Google Threat Intelligence Group (GTIG) has published a comprehensive report revealing persistent cyber operations targeting the defense industrial base (DIB) from Russia and China-linked threat actors. The findings detail how state-sponsored hackers are exploiting everything from battlefield messaging apps to edge network devices to compromise defense contractors, military personnel, and the broader supply chain.
Key Findings
The GTIG report identifies several distinct threat patterns:
- Russian actors are actively targeting defense technologies deployed in Ukraine, with particular focus on unmanned aircraft systems (UAS) and secure messaging applications
- China-nexus groups represent the most active threat by volume, increasingly exploiting edge devices and appliances for initial access
- North Korean IT workers continue infiltrating defense organizations through the hiring process
- Iranian espionage actors are spoofing recruitment portals to target defense contractor employees
Russian Targeting of Ukraine Defense Technologies
Multiple Russian threat clusters are conducting sophisticated campaigns against Ukraine’s military technology ecosystem:
APT44 (Sandworm)
Attributed to GRU Unit 74455, APT44 continues attempting to exfiltrate data from Signal and Telegram encrypted messaging applications, likely via physical access to devices obtained during military operations. The group deploys WAVESIGN, a Windows Batch script for decrypting and stealing Signal Desktop data, and INFAMOUSCHISEL malware targeting Android devices running Ukrainian military applications.
TEMP.Vermin
Linked to security agencies of the Luhansk People’s Republic, this actor deploys malware including VERMONSTER, SPECTRUM, and FIRMACHAGENT via lure content themed around drone production, anti-drone defense systems, and video surveillance.
UNC5125 and UNC5792
These clusters target frontline drone units through fake questionnaires purporting to be from drone training academies, and compromise Signal accounts by exploiting the device-linking feature. UNC5125 has delivered the MESSYFORK backdoor to Ukrainian UAV operators, while UNC5792 uses altered “group invite” pages to link actor-controlled devices to victims’ Signal accounts.
UNC5976
Since January 2025, this cluster has conducted phishing campaigns delivering malicious RDP connection files, with infrastructure spoofing defense contractors from the UK, US, Germany, France, Sweden, Norway, Ukraine, Turkey, and South Korea.
China-Nexus: The Most Active Threat
GTIG’s analysis reveals that China-nexus groups represent the highest volume of state-sponsored cyber espionage intrusions against the defense industrial base over the past two years. Key observations include:
- UNC3886 and UNC5221 exemplify how Chinese APTs increasingly target edge devices and appliances for initial access
- Unlike the tactical battlefield focus of Russian operations, Chinese intrusions appear oriented toward preparatory access and R&D theft missions
- The targeting of network edge infrastructure poses significant risks as these devices often lack traditional endpoint detection capabilities
Supply Chain and Ransomware Risks
The report highlights that manufacturing has been the most represented sector on ransomware data leak sites since 2020. While dedicated defense organizations represent a small fraction, many manufacturing companies provide dual-use components for defense applications, creating cascading supply chain risks.
The ability to surge defense component production during wartime can be severely impacted by ransomware intrusions—even when attacks are limited to IT networks.
Evasion Tactics on the Rise
A consistent theme across these campaigns is the increasing sophistication of detection evasion:
- Targeting personal devices and accounts outside enterprise security visibility
- Focusing attacks on single endpoints and individuals rather than broad network compromise
- Exploiting edge devices that lack traditional EDR coverage
- Using legitimate cloud services and supply chain vectors to blend with normal traffic
Implications for Defense Organizations
This report underscores the need for defense contractors and military organizations to:
- Extend security monitoring to personal devices and messaging applications used for sensitive communications
- Harden edge infrastructure including firewalls, VPN appliances, and network devices with regular patching and monitoring
- Implement robust hiring verification to detect IT worker infiltration schemes
- Assess supply chain security for dual-use component providers vulnerable to ransomware
- Train personnel on social engineering tactics including fake recruitment portals and phishing via messaging apps
As modern warfare increasingly extends into cyberspace, the defense industrial base remains a critical target. Organizations must adapt their security postures to address threats that increasingly operate outside traditional enterprise boundaries.
Source: Google Threat Intelligence Group
