đť•Ź in f M
ES

State hackers: what no one tells you about offensive cybersecurity

· internet-dangers, hacking-tools, hacking

U.S.-sponsored hackers

A few days ago, a friend confessed to me that he thought all hackers were the same: hooded people who, for money, ego or ideals, sneak into other people’s systems from a dark room full of green screens. The image is very cinematic, I don’t deny it. It’s also quite comfortable, because it allows us to think that the world of hacking fits into a cartoon. But no: the reality is much more complex and, above all, much more disturbing.

I had to spend quite a while explaining to him that not all hackers are the same. In fact, they don’t even all play the same sport. Some look for vulnerabilities to help fix them. Others steal credentials, empty accounts or extort money from companies. Some act out of ideology. Others, out of simple, misplaced curiosity. And then there are the truly dangerous ones: those who work not for themselves, but for a state.

In Chapter 1 of the book Legal Aspects of Cybersecurity, I described in detail what ethical hacking is and what types of hackers exist on paper: ethical hackers who test systems to find and fix vulnerabilities; cybercriminals who seek immediate financial gain; hacktivists, who operate for political or social motivations; insiders, who betray from within; script kiddies, who just copy other people’s code without fully understanding what they are executing; and, of course, state-sponsored hackers.

Today I want to focus on the latter, because what I discovered when I was a professor of ethical hacking, and even before that, as a student in dozens of technical courses, is that real high-level offensive cybersecurity barely makes headlines in the mainstream press. What we see in the news is usually the tip of the iceberg: a data theft, a company crippled, a hospital attacked, a cryptocurrency platform hollowed out. What is almost never explained is the machinery underneath.

And that machinery doesn’t look much like the cliché of the bright teenager who improvises attacks in the wee hours of the morning. It’s more like a military unit, an intelligence agency or a clandestine laboratory with budget, targets, shifts, procedures, supervisors and performance metrics (KPIs).

Hackers with fixed salary and invisible badge

A state-sponsored hacker is not a common criminal: he is an employee. He may not have a physical badge, nor a uniform, nor appear on a public organizational chart. But he is paid a salary, has advanced technical means and takes orders from a military, political or intelligence chain of command.

He does not work “when he can”. He works every day. It does not improvise like someone who throws a fishing rod into the river to see what it catches. It operates with specific objectives: to steal industrial secrets, infiltrate ministries, monitor dissidents, interfere in electoral processes, prepare the ground for a conflict or finance the regime that pays it.

In the industry we often talk about APT (Advanced Persistent Threat). The “A” stands for advanced, because its methods far exceed those of the most basic cybercrime. The “P” stands for persistent, because they don’t just come in, steal and go away: they install, observe, come back, change techniques and remain silent for months or even years. And the “T” stands for threat, threatening, because that’s exactly what they are.

The word “persistent” is critical. A run-of-the-mill cybercriminal can launch thousands of phishing emails hoping someone will take the bait. An APT, on the other hand, can study a single person for weeks: their schedules, their contacts, their tastes, their posts on social networks, their travels, their suppliers and even the language they use when writing. It will then fabricate a tailor-made attack, so credible that the victim will not feel that he is falling into a trap, but doing something completely normal.

This is one of the great misunderstandings of modern cybersecurity. Many people imagine that the most sophisticated attacks always start by exploiting a top-secret technical vulnerability. Sometimes they do. But most of the time these operations start with something much more human: a fake LinkedIn conversation, a doctored resume, an invitation to a conference, a supposed vendor who writes with the right tone, or a document that appears to come from someone you trust.

Technology opens the door. But, many times, the one who turns the knob is a deceived person.

APTs are not an urban legend. Groups such as APT29, also known as Cozy Bear or Midnight Blizzard, have been attributed by different sources to Russian foreign intelligence services and have been operating for years against governments, institutions, research centers, international organizations and strategic sectors. MITRE describes APT29 as a group attributed to the SVR (Russian Foreign Intelligence Service), active at least since 2008 and regularly targeting European governments, NATO countries, research institutes and think tanks.  

On the other side of the world, North Korea has developed a very particular variant of state cyber power. While other countries prioritize political, military or industrial espionage, Pyongyang has turned cybercrime into a source of funding. The Lazarus group and other units associated with North Korea have for years been linked to bank robberies, attacks on cryptocurrency platforms, social engineering campaigns and operations aimed at obtaining foreign currency in a country under heavy international sanctions.

The Bybit case is particularly illustrative. In February 2025, the FBI attributed the theft of approximately $1.5 billion in virtual assets from the Bybit platform to North Korea. The FBI’ s own alert identified this activity as Trader Traitor, a designation associated with North Korean operations against the crypto ecosystem.  

