Skip to content

Back to the catalog

ESET Research (@ESETresearch) on X
x.comthread

ESET Research (@ESETresearch) on X

ESET Research thread summarising its APT Activity Report for April to September 2026 on Russia-aligned groups targeting Ukrainian defense, government and infrastructure. Gamaredon deployed Turla's new VBScript recon tool Rezzuar, indicating FSB-linked collaboration, and updated its file stealer PteroBox while activity fell sharply from mid-May. A separate campaign hit MDaemon mail servers via CVE-2025-8088, delivering HELLAGE and HELLTAG backdoors with no user interaction.

TL;DR ESET thread on its April to September 2026 APT report: Gamaredon using Turla's Rezzuar, PteroBox updates, and an MDaemon exploitation campaign delivering HELLAGE and HELLTAG.
Open original ↗

Organisations named here

  • ESET
  • FSB

CVEs named here

  • CVE-2025-8088

Technologies named here

  • ClamAV
  • WinRAR
  • MDaemon
  • MDaemon mail servers
  • VBScript

Techniques named here

  • Exploitation of vulnerability in mail server (CVE-2025-8088 in ClamAV, originally a WinRAR flaw)
  • VBScript reconnaissance

Concepts named here

  • APT Activity Report (Apr–Sep 2026)
  • Shared tooling across FSB-linked groups

Threat actors named here

  • Gamaredon
  • HELLAGE
  • HELLTAG
  • PteroBox
  • Rezzuar
  • Turla

Related in Threat Intel