State-sponsored threats: Different objectives, similar access paths
Summary: Cisco Talos's 2025 Year in Review reports that state-sponsored activity from China, Russia, North Korea, and Iran shared common access paths through vulnerabilities and identity, with access persisting undetected for considerable periods. China-nexus investigations rose nearly 75% over 2024, with newly disclosed flaws like ToolShell exploited almost immediately, while North Korea carried out a $1.5 billion cryptocurrency heist and placed thousands of IT workers using stolen identities and AI-generated profiles at Fortune 500 companies.
Why it matters: Four different state programs with different goals converge on the same entry points - unpatched networking devices, identity, and valid credentials - so the patch backlog and MFA gaps you already know about are the shared attack surface, and North Korea's $1.5 billion heist and thousands of infiltrated IT workers show the payoff is already being collected.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026