We are not talking about kids trying their luck. We are talking about operations that, according to U.S. authorities, serve to launder funds, convert them into other cryptocurrencies and, ultimately, support the North Korean regime. In other words: in certain cases, a cyber attack is not just an economic crime. It is another piece of a state’s foreign policy.

The false comfort of thinking: “I will not be attacked”

Here it is worth pausing for a moment. When APT is mentioned, many people switch off because they think: “Well, that’s for ministries, armies, nuclear power plants or big companies. I’m not important”. And, in part, that’s true. A top-tier APT doesn’t usually spend its best resources against an anonymous citizen for no reason.

But that doesn’t mean the anonymous citizen is off the board. Sometimes you are not the end target, but the path to the target. You may be a supplier, employee, family member, journalist, external technician, small business administrator, owner of a seemingly irrelevant website, or just someone with indirect access to a more interesting person.

In cybersecurity there is a very uncomfortable idea: you are not always attacked for what you have, but for what you can lead to. A small air conditioning company can be the gateway to a large retail chain. A modest law firm may have sensitive documents of very important clients. A personal email account can be used to rebuild relationships, habits and patterns of trust. And a cell phone can become a permanent window into someone’s life.

Therefore, when we talk about state actors, we should not only think about “hacking servers”. We also talk about doxing people, relationships, dependencies, suppliers, routines and weaknesses. Technical infrastructure matters, but human infrastructure matters even more.

If a State targets you, there’s no escape: TTP, MITRE ATT&CK and the art of reading invisible footprints

When analysts study these groups, they don’t just look at the name of the malware or a suspicious IP address. That would be like trying to identify a thief by the brand of his shoes alone. It’s good, but it’s not enough.

The first thing they look for are their **TTPs **(Tactics, Techniques and Procedures). Tactics describe the “why”: gain initial access, move laterally, steal credentials, exfiltrate data or cause impact. Techniques explain the “how”: impersonate identities through targeted phishing, exploit an unpatched vulnerability, abuse legitimate system tools or exploit weak configurations. Procedures are the concrete step-by-step: the exact way a group executes a technique.

Imagine if each attack were a fingerprint. Changing the server, domain, tool or IP address is relatively simple. Completely changing the way you operate is less so. Offensive groups, like any human organization, develop habits. They reuse processes that have already worked for them. They automate parts of their work. They repeat certain commands. They prefer certain tools. They have business hours that are compatible with their geographic area. They make the same small mistakes. And sometimes those habits outweigh any purposely planted clues.

This is why TTPs have enormous forensic value. An attacker may change the scenery, but he does not always change his mannerisms.

In order to bring order to this ecosystem, MITRE created **MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge). It is a public knowledge data base that catalogs actual behaviors observed in attacks. It is not a list of viruses. It is a behavior map.

MITRE ATT&CK allows to go through the phases of an offensive operation: reconnaissance, resource development, initial access, execution, persistence, privilege escalation, evasion or weakening of defenses, credential access, discovery, lateral movement, collection, command and control, exfiltration and impact. MITRE itself defines ATT&CK as a global knowledge base on adversary tactics and techniques based on actual observations.

This is more important than it sounds. For years, many organizations defended their networks like someone trying to stop mosquitoes with a racket: by blocking specific indicators. A malicious IP. A domain. A file hash. An antivirus signature. The problem is that these indicators expire very quickly. Today they are useful; tomorrow, maybe not.

TTPs, on the other hand, age better. If an attacker often abuses PowerShell to load code into memory, uses stolen credentials to move laterally, queries certain Active Directory objects, establishes persistence through scheduled tasks, or exfiltrates data in small packets overnight, those behaviors can be detected even if the particular tool changes.

In a good security operations center (SOC), the goal should not just be to ask, “Do we know this malware?”. The really interesting question is: “Does this behavior resemble that of a real adversary?”.

The detail that almost nobody tells: States also reuse, make mistakes and have bureaucracy

We tend to imagine state groups as near-perfect entities. And it is true that some possess extraordinary capabilities. But they are still human organizations. And that means they have pressure, targets, shifts, constraints, hierarchies, mistakes, rushes and bureaucracy.

This detail is important because it explains why they can be detected. An operator can make a mistake when configuring a server. A developer may reuse an internal library (.dll). A team may deploy a tool before testing it properly. A group may work on schedules that give away its geographical area. A unit may share infrastructure with another. A procedure may be repeated because the organization has trained its operators in a certain way.

Sometimes attribution is not based on a big cinematic clue, but on a sum of small breadcrumbs: timing, language, infrastructure, chosen victims, geopolitical targets, reused malware, digital certificates, compilation errors, misconfigured servers and behavioral patterns.

