ESET says Iran’s own internet restrictions degraded its hackers before they came back

ESET’s APT Activity Report for Q2–Q3 2026, published on 28 October and covering April through September, records an increase in Middle East-aligned activity that the firm says was “driven mainly by the return of several established Iran-aligned groups.” It names two: FilthyFeline, which ESET treats as a subgroup of the cluster commonly tracked as OilRig, and MuddyWater. Both resumed operations during the period, “with most activity directed at entities in Israel across multiple sectors,” according to the report. The analytically significant line is ESET’s account of why these groups had gone quiet in the first place. Internet restrictions imposed by the Iranian government, the firm writes, “hindered their own ability to operate effectively” — a domestic information-control measure that degraded the state’s own offensive reach alongside everyone else’s connectivity.

This is a single-vendor finding, derived from ESET’s own telemetry and its own naming conventions, and it has not been independently corroborated by a second research house inside this reporting window. ESET does not publish, in the material available, a measure of how much activity fell or by how much it recovered, nor does it tie the restrictions to specific dates or specific shutdown events. The Files has not yet cross-checked the claim against the public connectivity trackers — NetBlocks, IODA, Access Now — or against Israeli National Cyber Directorate advisories, none of which were reached in this sweep. Until that is done, what exists is a vendor’s causal explanation for a gap in its own visibility, which is not the same thing as a measured gap in Iranian operations.

Assessment: If ESET is right, it prices something states rarely admit: the kill switch is not free. A government that throttles its national internet to manage a domestic political moment is also throttling the infrastructure its own operators route through, and the bill arrives as months of lost access and rebuilt tooling. Treat the word “return” carefully, though. A group that reappears in one vendor’s telemetry may have been working the whole time through infrastructure that vendor cannot see. The claim worth testing is not whether MuddyWater is active — it almost always is — but whether the lull was real or was an artefact of where ESET’s sensors sit.