State-Sponsored Hackers Targeting Defence Sector Employees

A recent report from Google highlights a significant increase in state-sponsored cyber-espionage campaigns targeting the defence sector, particularly focusing on employees and hiring processes. Released ahead of the Munich Security Conference, the report details a "relentless barrage of cyber operations" primarily orchestrated by state-linked hackers against industrial supply chains in the United States and Europe. Luke McNamara, an analyst for Google’s threat intelligence group, noted that these attacks have become more personalized, often targeting individuals rather than just corporate networks. This shift complicates detection, especially when attacks occur on personal systems.

The Guardian

The report indicates that hackers have expanded their focus beyond traditional defence contractors to include a wider range of industries, such as German aerospace firms and UK car manufacturers. Notably, a recent attack attributed to Russian intelligence attempted to steal information by spoofing websites of numerous leading defence contractors across countries including the UK, US, Germany, France, Sweden, Norway, Ukraine, Turkey, and South Korea. Additionally, North Korean hackers have adopted sophisticated methods, impersonating corporate recruiters to target employees of major defence firms. These hackers utilize artificial intelligence to profile potential targets based on their roles and salaries, leading to successful compromises.

The Guardian

In Ukraine, cyber-attacks against military personnel have become increasingly individualized, with potential targets monitored for extended periods before being attacked. Dr. Ilona Khmeleva, secretary of the Economic Security Council of Ukraine, reported a 37% increase in cyber incidents from 2024 to 2025. The tactics employed by hackers have included impersonating Ukrainian drone builders and training courses to launch targeted attacks against frontline drone units.

The Guardian

The implications of these cyber threats extend beyond national borders. As Western technologies and investments are integrated into Ukraine, the pool of potential victims now includes foreign contractors, engineers, and consultants involved in Ukraine-related projects. Khmeleva emphasized that this situation represents a transnational security issue, necessitating a collective response from affected nations.

The Guardian

The US Justice Department has revealed that North Korean operatives successfully secured remote IT jobs with over 100 US companies, allegedly to fund the North Korean government through salaries and cryptocurrency theft. Iranian state-sponsored groups have also been implicated in creating fake job portals to harvest credentials from defence firms. Furthermore, a Chinese-linked group, APT5, has targeted employees of aerospace and defence companies with tailored phishing emails, utilizing local and personal context to increase the likelihood of success.

The Guardian

Critics argue that the growing sophistication of these cyber-attacks highlights a significant gap in cybersecurity measures within the defence sector. The reliance on personal systems for work-related tasks is seen as a vulnerability that state-sponsored hackers are exploiting effectively.

The Guardian

“It’s harder to detect these threats when it’s happening on an employee’s personal system, right? It’s outside a corporate network,” — Luke McNamara, Analyst, Google Threat Intelligence Group

The Guardian