Attribution in cybersecurity is rarely an absolute “gotcha.” It’s usually more like an intelligence judgment: accumulation of indicia, comparison with previous campaigns, and assessment of confidence. So when a serious agency says “we attribute with high confidence,” it’s not saying “we know because a flag appeared in the code.” It is saying: “we have cross-checked enough technical, operational and strategic pieces to support this conclusion”.

The training camp: Red Team, Blue Team, Purple Team and cyberbattlefields

Before launching a real operation that, if it goes wrong, can escalate into a diplomatic or military conflict, governments and large organizations train. They don’t do it in real production networks, or at least they shouldn’t do it without control. They do it in ***cyber ranges, ***cyber training camps that replicate corporate networks, military environments, industrial systems or critical infrastructures.

A well-designed cyber range is not a simple laboratory with four virtual machines. It is an environment that replicates users, servers, workstations, normal traffic, logs, alarms, errors, vulnerable services, active defenses and, in some cases, industrial control systems (ICS). The trick is that the defender is not training against a dead model, but against something that breathes and behaves like a real network.

This is where the Red Teams comes into play. Their role is to act as the attacker. They don’t just “pass a vulnerability scanner”. They try to behave as a real adversary would: reconnaissance, initial entry, persistence, privilege escalation, lateral movement, information theft and exfiltration. If the exercise is well thought out, the red team is not looking to prove that it is very clever, but to test the organization’s actual Identify, Protect, Detect, Respond, and Recover (IPDRR) capabilities.

Opposite are the Blue Teams . They are the defenders: security analysts, administrators, incident response teams, network managers, forensic specialists and operations personnel. Their mission is to detect the attacker, understand what he is doing, contain him, expel him and learn from what happened.

When both teams collaborate and share information in real time, we are talking about a Purple Team . In reality, it is not usually a separate third group, but a working dynamic. Red executes a technique and Blue checks to see if they see it. If it doesn’t, rules, logs, alerts or procedures are adjusted. Then it repeats. It’s an immediate improvement loop.

The difference between a traditional exercise and a purple one is huge. In a classic exercise, the red team can deliver a glossy report at the end, full of vulnerabilities and screenshots. That has value, but it comes late. In a purple exercise, the learning happens during the attack: “I just moved laterally using Pass-the-Hash; did you see it?”. If the answer is no, it is corrected on the fly.

This approach trains defenders not only to detect specific artifacts: an IP, a domain or a file, but patterns of behavior. And that is much more useful against advanced adversaries.

Adversary emulation: playing APT29 without being APT29

Here appears a very interesting discipline: adversary emulation. It does not consist in launching generic attacks, but in imitating a specific group. If an organization fears APT29, the red team can construct a scenario that replicates its known TTPs. If the main risk comes from North Korean groups oriented to financial theft, an exercise can be designed inspired by those campaigns.

The idea is simple to explain, but difficult to execute: “don’t attack me as you can; attack me as the adversary I really care about would”.

This completely changes the value of the exercise. A bank does not need the same training as a hospital. An energy company does not need exactly the same scenario as a media company. A defense ministry does not have the same risk profile as a university. And a small company working as a supplier to a large organization may be attacked differently than the main organization.

MITRE ATT&CK helps to build precisely those scenarios. It allows you to choose techniques observed in real campaigns, map them against defensive controls and check which part of the attack chain is detected and which remains invisible.

A little talked about detail is that many organizations believe they have good security because they have bought expensive tools. But when a serious emulation exercise is performed, they discover something uncomfortable: the problem is not always a lack of technology. Sometimes the logs are not collected well. Sometimes they are collected, but no one looks at them. Sometimes they are looked at, but not understood. Sometimes it is understood, but there is no authority to act. And sometimes there is authority, but the procedure takes so long that the attacker has already moved elsewhere. You know: “No logs, no crime“.

Defense is not just about buying sensors. It’s getting people, processes and technology to work in lockstep.

Security Certificates that teach you how to hack for real

It may sound strange, but there are official certifications that teach and certify advanced offensive skills. I’m not talking about a weekend course or watching videos while copying a command. I’m talking about long, proctored, grueling, hands-on exams where you have to engage real systems in a controlled lab and rigorously document your work.

Among the best known are the certifications of OffSec:

– OSCP ( OffSec Certified Professional) – often considered a serious gateway to the world of hands-on pentesting. The exam lasts 24 hours and requires you to compromise several machines in a controlled environment.
– OSEP ( OffSec Experienced Penetration Tester): geared towards defense evasion, hardened environments and operations closer to the Red Team. OffSec indicates that the exam lasts approximately 47 hours and 45 minutes, plus additional time to submit documentation.  
– OSWE ( OffSec Web Expert): focused on advanced analysis and exploitation of web applications.
– OSED ( OffSec Exploit Developer): specialized in exploit development, especially in Windows environments.
– **OSEE( OffSecExploitation Expert): one of the most demanding certifications in the offensive field. OffSec describes its exam as a 72-hour test in which the student must discover and exploit unknown vulnerabilities in a controlled laboratory.  

