn in this period.
- Other North Korea-aligned groups had seen fluctuations in their operational tempo: In early 2025, Kimsuky and Konni had returned to their usual activity levels after a noted decline at the end of 2024, shifting their targeting away from English-speaking think tanks, non-governmental organizations and North Korea experts to focus primarily on South Korean entities and diplomatic personnel. Also, Andariel had resurfaced after a year of inactivity, with a sophisticated attack against a South Korean industrial software company.
- Iran-aligned APT groups had maintained their primary focus on the Middle East region, predominantly targeting governmental organizations and entities within the manufacturing and engineering sectors in Israel. Additionally, there had been a significant global uptick in cyberattacks against technology firms during the monitoring period, largely attributed to increased activity by North Korea-aligned DeceptiveDevelopment.
According to Jean-Ian Boutin, Director of Threat Research, ESET, the firm releasing some of its data findings to the media: “The highlighted operations are representative of the broader threat landscape that we investigated during this period. They illustrate the key trends and developments, and contain only a small fraction of the cybersecurity intelligence data provided to customers…”
*based on proprietary telemetry and associated research on specific APT groups
