The study showed that during 2020-2025, the scale of cyberattacks carried out by states or cyber groups loyal to them increased significantly, and the methods and approaches to their implementation evolved significantly, marking the beginning of a new stage of interstate conflicts in the global digital space.
The main features of cyberattacks in support of states were identified. Like cyberincidents organized by other entities, cyberattacks by nation states are characterized by asymmetry, latency, and hybridity. The motives for malicious cyber activity by states include intelligence and espionage, economic competition and the struggle for control over resources, disruption of infrastructure, and manipulative information and psychological influence (IPI). In addition to traditional methods, states use new methods that were not previously inherent to them: cyber extortion, illegal cryptocurrency transactions, and the introduction of remote workers into competing countries.
It was found that the four leading states of illegal cyber activity include China, the Russian Federation, Iran and North Korea. Their cyberoperations have a predominantly geopolitical connotation and are aimed at increasing influence over territorially neighboring countries, with the exception of the United States. The main targets of cyber operations in support of states were IT, education and research, government systems, analytical institutions and NGOs, critical infrastructure facilities and supply chains of IT products and services.
Nationally oriented cyber actors continue to improve cyberattack methods, using automation tools, cloud infrastructure and remote access technologies, quickly exploiting unpatched vulnerabilities and actively implementing AI to make cyberattacks larger, more effective, more difficult to track, and also cheaper.
An important feature of modern state criminal activity in cyberspace is the convergence of efforts of national actors and cybercriminal groups. By providing cyberattack services, developing spyware and hacking tools, states not only strengthen and reduce the cost of their cyber efforts, but also ensure the possibility of their identifying and establishing responsibility.
Recently, the volume and importance of state cyber IPI operations have increased, which, through the use of AI tools, in particular the creation of synthetic analogues of leading online news media and the use of deepfakes, ensure the effective manipulation of public opinion and the dissemination of desired propaganda narratives in competing countries and at the international level.
It was observed that national actors are increasingly introducing remote insiders into companies of “hostile” countries, primarily to gain access to intelligence data and espionage, as well as to introduce malicious software, extortion and sabotage in the workplace.
The study showed that only in half of cases of cyberattacks, including those supported by states, their true organizers have been identified, which is a consequence of the difficulties of cyber attribution – the process of tracking the identification of the perpetrator of a cyberattack, as well as the imperfection and non-compliance by states with the norms of international cyberspace law.
The authors emphasized that a deep understanding the prerequisites and specifics of state-sponsored cyber operations will contribute to solving the problems of their detection and counteraction peacefully and within the framework of international law.