There are also certifications from **GIAC (Global Information Assurance Certification), which are highly respected in professional environments:

*– GPEN ( GIAC Penetration Tester): focused on network and system penetration testing. GIAC states that its exam consists of 82 questions, lasts three hours and requires a minimum score of 73%.
– GWAPT ( GIAC Web Application Penetration Tester) – Focused on web application security.
–  GXPN (*GIAC Exploit Researcher and Advanced Penetration Tester): focused on advanced exploitation, complex attack techniques and deep analysis. GIAC describes its exam as a 60-question, three-hour test with a minimum score of 67%.
– **GREM ( GIAC Reverse Engineering Malware ): focused on malware analysis, unpacking, disassembly and understanding malicious code.

I myself obtained the C|EH (Certified Ethical Hacker ) from EC-Council. It’s a well-known and useful certification to get an overview, especially if you come from auditing, accreditations systems, system administration or defensive security background. But to be honest: it doesn’t play in the same league as the more hardcore offensive certifications.

The C|EH shows you the map. Certifications such as OSCP, OSEP, OSWE, OSED or OSEE force you to cross the forest at night, in the rain, without cover and with a compass that sometimes lies. The difference is similar to the difference between passing your driver’s license and competing in the Dakar. Both have to do with vehicles, yes, but they don’t require the same kind of suffering.

Scary tools: Cobalt Strike and the dual-use weapons problem

If we talk about real offensive tools, Cobalt Strike deserves a separate mention. It was born as a legitimate adversary simulation platform. That is, a tool for red teams to mimic real attackers and improve an organization’s defenses. The problem is that powerful tools rarely stay in the hands of the good guys, as will soon happen to Claude Mythos, which we will talk about later.  

Over the years, Cobalt Strike has also become a tool used by criminal groups, ransomware operators and state actors. Part of the problem lies in the hacked versions that have been circulating for some time. That has allowed actors with fewer resources to access capabilities previously reserved for professional teams.

Its most famous component is Beacon, a post-exploitation agent. Once inside a system, Beacon allows to communicate with the attacker’s infrastructure, execute commands, move around the network, pivot between computers and perform reconnaissance or information theft actions.

What’s disturbing is not just what it does, but how it does it. Beacon can communicate in a “low and slow” manner, generating spaced traffic to appear less suspicious. It can use HTTP, HTTPS or *DNS *. It can adapt to proxy networks. It can modify its communication profile using what is known as malleable C2 (malleable command and control), making the traffic look like something else, i.e. legitimate traffic.

In other words: it doesn’t shout “I’m malware”. It tries to talk like a normal application would talk inside a corporate network.  

A crucial insight emerges here: many offensive tools are dual-use. The same tool that allows a red team to demonstrate a weakness may allow a real attacker to exploit that weakness. The same is true for Metasploit, Nmap, Burp Suite, BloodHound, Mimikatz or certain remote administration utilities (RAT). The tool does not always define the intent. Context is everything.

A ham knife can be used to slice ham or to assault. In cybersecurity, many tools live in exactly that ambiguity.

How to detect what tries to appear normal

Detecting Cobalt Strike or similar tools is not impossible, but it requires going beyond traditional antivirus. The defender cannot simply ask: “Do I know this file?”. He has to ask, “Does this behavior make sense on this computer, on this user, at this time and with this network pattern?”.

Analysts can look for patterns in HTTP headers, strange periodic communications, domains with high entropy, suspicious DNS queries, processes that inject (migrate) code into other processes, anomalous use of PowerShell, unusual side connections or creation of named pipes with known names. They can also use Sigma rules, which allow generic detections to be expressed and then converted to different SIEM (Security Information and Event Management) systems.

The key is to build behavior-based detections. A hash changes. An IP changes. A domain changes. But if an accounting user suddenly executes an offensive operator’s own command string, something smells fishy. If a server that should never initiate external connections starts communicating every thirty seconds with a newly created domain, something smells bad. If a workstation generates DNS traffic with very long and random strings, something is fishy.

Good defense consists of learning to smell.

Zero-day vulnerabilities: the offensive holy grail

When a government group discovers a hole in a program that the vendor does not yet know about, it has a zero-day (0-day) vulnerability. The “zero” refers to the number of days the vendor has had to fix it: exactly zero. No patch. No advance warning. No reliable signature. No clear entry in the “things to block” manual.

