ESET APT Report 2026: Security Priorities for Businesses

Advanced persistent threat (APT) activity is often described as a problem for governments and defence organisations. That framing is too narrow for Hong Kong businesses. Organisations across financial services, logistics, professional services, technology and manufacturing depend on trusted identities, cloud services, suppliers and software workflows that can also provide an entry point for a targeted attacker.

ESET Research’s APT Activity Report published on 28 October 2026 reviews selected campaigns observed from April to September 2026. It describes renewed activity from several Iran-aligned groups, closer operational alignment between Belarus- and Russia-aligned actors, continued targeting of government and strategic industries by China-aligned groups, and attacks against technology, cryptocurrency and software-development ecosystems linked to North Korea-aligned actors. Researchers also observed threat actors using AI and large language models to speed up tasks such as malware development and the creation of decoy websites. ESET said its telemetry did not indicate that AI had fundamentally transformed the APT landscape over the six-month period.

For Hong Kong security leaders, the report is best treated as a planning input rather than a claim that every named campaign is targeting local companies. The practical lesson is that targeted intrusions can combine familiar techniques—phishing, stolen credentials, malicious code and supplier access—with patient reconnaissance and destructive follow-on activity. Defences should therefore be designed around how an attacker could move through the business, not only around a list of malware names.

What the latest APT reporting signals

1. Strategic sectors remain attractive targets

ESET observed China-aligned activity involving government targets and organisations in Taiwan’s semiconductor industry. Other activity covered strategic industries, public-sector entities and regional campaigns associated with intelligence collection. These observations reinforce a long-standing pattern: attackers may pursue information that has commercial, political or operational value, rather than seeking an immediate financial payoff.

Hong Kong organisations do not need to operate a semiconductor plant or government department to face related risk. A company may hold customer records, transaction information, legal documents, shipping data, intellectual property or privileged access to a larger partner. The value of that information depends on the attacker’s objectives. A supplier with broad access can become a route into a more attractive target.

2. Threat groups may cooperate across stages of an intrusion

The report describes increasing similarities between Russia-aligned and Belarus-aligned operations, including a destructive attack against a Ukrainian manufacturing company. It also notes that different groups can play different roles in an intrusion. One actor may establish access or collect intelligence, while another uses that foothold for a more disruptive operation.

This is a reminder not to treat an initial compromise as a self-contained incident. An account or endpoint that appears to have been used for reconnaissance may later support lateral movement, data theft or sabotage. Detection and response procedures should consider the full attack path and preserve evidence even when the first observed activity appears limited.

3. Developer ecosystems and supply chains need protection

ESET reported North Korea-aligned activity against technology and cryptocurrency companies, software developers and other opportunistic targets. The report also describes a shift by one group from fake job-interview lures toward broader software supply-chain compromises, including the theft of developer credentials and attempts to inject malicious code into repositories.

For Hong Kong businesses that build software, customise applications or rely on external developers, this is a direct governance concern. A developer account can hold access to source code, build pipelines, package registries, cloud environments and production secrets. Protecting office laptops alone is not enough if an attacker can use a compromised development identity to alter trusted software or access deployment systems.

4. AI is an accelerator, not a reason to abandon fundamentals

ESET researchers found examples of AI and large language models being used to accelerate malware development, create decoy websites and assist with other labour-intensive tasks. They also observed AI-generated images in phishing lures. At the same time, ESET said the activity it reviewed remained largely hands-on-keyboard rather than fully autonomous.

Businesses should prepare for more polished lures and faster iteration, but there is no need to assume that every attack is an autonomous AI operation. Email security, identity controls, endpoint monitoring, secure software development and effective incident response remain foundational. Staff training should also acknowledge that grammar, tone and visual quality are no longer reliable ways to judge whether a message is legitimate.

What Hong Kong buyers should prioritise

Map critical assets and privileged access

Start with a practical inventory of business-critical systems, sensitive data, internet-facing services, cloud tenants, remote administration tools and third-party connections. Identify which identities can reach each asset, especially administrator accounts, service accounts, developer identities and vendor accounts. Where possible, assign a business owner to each critical system and document its recovery requirements.

The objective is to answer three questions quickly: what must remain available, which identities can change it, and how would the organisation detect unauthorised access? If these answers are scattered across spreadsheets and teams, an incident will be slower and more expensive to contain.

Strengthen identity before adding more tools

Require multi-factor authentication for remote access, email, cloud administration, code repositories and other high-value services. Prefer phishing-resistant methods where the platform and business workflow support them. Remove standing administrative privileges that are not necessary, separate everyday accounts from privileged accounts, and review access when staff change roles or leave.

Monitor unusual sign-ins, repeated authentication failures, new device registrations, unexpected privilege changes and access from unfamiliar locations or services. A single alert may be ambiguous; a sequence of identity events across email, endpoints and cloud applications can provide a much clearer picture of an intrusion.

