Adversary Intelligence — 2026-05-31

Chinese APT Groups Exploit Iran War Disruption to Target Maritime and Energy Firms Across Middle East

BLUFBeijing's synchronized deployment of at least three APT groups across four continents signals coordinated intelligence tasking that will likely intensify against Gulf maritime and energy networks through late 2026.

ESET's APT Activity Report for October 2025 through March 2026, released May 28, documents signs of China-aligned groups mobilizing to improve Beijing's visibility into Gulf maritime and energy sectors following US military operations against Iran 123. FamousSparrow targeted a Venezuelan government entity responsible for maritime affairs following the January US military intervention there, with ESET assessing the campaign aimed to monitor oil shipment resilience 124. SteppeDriver compromised a Syrian government network in February 2026, assessed to reflect Chinese commercial interest in Syria's reconstruction and concern over Uyghur fighters integrating into Syrian security forces; NegativeGlimmer breached government entities in Cambodia and Panama as well as an AI and robotics firm in South Korea 14. ESET assessed the South Korean intrusion sought intellectual property aligned with Made in China 2025 industrial policy 124.

Analysis
Gulf maritime and energy sector firms are likely to face at least one additional documented Chinese APT intrusion by November 30, 2026. Moderate confidence rests on a single vendor's proprietary telemetry without cross-vendor corroboration, with apparent convergence across secondary outlets reflecting one underlying dataset. Simultaneous deployment of FamousSparrow, SteppeDriver, and NegativeGlimmer across four continents within six months indicates coordinated tasking driven by geopolitical disruption, though the pattern is consistent with separately tasked groups responding to independent ministry-level requirements with less unified strategic direction. Made in China 2025 sustains durable collection requirements against South Korean AI and robotics targets regardless of Gulf conditions. Gulf energy operators treating this as an episodic peak rather than a baseline accept continuous exposure as Beijing's collection tracks instability.

4 sources

ESET APT Activity Report Q4 2025–Q1 2026 - ESET / WeLiveSecurity
ESET Research APT Report: China-aligned groups spy in Venezuela and the Gulf, target AI robotics in S. Korea - GlobeNewswire
Chinese Hackers Exploit Iran War to Target Maritime and Energy Firms - Infosecurity Magazine
Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns - Help Net Security