Targeting follows strategic value rather than exposure. The recurring targets: - Government and diplomacy. Ministries, embassies, and policy bodies. - Defence and its supply chain. Militaries and the contractors that build for them.

For most organisations, defending against a state actor is the same discipline as defending against any Advanced Persistent Threat, with a few additions. 1. Assume breach and hunt internally. Reduce dwell time and watch for lateral movement and credential abuse, because these actors live off the land once inside. 2. Ha

Nation-State Hacking: State-Sponsored Cyber Operations

When a government wants to know what a rival is planning, it no longer has to recruit a spy and smuggle out paper. It can task a team of operators to quietly read the target's email. Cyber capability has become a standard instrument of statecraft, sitting alongside diplomacy, sanctions, and the military. Every capable state now runs offensive cyber programmes, and the good ones are very good.

Nation-state hacking is cyber activity that a government runs or directs to serve national interests. That framing matters. The operator is not chasing a payday, they are executing policy, and that difference shapes everything about how they behave.

Who actually does the hacking

"The state did it" hides a range of arrangements. State-linked operations sit on a spectrum of directness.

Direct units. Intelligence agencies and military commands with their own operators, tooling, and tasking. The most disciplined operations look like this.
Contractors. Private companies hired by the government to build tools or run operations, which adds capacity and a layer of deniability.
Proxies and tolerated criminals. Criminal groups permitted to operate, sometimes tasked, sometimes simply left alone as long as they hit useful targets and not domestic ones. This blurs the line between crime and statecraft on purpose.

The proxy model is why attribution gets slippery. A government can benefit from an intrusion while keeping enough distance to deny ordering it. The intent is served either way.

The four goals of state operations

State cyber activity serves national objectives that group into four broad goals.

Goal	What it looks like	Typical intent
Espionage	Quiet theft of secrets and data	Intelligence advantage, faster R&D, negotiating leverage
Sabotage	Disruption or destruction of systems	Degrade an adversary's capability, send a signal
Influence	Manipulating information and opinion	Shape elections, sow division, discredit
Financial	Theft to raise revenue	Fund the state under sanctions

Espionage is the largest category by volume. Stealing information is lower-risk than destroying it and almost always more useful. Political and military intelligence, trade negotiation positions, defence technology, and commercial research all get collected. Economic espionage (stealing intellectual property to shortcut a domestic industry's development) is a major and persistent strand.

Sabotage is rarer because it is escalatory and reveals capability. When it happens it targets things that hurt: industrial control systems, power and water, and other operational technology. A recurring and quieter form is pre-positioning, where operators establish access to critical infrastructure and simply hold it, so disruption is on the shelf if a conflict starts. The intrusion looks like espionage until the day it does not.

Influence operations use cyber means to shape what people believe: hacked material leaked at a chosen moment, coordinated inauthentic accounts, and amplification of divisive content. The target is public opinion rather than a network.

Financial operations are the odd one out, run mainly by heavily sanctioned states that use cyber theft to raise hard currency. These campaigns pursue banks, cryptocurrency exchanges, and individual holders with state-level patience and resourcing, which makes them unusually dangerous compared with ordinary financial crime.

Who gets targeted

Targeting follows strategic value rather than exposure. The recurring targets:

Government and diplomacy. Ministries, embassies, and policy bodies.
Defence and its supply chain. Militaries and the contractors that build for them.
Critical infrastructure. Energy, water, transport, healthcare, and financial systems.
Technology and research. Firms and universities holding valuable intellectual property.
Telecommunications. Carriers, because they offer access to communications at scale.
Suppliers and managed service providers. A single compromised vendor can open the door to many downstream victims, which is why supply-chain intrusion has become a favoured route.

Journalists, dissidents, and diaspora communities are also persistent targets for states focused on internal control, a category ordinary criminals have no reason to pursue.

The main sponsoring regions

At a conceptual level, capable offensive cyber programmes are concentrated in a handful of regions, each with a recognisable emphasis that reflects national priorities rather than any single event.

