State-Sponsored Cyber Espionage Targeting Defense and Critical Infrastructure

Google Threat Intelligence Group (GTIG) reported that the defense industrial base (DIB) is under sustained, multi-vector pressure from state-backed and aligned actors seeking to steal sensitive military technology, disrupt supply chains, and undermine national security. The report highlights Russian-linked activity focused on unmanned aircraft systems (UAS) and other emerging technologies, including TEMP.Vermin using drone-themed lures to deliver malware and APT44 (Sandworm/GRU) targeting military personnel devices with tooling such as INFAMOUSCHISEL to harvest data from battlefield-related applications; it also notes some Russian operators are using LLMs to improve reconnaissance and social-engineering effectiveness. GTIG also describes North Korea’s continued use of IT-worker/insider placement to generate revenue and access within Western organizations.

Separately, reporting on Transparent Tribe (APT36) describes ongoing espionage campaigns against Indian government and defense targets across Windows and Linux, including spear-phishing that deploys Geta RAT and execution chains abusing legitimate Windows components (e.g., mshta.exe) and XAML deserialization for evasion, alongside a shift toward more mature Linux tooling and persistence. A third report (Picus Labs’ Red Report) is broader trend research rather than a specific incident, claiming ransomware encryption is declining while “sleeperware”/dormant extortion tradecraft is rising based on ATT&CK technique prevalence across large-scale simulation and telemetry; it does not materially add to the defense-sector espionage narrative beyond general attacker TTP trends.