Make endpoint and server visibility actionable

Ensure that laptops, servers and other supported workloads are covered by centrally managed endpoint protection and detection controls. Define who reviews high-severity alerts, what evidence must be collected, and who has authority to isolate a device. Test whether the security team can investigate suspicious process execution, persistence, credential access and unexpected administrative activity without waiting for the affected user to explain what happened.

Coverage matters, but operational readiness matters just as much. A tool that generates alerts without an assigned owner or response process may create confidence without reducing risk. Buyers should ask vendors to demonstrate investigation workflows and show how an alert becomes a documented action.

Protect the software delivery chain

For development teams, require MFA on code-hosting and build systems, use role-based access, and remove credentials from source code. Store secrets in managed secret stores, rotate them when exposure is suspected, and restrict which identities can publish releases or change pipeline configuration. Review third-party libraries and build dependencies according to the risk of the application, and preserve logs for code changes, token use and release activity.

Separate development, test and production environments so that compromise in one does not automatically grant access to the others. Where feasible, require peer review for sensitive changes and protect release branches. These controls reduce the chance that a stolen developer credential can silently turn into a production incident.

Prepare for data theft and destructive activity

Use least privilege to limit the amount of data an account can access, and monitor unusual bulk downloads, archive creation, file transfers and changes to backup systems. Maintain backups that are isolated from routine administrator credentials and test restoration on a schedule. Backups are only useful if the organisation can restore systems and data within an agreed recovery window.

Include scenarios in which an attacker first steals information and then attempts to disrupt operations. A response plan should cover technical containment, legal and privacy assessment, executive decisions, communications with customers and suppliers, and coordination with relevant authorities where appropriate. In Hong Kong, organisations should align these plans with their sector obligations and internal incident-reporting requirements rather than assume that one generic playbook fits every business.

How to evaluate a security platform or service

When assessing an endpoint security, extended detection and response, managed detection and response, or threat-intelligence offering, Hong Kong buyers should look beyond feature lists. Ask suppliers to explain how their service supports the organisation’s specific risks and operating model.

• Coverage: Which operating systems, workloads and user groups are supported? What gaps remain for contractors, servers, cloud workloads and remote endpoints?
• Detection context: Can analysts connect endpoint activity with identity, network and cloud signals, or will teams have to correlate separate consoles manually?
• Response authority: Can the service isolate a device or disable a credential? Who approves disruptive actions, and how is evidence preserved?
• Threat intelligence: How are indicators and research translated into detections, hunting hypotheses and practical recommendations? How frequently is intelligence updated?
• Operations and support: What are the response hours, escalation routes, service-level commitments and language requirements? Who owns an incident outside normal office hours?
• Data handling: Where is telemetry stored and processed, who can access it, how long is it retained, and how can the organisation export relevant records for investigations or audits?
• Proof of value: Can the supplier demonstrate a realistic attack scenario and explain the evidence available at each stage? Request a pilot with measurable outcomes rather than relying only on a presentation.

ESET’s reporting is based on its own telemetry and researcher analysis, and the company offers threat-intelligence resources for organisations that need more detailed insight into targeted campaigns. Buyers should confirm the scope, availability, licensing, support model and regional fit of any product or service directly with the vendor or its authorised local partner. The appropriate choice depends on the organisation’s existing controls, staffing, risk appetite and regulatory context.

A practical 30-day action plan

Week 1 — Establish the picture. Identify critical systems, privileged identities, external connections and the people responsible for incident decisions. Confirm that endpoint and server coverage is current, and identify assets that are missing from central monitoring.

Week 2 — Close common access gaps. Enforce MFA on high-value accounts, remove unnecessary privileges, review vendor access and disable dormant accounts. Check that security logs are enabled for email, identity providers, cloud administration and code repositories.

Week 3 — Test detection and recovery. Walk through a scenario involving a phishing email, a compromised account, suspicious endpoint activity and attempted data theft. Verify alert routing, evidence collection, device isolation, backup integrity and recovery responsibilities.

Week 4 — Improve supplier assurance. Review the access granted to IT providers, software developers and other critical suppliers. Ask for evidence of their access controls, incident-notification process and ability to support an investigation. Record gaps with owners and due dates.

Turn threat intelligence into operating decisions

The latest ESET APT reporting does not suggest that Hong Kong businesses should chase every named threat group or buy a tool for every new technique. It shows why organisations need durable controls that withstand changes in an attacker’s identity, infrastructure and methods. Targeted operations can combine social engineering, stolen credentials, developer access, AI-assisted content and destructive follow-on actions. A resilient defence links identity, endpoint visibility, software delivery, backups and incident response into one operating process.

For Hong Kong buyers, the next step is to translate the intelligence into a short list of measurable improvements: reduce privileged access, improve telemetry on critical systems, protect developer identities, rehearse containment and verify recovery. Those improvements make the organisation better prepared whether the next incident is driven by a state-aligned group, a financially motivated criminal or a compromised supplier.