Large state programmes focused on scale and economic espionage. Broad collection across technology, industry, and government, often prioritising intellectual property that accelerates domestic industries.
Technically advanced programmes focused on strategic intelligence and disruption. Smaller in volume, high in tradecraft, aimed at political, military, and infrastructure targets.
Sanctioned states running financial operations. Programmes that blend espionage with revenue-raising theft to offset economic isolation.
Regional powers with growing capability. Focused primarily on neighbours, rivals, and domestic dissent.

These are patterns, not accusations tied to any current event. The point for a defender is that the region a group is attributed to tells you something about its likely goals and targets, which helps you judge whether you are in scope.

Attribution is a judgement, not a verdict

Naming the government behind an intrusion combines tradecraft analysis, targeting patterns, and technical indicators into a stated confidence level. States actively muddy this with proxies, shared tooling, and false flags. Treat public attributions as evidence-weighted assessments, and note the confidence language, not as courtroom proof.

How states differ from criminals

State and criminal operators sometimes use the same techniques, so the difference is in constraints and objectives rather than raw method.

Dimension	Criminal	Nation-state
Motive	Profit	National interest
Patience	Weeks	Months to years
Cost tolerance	Low, burn nothing valuable	High, will spend rare exploits
Legal risk at home	Prosecutable	Protected, acting for the state
Toolkit	Reused kits and commodity malware	Custom tools plus commodity where it suffices
Combined power	Cyber only	Cyber plus diplomacy, sanctions, military

The legal immunity point is underrated. A criminal fears arrest and shapes operations around it. A state operator working for their own government does not, which lets them run longer, more aggressive campaigns and treat access as a durable strategic asset. States also fold cyber into a larger toolkit, timing an intrusion to a diplomatic moment or pairing it with other pressure in ways a criminal never would.

How to defend

For most organisations, defending against a state actor is the same discipline as defending against any Advanced Persistent Threat, with a few additions.

Assume breach and hunt internally. Reduce dwell time and watch for lateral movement and credential abuse, because these actors live off the land once inside.
Harden the supply chain. Vet vendors and managed service providers, and monitor the access you grant them. Supply-chain intrusion is a preferred route precisely because it bypasses your perimeter.
Protect critical operational technology. Segment industrial and control systems from IT networks, and treat quiet, long-lived access to them as the pre-positioning risk it is.
Follow government advisories for your sector. National agencies publish specific technical guidance on active state campaigns. If you run infrastructure, this is not optional reading.
Map known techniques to detections. Identify which groups target your sector and engineer detections against their documented behaviours.

To see which state-linked groups target which sectors, along with their aliases and known operations, our Threat Groups directory tracks the actors so you can focus on the ones aligned with your industry and region.

How a state operation typically unfolds

State campaigns follow a recognizable lifecycle, and mapping it helps a defender understand where they might see the actor and where they might intervene. The stages align with the phases in the MITRE ATT&CK framework, which catalogs the specific behaviors under each.

Target selection and tasking. The operation begins with a national objective, not a target of opportunity. A collection requirement, for example a particular ministry's negotiating position or a defense program's designs, is handed down, and operators work backward to who holds that information.
Reconnaissance. Operators study the target's people, technology, and suppliers, often patiently, building a picture of the attack surface including third parties that touch the target.
Initial access. Entry commonly comes through spearphishing tuned to specific individuals, exploitation of an internet-facing service, or a supply-chain compromise that reaches the target through a trusted vendor. State actors will spend a rare, unpublished exploit here when the target justifies it.
Establishing a foothold and persistence. Once inside, the actor installs durable access designed to survive reboots and password changes, frequently blending into legitimate tools and processes to avoid drawing attention.
Privilege escalation and lateral movement. The operator expands quietly, harvesting credentials and moving toward the systems that actually hold the objective, often living off the built-in administrative tools of the environment to avoid dropping detectable malware.
Collection or effect. For espionage, this is the slow, careful gathering and staging of data. For sabotage or pre-positioning, it is the placement of access or capability against a future decision to act.
Exfiltration and dwell. Data leaves over channels chosen to blend with normal traffic, and the actor often remains inside for months, returning to collect as the target's information changes.

The two features that distinguish this lifecycle from a criminal intrusion are patience and objective. A criminal wants to monetize access quickly and move on. A state operator will sit quietly for a long time because the value is the sustained access itself, and because the tasking rewards completeness over speed.