The “0-day exploits” are the offensive holy grail because they allow you to get in where others can’t. That’s why they can fetch huge prices in gray or private markets, especially if they affect widespread systems: browsers, cell phones, operating systems, email platforms, security products, network devices or corporate applications. There are experts who are dedicated to finding them and then “literally” making a fortune by selling them on platforms such as Zerodium, Crowdfense, HackerOne or Bugcrowd.

But there’s a little-known nuance: a 0-day burns when misused, often a one-time bullet. If the attacker deploys it against a low-value target and the attack is discovered, the manufacturer can analyze it, create a patch and close the door. That’s why the really sophisticated groups don’t spend their best tools on just any victim. They reserve them for targets that justify the cost.

Here we see a clear difference between cybercrime and state-sponsored operations. A criminal wants to monetize fast. An intelligence service can wait. It can observe. It can keep a capability unused for months. It may decide that a vulnerability is worth more as secret access than as news.

The new digital atomic bomb: offensive AI, 0-days and democratization of harm

Until relatively recently, finding a zero-day vulnerability was a task reserved for a very small minority of specialists. We are talking about people capable of reading source code for weeks, understanding internal architectures, reviewing assembler language, identifying race conditions, exploiting memory errors and turning a seemingly innocent bug into a real compromise path.

That kind of talent is still invaluable. In fact, combined with advanced artificial intelligence, it can become almost stratospheric. A good security researcher with a frontier AI tool not only works faster: he or she can explore more hypotheses, review more code, automate more tests, and turn technical intuitions into practical results in a fraction of the time it used to take.

But here comes the truly disturbing change: advanced offensive hacking is starting to democratize. Not because everyone has suddenly become an expert, but because the tools are beginning to absorb some of the knowledge that previously lived only in the heads of a few geniuses.

The difference is enormous. Before, to exploit a complex vulnerability, you needed years of experience. Now, some models are starting to act as assistants capable of analyzing code, reasoning about bugs, building proofs of concept, suggesting exploit chains and, in some controlled environments, executing multi-step attacks with an autonomy that would have sounded like science fiction just a few years ago.

The most talked about example is *Anthropic’*s Claude Mythos Preview. According to Anthropic itself, Mythos Preview has demonstrated an ability to identify and exploit 0-day vulnerabilities in major operating systems and browsers when directed to do so. The company even claims that the model found a 27-year-old (now patched) flaw in OpenBSD, an operating system famous precisely for its emphasis on security. It also describes cases where the model built complex exploit chains, including chained vulnerabilities in browsers and local privilege escalations.  

The UK AI Security Institute’ s own external evaluation is even more interesting. According to this body, Claude Mythos Preview showed significant improvement in CTF (Capture The Flag) type technical challenges and in multi-step attack simulations. In a test called The Last Ones, which simulates a 32-step corporate attack and would require an estimated 20 hours of expert human work, Mythos Preview was the first model able to solve it from start to finish, albeit in only 3 out of 10 attempts. That doesn’t mean it can conquer any real network, but it does indicate a worrying direction: offensive autonomy is no longer a distant hypothesis.  

OpenAI has also recognized significant advances in this area. In the technical documentation for GPT-5.5-cyber, the company indicates that the model outperforms previous versions in CTF challenges, vulnerability discovery and attack simulations. In some external evaluations, it was noted that it could significantly help novice or mid-level operators and, in certain cases, even assist experts in niche tasks that not all professionals master. However, the documentation itself qualifies something important: there are still limitations in translating these capabilities to real scenarios, especially in aspects such as operational security, sustained evasion and adaptation to active defenses.

That nuance is essential. We are not looking at a magic “hack the world” button. Not yet. But we are facing a brutal acceleration of capabilities. And when a technology reduces the cost, time and knowledge needed to do something dangerous, the number of people capable of trying increases.

This is where the parallel with the digital atomic bomb comes in. Not because an AI is going to destroy a city with a keystroke, but because it changes the balance of power. For decades, the most advanced offensive capabilities were concentrated in states, large agencies, specialized contractors and a very small technical elite. Now, that frontier is beginning to shift. First, governments and large companies will gain access. Then, predictably, some capabilities will be leaked, copied, sold in clandestine markets or replicated through open models and derivative tools.

Anthropic has attempted to channel these capabilities through Project Glasswing, an initiative aimed at “selected partners” using Claude Mythos Preview to find and fix vulnerabilities in critical systems before attackers do. The company itself describes Glasswing as a coalition aimed at protecting critical software on which much of the world’s attack surface depends. It also claims that Mythos Preview has already identified thousands of 0-day vulnerabilities in critical infrastructure and that its access is limited as a closed research preview.

