Nation-State Activity

Nation-state activity is hacking that governments run, sponsor or buy, to steal secrets, position inside critical infrastructure or raise money for the state. In 2026 analysts saw state espionage blur with profit-seeking crime and argued for mapping the contractors and agencies behind a campaign, not a single group label, to aim sanctions and takedowns better.

US authorities said Chinese operations relied on contracted firms, one of which built scanning and phishing tools for the Ministry of State Security. Chinese and Russian groups targeted governments, think tanks and AI policy experts with phishing and backdoors, hiding in Microsoft 365 traffic or impersonating trusted institutions. Hackers tied to North Korea stole $387.5 million from one exchange, and prosecutors say North Korean IT workers took US jobs under false identities. Governments answered by targeting the enablers.

As of October 2026, Chainalysis put North Korea's 2026 crypto haul past $1 billion; the FBI had seized domains behind a Chinese contractor's tools; and CrowdStrike expected raids on North Korean laptop farms to have limited impact.

Contractors and composite attribution

Analysts in 2026 pushed to replace single-label attribution, which credits a campaign to one advanced persistent threat (APT) group, with a map of the contractors and agencies behind Chinese operations, so that responses can be aimed more precisely. They cited Salt Typhoon as the most consequential case, yet as of early 2026 the roles of the firms named in it remained publicly undescribed.

Integrity Technology Group (Integrity Tech), whose activity overlaps with operations tracked as Flax Typhoon, shows how such a contractor works. US authorities say the Beijing firm built and ran hacking tools under contract to China's Ministry of State Security: MicroScan, a vulnerability scanner aimed at targets from a South Carolina power company to Japanese and Polish airports, and FishHub, a spear-phishing platform whose confirmed victims included about 20 Taiwanese universities. The FBI's Brett Leatherman said the PRC "relies on contractor and enabling companies" to extend its hacking.

Analysts also flagged a broader 2026 trend of state espionage blurring with financially motivated cybercrime. Symantec and Carbon Black described Jewelbug, a China-based hackers-for-hire group, as running both espionage and cryptocurrency fraud. Cisco Talos found overlap between Jewelbug and the China-nexus cluster UAT-11587 but found no link to Jewelbug's for-profit work and tracked UAT-11587 separately.

Espionage against policy communities

State hacking campaigns targeted the people who shape policy and hid inside channels their targets trust. UAT-11587's Antino backdoor runs its command and control entirely through Microsoft 365, so its traffic ends at Microsoft domains that enterprises commonly allow. By July 2026 the campaign had compromised roughly 350 endpoints at government, diplomatic and policy organisations in eight countries.

Russia's Star Blizzard, attributed to the FSB, sent fake event invitations impersonating think tanks such as Chatham House. Microsoft counted at least 13 campaigns between January and September 2026 against more than 100 organisations, mostly in the US and UK, plus targets in and supporting Ukraine. Its RedFlick chain installs a backdoor after a single click, where its 2025 ClickFix technique needed several manual steps.

Proofpoint said the China-aligned group TA419 impersonated a former White House science policy official and an economist in July 2026, inviting fewer than 10 US AI policy experts onto a fictitious advisory committee before steering them to a credential-phishing page. Proofpoint assessed that the activity likely supports Chinese intelligence efforts to track US AI policy.

North Korean revenue operations

North Korean operators raised money through crypto theft and fraudulent remote employment. Hackers that Bitget, Elliptic and Chainalysis attributed to North Korea stole $387.5 million from the Bitget exchange in September through a zero-day in an unnamed third-party security product, an entry point SlowMist and Mandiant confirmed. Chainalysis said the theft pushed North Korea's 2026 crypto haul past $1 billion.

North Korean IT workers also posed as US-based remote employees, prosecutors say, using stolen or fabricated identities while US facilitators hosted their company-issued laptops in "laptop farms". One indictment alleges that a scheme running from 2019 to July 2025 placed workers at more than 70 US companies and generated over $3 million.

Disrupting the enablers

Governments went after the firms and people that enable state hacking. In October 2026 the FBI, backed by a six-country coalition, seized seven domains supporting MicroScan and FishHub. CISA's Chris Butera said Chinese government hackers "continue to position themselves within critical infrastructure networks" to disrupt critical functions "at a future time of their choosing."

US authorities also arrested two US nationals accused of hosting laptops for North Korean workers, and in an operation codenamed Lonestar Roundup the FBI searched 40 suspected laptop farms in Texas. CrowdStrike expected limited impact on the scheme but called the raids the start of a broader US effort to dismantle its American infrastructure.