Living off the land is the norm, not the exception

The most capable state operators avoid custom malware wherever built-in administrative tools will do the job. Using the same utilities administrators use for remote management, scripting, and credential handling lets the intrusion hide inside expected activity. This is why signature-based detection alone misses well-run state operations, and why behavioral detection and internal hunting matter so much against them. The absence of obvious malware is not evidence of safety.

A worked scenario: supply-chain reach

Consider how a state actor reaches a hardened government target through a softer supplier, a pattern that has made supply-chain intrusion a preferred route.

The final objective is a defense ministry with strong perimeter security and mature monitoring. Attacking it head-on is expensive and noisy. The operator instead studies the ministry's vendors and identifies a smaller software supplier whose product runs inside the ministry with elevated trust. That supplier has weaker defenses and less scrutiny. The operator compromises the supplier, then uses the trusted relationship, a software update, a maintenance connection, or shared credentials, to cross into the ministry inside traffic the ministry already trusts. The perimeter that would have stopped a direct attack waves the vendor through, because trusting the vendor is the whole point of the relationship.

The defensive lesson is that the target's own security is not the boundary of its risk. Every vendor and managed service provider with trusted access extends the attack surface, and a state actor will find the weakest link in that chain deliberately. This is why vendor scrutiny and monitoring the access granted to third parties are not compliance chores but core defenses against capable actors.

Detecting state-level activity

State operations are harder to catch than commodity crime because the actor is patient and quiet, but they are not invisible. The signals lean behavioral.

Low-and-slow anomalies. Small, patient deviations, an account authenticating at unusual hours, a slow trickle of data to an unfamiliar destination, matter more than loud events. The tradecraft is designed to avoid thresholds, so baselining normal behavior and investigating quiet outliers is central.
Abuse of legitimate tools. Administrative utilities being used in unusual sequences, from unusual hosts, or by accounts that do not normally perform administration, is a hallmark of living off the land. Detection means understanding who legitimately uses which tools.
Credential misuse and lateral movement. Reused credentials appearing across systems, and authentication paths that do not match normal work patterns, indicate an actor expanding quietly inside.
Persistence in unexpected places. Durable access mechanisms placed in scheduled tasks, services, or startup paths that no administrator created point to an actor establishing a foothold.
Traffic that blends but does not quite fit. Exfiltration channels chosen to look normal often still deviate in volume, timing, or destination when compared against a real baseline.
Targeting of individuals. For states focused on internal control, the target set itself is a signal. Journalists, dissidents, and diaspora members being probed is a pattern ordinary crime has no motive to produce.

Common misconceptions

"Only large organizations are targets." Small suppliers, contractors, and individuals are routinely targeted precisely because they are the path to a larger objective or because they personally hold intelligence value. Size is not a shield.
"Nation-state means unstoppable." Capable actors are patient and well-resourced, but they still rely on ordinary footholds like phishing and unpatched services, and they still have to move laterally and persist in ways that disciplined defense can detect and disrupt. Fundamentals raise their cost meaningfully.
"Attribution names the culprit with certainty." Public attribution is a weighted assessment built from tradecraft, targeting, and infrastructure, and states actively muddy it with proxies, shared tools, and false flags. It carries a confidence level, and reading that confidence is part of using it responsibly.
"It always involves exotic zero-day exploits." States hold rare exploits and spend them on hard targets, but most intrusions begin with mundane access and commodity techniques. Reserving your defenses for exotic threats leaves the common door open.
"Financial motive rules out a state." Some heavily sanctioned states run revenue-raising theft as policy, so financial gain and state sponsorship are not mutually exclusive. The scale, patience, and resourcing behind such theft distinguish it from ordinary financial crime.

How state cyber operations developed

Offensive cyber began as an extension of signals intelligence, a quieter way to collect the communications and documents that agencies had always sought. As dependence on networks grew, the same access that served espionage started to offer the option of disruption, and states began treating quiet, long-lived access to critical infrastructure as a strategic asset to hold in reserve. Influence operations emerged as social platforms made public opinion directly reachable, adding a third goal alongside collection and disruption. Sanctioned states, cut off from normal finance, turned cyber theft into a revenue stream, folding a fourth goal into the picture. Across this evolution the organizational model diversified, from tightly controlled military and intelligence units to contractors and tolerated criminal proxies that add capacity and deniability. The constant is that cyber capability became a standard instrument of statecraft, used in concert with diplomacy, sanctions, and military power rather than in isolation, and defenders now have to reason about intent and national objective, not just technique.