The defensive intent is reasonable. Indeed, it would be irresponsible not to use AI to find vulnerabilities before criminals do. But the dilemma is obvious: the same capability that makes it possible to find and patch flaws can also make it possible to find and exploit them. It’s the old logic of dual-use tools, but elevated to a new scale.

If defenders use AI earlier and better than attackers, they could discover deep bugs in critical software, generate patches, prioritize risks and reduce the window of exposure. For the first time in a long time, we could imagine a defense with some asymmetric advantage.

But there is also a dark side. If these tools fall into the hands of criminal actors, ransomware groups, digital mercenaries or script kiddies with more enthusiasm than brains, we will see an increase in clumsy, noisy and massive attacks. Not all of them will be sophisticated. In fact, many will be botched. But there will be a lot of them.

And there will come a second consequence that is also not sufficiently discussed: just as AI will make it easier to attack, it will also make it easier to investigate, correlate, detect and attribute. Many low-level attackers will believe that an intelligent tool makes them invisible. They will be wrong. It is one thing for an AI to help you launch an attack, and quite another to know how to operate without leaving traces, manage infrastructure, hide payments, avoid reusing patterns, not contaminate personal machines, not make scheduling errors, not mix identities and not talk too much in forums or private channels.

There will be a wave of new attackers. And there will also be a wave of arrests.

State-sponsored hackers will continue to play in a different league. They will have better models, better data, better analysts, better laboratories and better operational security. But common criminals and reckless trainees will also receive an artificial increase in capabilities. Some will go from copying commands without understanding them to launching semi-automated campaigns against small businesses, city halls, professional offices, clinics, stores and private users.

So if an organization still believes that cybersecurity is a luxury, it should wake up as soon as possible. The question is no longer just whether an expert can attack you. The question is what will happen when increasingly capable tools allow people with average or even limited knowledge to execute attacks that used to require specialized teams.

Offensive knowledge will continue to matter. Very much so. An expert with an advanced AI will be far more dangerous than a novice with the same tool. He will know what to ask for, how to interpret results, how to string together findings, how to avoid false positives, and how to move with discretion. But the minimum floor of capability will also go up. And when the floor goes up, the number of people capable of causing harm goes up.

The conclusion is uncomfortable, but necessary: AI does not replace the expert hacker; it amplifies him. And at the same time it turns thousands of irresponsible amateurs into operational threats of low or medium sophistication. Some will be dangerous because of their talent. Others, because of their numbers.

In the coming years, the difference between prepared organizations and naĂŻve organizations will become much more visible. The former will use AI to review code, detect anomalies, prioritize vulnerabilities, automate response and train their teams. The latter will discover too late that the attacker no longer needed to be a genius. All he needed was a powerful tool, a bad configuration and a company that never took its own security seriously.

And, as if all this were not complex enough, AI will not only complicate technical defense. It will also make it harder to distinguish between a state attack, a sophisticated criminal group, a false flag operation, or a gang of novices using tools they don’t fully understand.

The Inconvenient Truth About False Flags

Attribution in cybersecurity is further complicated by false flags. A sophisticated attacker can purposely leave planted clues: comments in a particular language, fake schedules, servers in a particular country, code scripts reused from another group, or usernames designed to mislead.

The goal is to make researchers look the other way. To make it look like North Korea when it is not. Make it look like Russia. Make it look like China. Make it look like an independent criminal group. Make it look like a chaotic attack when in fact it is part of a coordinated campaign.

That’s why good analysts don’t fall for a single clue. An IP address in Moscow does not automatically make Russia responsible. A comment in Korean does not automatically make North Korea the perpetrator. A Beijing-compatible schedule does not automatically make China culpable.

Serious attribution crosses many layers: infrastructure, code, victims, motivation, timing, geopolitical context, overlap with previous campaigns, operational errors, tools used, repeated techniques and external intelligence sources. Even so, it is rarely an exact science. It is a discipline of probabilities, confidence and prudence.

This point should be taught much more, because we live in an age where a computer attack can become political ammunition before the technical analysis is over. And that is dangerous. Misattribution can lead to sanctions, retaliation, diplomatic rifts or unnecessary escalation.

In cyberspace, accusing too soon can be almost as dangerous as never accusing at all.

The fifth domain: why this matters even if you’re not a ministry

For decades, armies thought in land, sea and air. Then came space. And, finally, cyberspace. At the 2016 Warsaw Summit, NATO officially recognized cyberspace as a domain of operations in which the Alliance had to defend itself as effectively as on land, sea and air.  

