SECURE IN SECURITY Threat Intelligence Reference
The Four-Actor Threat Landscape
A comparative breakdown of the cyber objectives, tactics, and campaigns of China, Russia, Iran, and North Korea.
About This Reference
This document compares the four most consequential state cyber programs through a practitioner lens: who directs them, what they are trying to achieve, how they operate, and which campaigns from 2024–2026 illustrate each. It is descriptive threat intelligence, not operational guidance for offensive activity.
One Label, Four Very Different Threats
“State-sponsored” is a useful umbrella, but it flattens four programs that pursue genuinely different ends. Treating them as interchangeable leads to misallocated defenses: hardening for Russian wipers does little against a North Korean recruiter lure, and watching for crypto theft will not catch Chinese pre-positioning in a substation. The four actors differ in their sponsoring institutions, their strategic objectives, their tolerance for noise and attribution, and the sectors they prize. The sections below break down each in turn, then consolidate the comparison into reference tables mapped to MITRE ATT&CK.
A through-line worth holding onto: China collects and pre-positions, Russia disrupts and destroys, Iran signals and coerces, and North Korea steals to survive. Each summary is a tendency, not an absolute — every program runs espionage of some kind — but the centre of gravity is distinct.
China — Strategic Espionage and Pre-Positioning
Chinese operations are split across two sponsors with different mandates. The Ministry of State Security (MSS) runs intelligence collection at scale, exemplified by Salt Typhoon, which compromised major U.S. telecom carriers — including Verizon, AT&T, T-Mobile, and Lumen — and reached lawful-intercept systems, with reporting placing the campaign across 200-plus targets in 80-plus countries. The People’s Liberation Army (PLA), meanwhile, runs Volt Typhoon, a pre-positioning effort that embeds in U.S. energy, water, transportation, and communications networks for potential sabotage during a Taiwan contingency rather than for espionage.
The signature tradecraft is living off the land (LOTL): valid stolen credentials, native administrative tooling, and compromised SOHO edge devices (the KV botnet) used to blend into normal traffic and sustain multi-year dwell. The strategic intent is patience — access held in reserve. In January 2025 the U.S. Treasury sanctioned Sichuan Juxinhe for its role enabling Salt Typhoon, and in April 2025 the FBI posted a $10M bounty for related information.
LOTL leaves few malware artifacts. Detection leans on behavioral analytics, edge-device integrity monitoring, and aggressive credential hygiene rather than signature matching. Assume long-dwell access in telecom and critical-infrastructure environments.
Russia — Disruption, Destruction, and Battlefield Support
Russia’s most distinctive capability is cyber-enabled physical disruption, concentrated in the GRU’s Sandworm (APT44, Unit 74455). Sandworm authored the 2015–16 Ukrainian power-grid blackouts and the 2017 NotPetya wiper — still the costliest cyberattack on record — and through 2024–2025 intensified destructive operations against Ukrainian energy companies, deploying the new ZEROLOT wiper alongside earlier families such as Industroyer and AcidRain. A second GRU unit, APT28 / Fancy Bear (Unit 26165), is the espionage arm; a May 2025 joint advisory (CISA AA25-141A) detailed its multi-year campaign against Western logistics and technology firms coordinating aid to Ukraine.
Russian tradecraft pairs destructive intent with deniability: spear-phishing and edge-device or supply-chain compromise for access, LOTL for stealth, then wipers or ICS-specific malware for effect — frequently masked behind hacktivist personas and false-flag operations. The FSB (Turla/Secret Blizzard) and SVR (APT29) add longer-horizon espionage, but the defining Russian signature remains sabotage timed to military and political events.
Treat ransomware in Russia-targeted sectors as potentially destructive. Sandworm has repeatedly disguised wipers as ransomware (NotPetya). Preserve forensic evidence, validate data integrity before assuming criminal intent, and rehearse recovery from irreversible data loss — not just decryption.
Iran — Disruptive Opportunism and Influence
Iran’s program is bifurcated between the IRGC (military, including the Cyber-Electronic Command and APT33/APT35/APT42) and the civilian MOIS (APT34/OilRig, MuddyWater). Its defining trait is a willingness to touch operational technology for psychological effect. CyberAv3ngers (IRGC-CEC) compromised roughly 75 Israeli-made Unitronics PLCs across U.S. water and other sectors in 2023, fielded the custom IOCONTROL ICS/IoT malware in 2024, and — per a six-agency advisory (CISA AA26-097A, April 2026) — was tied to active exploitation of Rockwell CompactLogix and Micro850 controllers, with confirmed operational disruption and financial loss at victims.
Espionage groups like APT35 / Charming Kitten specialize in long-horizon social engineering, increasingly using AI-crafted lures and MFA-intercepting credential phishing against researchers, academics, and policymakers, while MuddyWater has shifted toward custom Rust implants. The June 2025 twelve-day Israel–Iran conflict showed how Tehran’s hacktivist proxies surge DDoS and ICS scanning in coordination with the state — effect and signal prioritized over silent persistence.
Iran’s OT intrusions overwhelmingly exploit internet-exposed devices with default or weak credentials. Inventory and remove internet-facing PLCs/HMIs, eliminate default passwords, segment OT from IT, and move high-risk users to phishing-resistant FIDO2 hardware tokens.
North Korea — Revenue Generation at State Scale
Alone among the four, North Korea’s primary cyber objective is money. Operations under the Reconnaissance General Bureau (RGB) — chiefly Lazarus Group (APT38) and its crypto-focused TraderTraitor cluster — fund the regime’s sanctioned weapons programs. In February 2025 Lazarus executed the $1.5 billion Bybit heist, the largest crypto theft in history, via a supply-chain compromise of the Safe{Wallet} signing interface, then laundered the proceeds through THORChain across thousands of addresses. Chainalysis attributes roughly $2.02 billion in 2025 theft to DPRK actors — a 51% year-over-year rise and about three-quarters of all service-compromise value.
Two human-centric techniques dominate. Operation Dream Job uses fake recruiter lures on LinkedIn to deliver malware to developers, and the IT-worker (Wagemole) scheme plants operatives inside Western firms under false identities to draw salaries and seed access — prompting fresh OFAC designations in March 2026. Sibling units Kimsuky (espionage) and Andariel (defense-sector intrusions) round out a portfolio that blends criminal efficiency with intelligence tradecraft.
└─ Unsolicited recruiter DM → “coding test” → poisoned npm/PyPI package └─ New contractor + AnyDesk/laptop-farm access + odd-hours commits └─ Wallet signing UI manipulated during cold-to-hot transfer
Comparative Summary
The matrix below consolidates the four programs across sponsor, objective, signature tradecraft, and a representative 2024–2026 campaign.
| Actor & Sponsor | Strategic Objective | Signature Tradecraft | Notable 2024–2026 Activity |
|---|---|---|---|
| China MSS + PLA | Espionage; pre-position in critical infrastructure for crisis-time disruption | Living-off-the-land, valid credentials, compromised edge/SOHO devices, long dwell | Salt Typhoon telecom breaches; Volt Typhoon infrastructure pre-positioning; Jan 2025 sanctions |
| Russia GRU / FSB / SVR | Disruption & destruction; battlefield support; espionage; influence | Wipers, ICS/OT malware, spear-phishing, supply chain, hacktivist false flags | Sandworm ZEROLOT wiper vs. Ukrainian energy; APT28 logistics campaign (AA25-141A) |
| Iran IRGC + MOIS | Disruptive/coercive signaling; espionage; influence and psychological ops | Default-credential OT abuse, custom ICS malware, AI-aided phishing, hacktivist proxies | CyberAv3ngers PLC attacks & IOCONTROL; Rockwell exploitation (AA26-097A, Apr 2026) |
| North Korea RGB | Revenue generation to fund weapons programs; espionage | Crypto-exchange & supply-chain theft, recruiter lures, IT-worker infiltration | $1.5B Bybit heist (Feb 2025); ~$2.02B stolen in 2025; IT-worker OFAC sanctions |
MITRE ATT&CK Quick Reference
Representative techniques observed across these programs. Mappings are indicative of commonly reported behavior, not an exhaustive profile of any single group.
| Technique | ID | Most associated actors |
|---|---|---|
| Valid Accounts | T1078 | China, Iran, Russia |
| Command & Scripting Interpreter | T1059 | All four |
| Phishing / Spearphishing | T1566 | Russia, Iran, North Korea |
| Supply Chain Compromise | T1195 | Russia, North Korea |
| Data Destruction / Wiper | T1485 | Russia (Iran latent) |
| ICS: Modify Controller Tasking | T0821 | Iran, China, Russia |
Defensive Implications
Because the objectives diverge, no single posture covers all four — but the entry points overlap more than the end states. Identity and edge are the shared front door: stolen credentials, internet-exposed devices, and unpatched edge appliances feature in Chinese pre-positioning, Iranian OT intrusion, and Russian access alike. Phishing-resistant MFA, rigorous patch and exposure management for edge and OT assets, and removal of default credentials raise the cost against three of the four at once.
From there, defenses should be tuned to each actor’s endgame: behavioral analytics and IT/OT segmentation against Chinese and Iranian persistence; tested, offline-capable recovery against Russian wipers; and protection of hiring, developer, and wallet-signing workflows against North Korean theft and infiltration. Threat-led validation — emulating Salt Typhoon, Sandworm, CyberAv3ngers, and Lazarus TTPs against your own controls — turns this comparison into measurable assurance.
Map your sector and exposure to the actor most likely to target it, then defend the shared front door first — identity and edge — before specializing for that adversary’s objective. Attribution is useful context; control coverage is what reduces risk.