It has almost been six months since Russia invaded Ukraine, and understandably, the world and its media have focused on this region. Since the onset of the war, there has been a resurgence of hacktivism, with the pro-Russian hacktivist group Killnet taking center stage. Threat groups like Wizard Spider and APT28 have also been observed conducting cyber threat campaigns against Ukraine. So, while attention focuses on Russia-based and pro-Russia threat groups, now is an excellent time to take a quick run-back through the other nations with highly developed cyber capabilities, outlining some key geopolitical points and previous cyber threat campaigns along the way.

The People’s Republic of China (PRC)

Unsurprisingly, the PRC takes the top spot when it comes to offensive cyber capabilities. The PRC’s cyber strategy indicates a preference for avoiding direct confrontation, which makes cyber espionage a central part of its intelligence agenda. Most PRC-linked cyber attacks focus on intelligence property and proprietary information theft. 

The PRC regularly uses cyber operations to pursue its national interests and has several advanced persistent threat (APT) groups at its disposal to perform attacks. These groups are among the world’s most sophisticated, technically capable, and persistent cyber-threat groups. For example, the “Winnti” threat umbrella has targeted multiple companies across the globe to obtain intellectual property valuable to the PRC-state, while the APT group “APT40” has targeted many universities in the US, Canada, and South-East Asia involved in nautical technology research. This activity aims to further the PRC’s naval modernization efforts. Also, since at least 2006, the PRC-linked APT group “APT1” has conducted cyber intrusions into 141 organizations globally to obtain “hundreds of terabytes” of data. 

PRC-linked threat groups also use supply-chain attacks to achieve their aims. However, these attacks do not always generate the same media attention as, for example, the Russia-linked attack that used SolarWinds’ Orion Platform. In rare instances, some Chinese state-affiliated threat actors have conducted financially motivated cyber operations. “APT41” targeted the video game industry and manipulated virtual currencies to gain funds that were likely laundered on underground criminal platforms. At the same time, the APT group “APT27” targeted five online gambling firms in 2020 to deploy ransomware and extort their victims for financial gain. 

Iran

Iran has greatly advanced its cyber capabilities over the past ten years. Although it remains less technically capable than the PRC and Russia, its attack campaigns are often successful, notably by relying on relatively simple tactics that still bypass even the most organized defenses. 

Like most nation-states, Iran aims to obtain intellectual property advantageous to the state. Such information typically supports Iran’s endeavors, like retaliating against sanctions and previous attacks or establishing dominance in the Middle East. Primarily, attacks are focused on countries that have a strained geopolitical relationship with Iran, such as the US and Israel. The attackers are usually threat groups directly associated with the Iranian state or indirectly affiliated proxy threat groups; proxy groups take responsibility for the attack, allowing Iran to avoid international condemnation.

Iran-linked threat actors are likely involved in the operations of several different groups; there is evidence of overlapping infrastructure and tool/technique sharing. There are three main APT groups associated with the Iranian state: “APT35” (aka Charming Kitten), “APT34” (aka OilRig, Helix Kitten), and “MuddyWater” (aka TEMP.zagros). APT35 has conducted information-gathering campaigns in North America, the UK, and the Middle East since at least 2017, targeting individuals working in or covering issues that overlap with Iranian national security interests. APT34 is primarily active in the Middle East, targeting sectors such as financial services, government, education, telecommunications, and oil and gas. MuddyWater has also been active since at least 2017, targeting various sectors in Asia and the Middle East, likely to conduct espionage operations. 

North Korea

Like Iran, North Korea has a less developed offensive cyber capability when compared with Russia, the PRC, or the US. Despite this, a relatively large number of cyber attacks originate from the nation-state. North Korea has shown a propensity to conduct cyber attacks during a crisis—likely for disruption, espionage, and financial gain—and will highly likely continue such attacks until the state’s goals have been satisfied. In 2020, the US Cybersecurity and Infrastructure Agency (CISA) issued an advisory on North Korean cyber threats, stating that the nation-state was increasingly relying on cybercrime to generate revenue that would fund its weapons-of-mass-destruction and ballistic-missile programs. This move was likely implemented to overcome international sanctions imposed to prevent North Korea from achieving this objective.

Famed for its WannaCry attack on over 200,000 devices worldwide, the North Korea-linked “Lazarus Group” has also been responsible for several financially motivated cyber attacks. The group has conducted several high-profile campaigns designed to steal cryptocurrency, typically distributing spearphishing emails containing fake job advertisements tailored to the recipients’ specific skills and experience. Lazarus Group has targeted cryptocurrency and financial services entities in at least 14 countries globally since at least 2016, likely for financial gain. Lazarus Group will almost certainly continue targeting cryptocurrency platforms in the medium term, as cryptocurrency platforms often fall short in security, leaving investors susceptible to fraud.

Although relatively less advanced, North Korea’s technical capability has developed relatively quickly. APT groups linked to the nation-state have refined initial access techniques and demonstrated an in-depth knowledge of targets and their systems. Other notable threat groups operating in North Korea include “APT37” and “Kimsuky”. 

Israel

Israel, with its innovative and advanced technology scene and its proactive military-intelligence capability, has one of the most advanced cyber-security and cyber-defense programs in the world. The primary motive behind Israel-initiated cyber-threat activity is likely combatting multiple threats from other nation-states and terrorist groups. Many of Israel’s cyber attacks aim to hinder Iran-sponsored militant groups and reduce the offensive capabilities of Iranian groups and their allies. 

Although there is limited publicly available information about the activities of Israel’s intelligence agency, many cyber-attacks are politically motivated and aimed at providing advantage, be that political, strategic, or military, over Israel’s adversaries. In 2010, the Stuxnet worm was used to cause substantial disruption to Iran’s nuclear program, destroying one-fifth of Iran’s nuclear centrifuges and compromising more than 200,000 computers. Stuxnet targets SCADA systems and has been widely reported (but not confirmed by either nation) to have been jointly developed as a cyber-weapon by the US and Israel in a large, collaborative effort known as Operation Olympic Games.

Additionally, the Israeli technology company NSO Group is best known for developing the “Pegasus” spyware, which can be used for cyber espionage. Pegasus has reportedly been sold to several nation-states and groups that have used the software to surveil human-rights activists, journalists, and dissidents. Pegasus has been found on computers in the UK prime minister’s office and has also been used to target activists in Catalan and Bahrain.

The US

While the US is highly unlikely to target private organizations, its cyber capability is one of the most developed in the world; in a 2021 study, the US was ranked the world’s top cyber superpower. The US’s advanced cyber capabilities are well organized and are designed to defend against and deter attacks from other regional superpowers, notably the PRC and Russia. The US has invested heavily in its cyber capabilities, and many domestic government entities regularly issue directives to help users and businesses bolster their cyber defenses. Despite this, many US organizations operate with networks vulnerable to compromise, making the US an ever-popular target for many cyber-threat actors. Such attacks have spurred the US to harden its defenses further and improve its capabilities in anticipation of new attacks from its rivals.    

US-initiated cyber-attacks are typically conducted to defend its critical infrastructure and are seldom reported in the mainstream media. The biggest insight into offensive cyber activity conducted by the US came from documents leaked by Edward Snowden in 2013, a former employee of the US CIA. The leaked documents revealed that the NSA had reportedly been collecting the telephone records of tens of millions of Americans, as well as intercepting the servers of nine Internet providers to track online communications. Later, Snowden claimed the NSA had led more than 61,000 offensive cyber operations globally, including many targeting or affecting Hong Kong and the mainland PRC. 

While the threat from Russia-linked threat actors—cybercriminal, nation-state, and hacktivist—isn’t going anywhere any time soon, it’s good to remember that threats emanate from a variety of countries with highly developed offensive cyber capabilities. Some nation-states might even take advantage of the Russia-Ukraine war, using it as cover, so their activity flies under the radar. If you want to read more about any of the threat groups mentioned in this blog, why not take a seven-day SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) test drive. You can also get a customized demo of SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) to understand your organization’s threats and risks, including access to a fully furnished threat intelligence library with MITRE associations and mitigations from the Photon Research Team.