It was not a nice metaphor. It was a strategic realization. States no longer need to cross a physical border to cause damage. They can penetrate power grids, logistics systems, industrial plants, hospitals, satellites, radars, banks, universities, media or supply chains.

And the most disturbing thing is that many operations do not seek to destroy anything immediately. They seek to be on the inside. To prepare the ground. Know the network. Steal credentials. Leave persistent access for when they might need it. Map dependencies. Understand what system to touch if you ever want to have a major effect.

In a crisis, that advance preparation can make all the difference. Before a single shot is fired, implants may already exist within the adversary’s networks. Their logistical routes may already be known. Access against suppliers may already have been tested. The points where a small digital nudge would produce great physical damage may already have been identified, or several of their robotic systems and autonomous aerial platforms may already be infected years in advance to render them useless when the time comes.

This is one of the least understood aspects of modern warfare: cyberspace does not necessarily replace traditional domains. It accompanies them, prepares them, amplifies them and sometimes conditions them.

Industrial espionage: the silent war that doesn’t make the headlines

When we talk about state cyberattacks, we usually imagine missiles, radars, ministries and military secrets. But a huge part of the problem lies in industrial espionage.

A state can steal years of pharmaceutical research. It can access aircraft designs, batteries, turbines, semiconductors, satellites, navigation systems or artificial intelligence. It can learn about bids before a tender. It can anticipate commercial negotiations. It can copy strategic technologies. It can weaken foreign companies without dropping a single bomb.

This has enormous consequences. A company that loses intellectual property does not always find out. It can continue to operate, selling and contracting, unaware that a competitor backed by another state already has its designs, its formulas, its expansion plans or its internal costs.

Information theft does not make noise. It doesn’t always take down servers. It does not always encrypt disks. It doesn’t always leave a ransom note. Sometimes the perfect attack is one that is not discovered until years later, when it is too late to understand why a competitive advantage was lost.

That’s why APTs love silence. Ransomware needs attention to get paid. Espionage needs the exact opposite.

The supply chain: attacking the weak to reach the strong

Another point that almost no one outside the industry understands well is the supply chain. I get sick of saying that large organizations may have good security teams, but they depend on vendors, consulting firms, developers, maintainers, manufacturers, cloud platforms, open source software libraries, update tools and external services.

Attacking a large company directly can be difficult. Attacking one of their suppliers can be much easier.

This approach is particularly dangerous because it breaks a basic intuition: “I trust my supplier”. That’s precisely why it works. If an attacker compromises a legitimate update, software package, support account or remote administration tool, he can enter through a door that the victim considers normal.

Not all supply chain attacks have a state behind them, but state actors understand them very well. They are patient, quiet and scalable. A single compromised supplier can open many doors.

The lesson for small and medium-sized companies is hard, but necessary: even if you are not the ultimate target, you can be part of the journey. And if you work for sensitive sectors: defense, energy, healthcare, telecommunications, industry, public administration, finance or technology, your level of security is no longer just about you.

North Korea and the state cybercrime model

The North Korean case deserves a separate reflection because it breaks some schemes. Normally we think that a state uses its cyber capabilities to spy or prepare military operations. North Korea does that, but it has also turned digital theft into an economic tool.

The country is under severe sanctions and in need of foreign exchange. Cryptocurrencies, banks, financial platforms and technology companies have become natural targets. The Bybit theft, attributed by the FBI to North Korea, fits this logic: large amounts of digital assets, rapid movement between chains, progressive laundering and final conversion into usable value.  

Added to this is another lesser-known phenomenon: North Korean IT workers who, under false identities or intermediaries, try to get remote jobs in foreign companies. They do not always enter to “hack” in the classic sense. Sometimes they enter to collect salaries, access repositories, learn about internal environments or facilitate future operations. Recent reports and actions by U.S. authorities have warned of this pattern of labor infiltration and its relationship to the financing of the North Korean regime.  

The conclusion is uncomfortable: a state’s cyber power does not always manifest itself as a spectacular attack. Sometimes it appears as a remote candidate with a good resume, a convincing interview and an identity that no one verifies carefully enough.

What can a normal person do in the face of all this?

At this point, someone might think: “Then we’re lost”. Not exactly. If a top-tier APT decides to spend significant resources against you directly, your chances as an individual are practically nil. That needs to be said without embellishment. There is no domestic antivirus that compensates for the sustained attention of an intelligence service.

But that doesn’t mean that personal security doesn’t matter. It matters a lot, because most attacks don’t start with the most expensive weapon. They start with the easy stuff. A reused password. A convincing email. An outdated cell phone. An account without 2FA. A non-existent backup. An abandoned router with the same factory settings. A personal computer used for sensitive work.