Deniability, proxies, and false flags

The proxy model deserves a closer look, because it is central to how states use cyber capability while limiting the political cost. A government that wants an outcome, the theft of a design, the disruption of a rival's service, does not need to run the operation with its own uniformed operators. It can task a contractor, tolerate a criminal group that already has the capability, or simply let a nominally independent group act in a direction that serves the state. Each layer of separation buys deniability. The intent is served whether the state pressed every key or merely created the conditions and looked away.

False flags push this further. Operators can plant indicators that point at a different actor: reuse another group's tools, embed language or time-zone artifacts associated with someone else, or route through infrastructure a rival is known to favor. Because attribution is assembled from exactly these kinds of clues, a well-placed false flag can steer analysis toward the wrong government, at least for a while. Defenders and analysts counter this by weighting many independent signals together and by treating any single, conveniently obvious indicator with suspicion, since the easiest clue to plant is the one that names a scapegoat.

For a defender, the practical consequence is that the label on an intrusion matters less than the behavior. Whether a given campaign is run by a direct military unit, a contractor, or a tolerated criminal proxy, the techniques you detect and the controls that disrupt them are largely the same. The attribution question matters for policy and for judging who might target you and why, and the defensive question is answered by the discipline you apply regardless of who is behind the keyboard.

Do not build defenses around a single attribution

It is tempting to read a public report naming a specific government and to shape defenses around that one actor. Attribution shifts, proxies share tooling, and false flags exist to mislead exactly this instinct. Use attribution to understand which sectors and goals put you in scope, then defend against the behaviors, not the name. A control that only works if the report named the right country is a fragile control.

Frequently asked questions

What separates a nation-state actor from an advanced criminal group? Objective and constraint. A criminal pursues profit and fears prosecution, which shapes fast, monetizable operations. A state operator executes policy, enjoys protection at home, tolerates high cost, and can combine cyber with other instruments of national power, which supports patient, long-lived campaigns.

Why is espionage more common than sabotage? Stealing information is lower-risk and usually more useful than destroying it. Sabotage reveals capability and can escalate a conflict, so states reserve it, while quiet collection can continue for years and serve many objectives.

What is pre-positioning? Establishing and holding access to critical infrastructure without acting on it, so that disruption is available on short notice if a conflict starts. Such an intrusion looks like espionage until the day it is used, which is what makes quiet, long-lived access to operational technology so serious.

How should a normal company defend against a state actor? Largely with the same discipline used against any advanced persistent threat: assume breach and hunt internally, reduce dwell time, enforce least privilege, and patch exposed services. Add supply-chain scrutiny and follow your sector's government advisories, because those address the routes state actors specifically favor.

Can you ever be certain which government is behind an attack? Rarely with courtroom certainty. Attribution is an evidence-weighted judgment expressed as a confidence level, and states deliberately blur it with proxies and false flags. Treat named attributions as assessments and note the stated confidence.

Do state actors only use custom malware? No. Capable actors prefer to live off the land, using built-in administrative tools that blend into normal activity, and reserve custom or rare tools for situations that require them. This is why behavioral detection outperforms signature matching against them.

Are individuals ever direct targets? Yes. Journalists, dissidents, diaspora communities, and specific officials or researchers are persistent targets for states focused on internal control or high-value intelligence. The personal target set is itself a signal of state, rather than criminal, interest.

Why do states use criminal proxies at all? Proxies add capacity and deniability. A tolerated criminal group brings existing capability the state can benefit from, while the separation lets the government deny ordering the operation. The intent is served whether the state ran it directly or simply created the conditions and looked away, which is what makes the crime-and-statecraft line intentionally blurry.

State-sponsored hacking is policy carried out through networks. Understanding the goal behind an intrusion (steal, disrupt, influence, or fund) tells you far more about what a given actor will do next than any single piece of malware ever will.