Personal cybersecurity does not make you invulnerable. But it does increase the cost of attack. And that, in security, is already a lot.

Use password managers. Enable multifactor authentication, preferably with applications or physical keys when the risk justifies it. Update systems. Be wary of unexpected documents. Separate personal and professional accounts. Make offline backup copies. Check what you post on networks. Do not install software of dubious origin. And, above all, assume that social engineering is not aimed at “fools”, but at busy, confident or tired people.

Anyone can fall. The difference is in how many barriers the attacker encounters after the first mistake.

What should companies do?

Companies, even small ones, should stop thinking of security as just a list of products and start seeing it as a real capability. It is not enough to just buy a firewallantivirus and a cloud tool. Before that, you have to know what you want to protect, who might attack it, how you would detect improper access and what you would do in the first few hours of an incident.

I’ve seen companies that think that any bright employee can be assigned, almost overnight, to these cybersecurity roles. And that’s a huge mistake. They are foolish if they think that the same processes that serve, for instance for product certification or qualification also serve for their security accreditation. Proving that a product meets certain functional requirements is not the same as demonstrating that it can operate securely against real threats.

Whether they want to understand it or not, protecting a company and its products requires very well-prepared people. People with a solid educational background, yes, but also with experience, judgment and flight hours. In cybersecurity, it is not enough to read four papers, attend a crash course and learn two buzzwords. This field requires an understanding of how an attacker thinks, how a network behaves, how risks are managed, how systems are protected and how to respond when something goes wrong.

So it doesn’t help to reassign the most advantaged employees to that new domain and expect them to even understand what’s going on. Chances are they won’t. And not because they are not smart, but because they are entering a domain that requires specific knowledge, practice and an engineering mindset that is not improvised.

And if someone tries to justify it with cheap excuses such as: “It is very difficult to find cybersecurity experts, so I had to rely on other resources I already had”, they are not really telling the whole truth. Yes, it may be difficult to find them if you intend to pay them as if they were generic profiles, easily replaceable or abundant in the market. But in this field the reality is different: either salaries are adjusted to the level of responsibility and specialization required, or these professionals will leave for companies that have understood their value.

Moreover, when I hear that there are few cybersecurity experts, I sometimes laugh. Spain is full of very good professionals. What is really curious, and also worrying, is that some of the most brilliant minds I know, do not make more than 2,000 euros a month. And that, for the responsibility they assume and the impact they can have on the protection of an organization, is simply ridiculous.

Anyway, businessman, so as not to get too hot, at least let me leave you with some basic, but very powerful measures to protect yourself:

– Inventory assets: you can’t defend what you don’t know. If you don’t have an up-to-date inventory, you’re lost.
– Enforce least privilege: each user should have only the accesses he/she needs.
– Review privileged accounts: administrators are priority targets.
– Record relevant events: without logs, no investigation is possible.
– Protect mail: it is still one of the main entry points.
– Segment networks: if one team goes down, the whole organization should not go down.
– Test backups: A backup that has never been restored is a promise, not a guarantee that it will work when you need it most.
– Train with realistic scenarios: generic courses are not enough; you have to practice.
– Use frameworks such as MITRE ATT&CK: help you think like your opponent.
– Prepare crisis communication: during an incident, impromptu silence often makes things worse.

Defensive maturity does not consist of avoiding all attacks. That is impossible. It is about detecting earlier, containing better, recovering faster and learning from each incident.

With this I do not pretend that we fall into defeatism. On the contrary. Understanding how APTs operate, knowing the tools they employ and becoming familiar with frameworks such as MITRE ATT&CK is the first step in raising our collective consciousness.

We citizens are not completely defenseless. We can demand that our governments invest in cyber defense, that companies harden their systems, and that institutions treat digital security as a strategic issue, not an annoying IT expense.

We can also stop believing that state hacking is science fiction. It is not. It is diplomacy by other means. It is espionage without trench coats. It is sabotage without explosives. It is clandestine financing. It is silent war. It is political influence. It is industrial theft. It is battlefield preparation.

And perhaps most importantly: it is a reality that is already happening while we are still arguing about whether a password with the dog’s name and year of birth “is good enough”.

In a world where a fake email can open the door to a diplomatic crisis, knowledge is the only vaccine with lasting effect.

And now tell me, have you ever had the feeling that a cyber attack “could not happen to you”?
Did you know the difference between an APT and a common cybercriminal?
If you’ve made it this far, there’s no doubt you like this., so I would love to read your opinion in the comments. And, if you are curious, I invite you to check out other articles on josecurity.es where we talk precisely about how to strengthen our personal and corporate cyber defense.

Believe me: after understanding how state actors work, you never look at suspicious mail with the same eyes again.

References: