state-sponsored-espionagegovernment-diplomatic-threatinitial-access-methodperimeter-device-exposure

Google GTIG Warns of Intensifying Nation-State Targeting of the Defense Industrial Base

Threat Actor Intelligence · 2 sources · Updated 4mo ago · First seen Feb 13, 2026

Google’s Threat Intelligence Group (GTIG) reported sustained and expanding cyber operations against the defense industrial base (DIB) by state-linked and aligned actors from China, Iran, North Korea, and Russia, driven by battlefield technology demands and geopolitical conflict. Reported themes include targeting defense organizations supporting the Russia–Ukraine war, social engineering and recruitment/hiring-process abuse aimed at employees (notably attributed to North Korean and Iranian activity), increased reliance on edge devices and appliances for initial access by China-nexus groups, and heightened supply-chain exposure tied to compromises in adjacent manufacturing ecosystems.

The reporting highlights specific tactics and actor activity, including Russia-linked APT44 (Sandworm) efforts to access data from Telegram and Signal, including use of a Windows batch script (WAVESIGN) to decrypt and exfiltrate data from Signal Desktop after likely obtaining physical access to devices in Ukraine. Additional activity described includes Ukraine-focused campaigns using defense-themed lures (e.g., drones and counter-drone systems) and broader nation-state use of zero-day exploitation in edge devices to establish footholds in defense contractors’ networks, reinforcing GTIG’s assessment that “pre-positioning” and continuous access-building are now baseline expectations for DIB organizations.

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · Feb 13, 2026

Feb 13, 20269mo ago
China-linked actors target contractors via phishing, portals, and edge exploits
China-nexus groups were reported phishing defense contractor personnel, probing contractor portals, exploiting edge infrastructure, and abusing REDCap to implant persistent malware. Researchers also noted use of ORB networks to hinder detection and attribution.
Feb 13, 20269mo ago
Iran-linked campaigns use fake job materials to deliver malware
Iran-aligned operators were reported targeting aerospace and defense personnel in the U.S. and Middle East with resume- and personality-test-themed lures carrying custom malware. The campaigns also included tailored phishing and job-portal abuse aimed at defense workers.
Feb 13, 20269mo ago
North Korean actors abuse defense hiring and IT worker channels
Researchers reported North Korea-linked campaigns targeting defense and aerospace organizations through fraudulent recruitment, direct employee outreach, and IT worker schemes. Some activity also involved credential theft, backdooring attempts, and AI-assisted reconnaissance.
Feb 13, 20269mo ago
Russia-linked clusters target Ukrainian military communications and Android users
GTIG highlighted Russia-aligned activity focused on battlefield-relevant access, including attacks on Ukrainian military communications and Android devices. The operations included abuse of Signal features and Android malware disguised as Ukrainian military tools.
Feb 13, 20269mo ago
Attackers shift to edge-device exploitation for covert pre-positioning
Researchers described a growing tactic of exploiting internet-facing edge devices such as VPN appliances and security gateways to gain initial access and maintain long-term footholds in strategically important networks. This approach emphasizes persistent pre-positioning and evasion over noisier endpoint-focused intrusion methods.
Feb 13, 20269mo ago
State-backed groups intensify targeting of the defense industrial base
Google Threat Intelligence Group and other researchers reported sustained cyber operations against defense industrial base organizations by actors linked to China, Russia, Iran, and North Korea. The activity spans espionage, access-building, credential theft, phishing, and supply-chain targeting across multiple regions.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

17 linked

Andariel Kimsuky UNC5792 Lazarus APT5 Sandworm Volt Typhoon Magic Hound UNC4221 TEMP.Vermin+7 more

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

The Hacker NewsNews · Feb 13, 2026

Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber OperationsOpen source ↗

Dark ReadingNews · Feb 13, 2026

Nation-State Hackers Put Defense Industrial Base Under SiegeOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Google GTIG Warns of Intensifying Nation-State Targeting of the Defense Industrial Base

How this story unfolded

China-linked actors target contractors via phishing, portals, and edge exploits

Iran-linked campaigns use fake job materials to deliver malware

North Korean actors abuse defense hiring and IT worker channels

Russia-linked clusters target Ukrainian military communications and Android users

Attackers shift to edge-device exploitation for covert pre-positioning

State-backed groups intensify targeting of the defense industrial base

Related entities

Threat actors

Sources

See the full picture, correlated to your attack surface.

Related stories

State-Sponsored Cyber Espionage Targeting Defense and Critical Infrastructure

Google Warns of Escalating State-Backed Cyber-Espionage Targeting Europe’s Defense Industrial Base

Reports Highlight China-Led Expansion of Offensive Cyber Operations and Targeting of Defense and Critical Infrastructure

Google GTIG Warns of Intensifying Nation-State Targeting of the Defense Industrial Base

How this story unfolded

China-linked actors target contractors via phishing, portals, and edge exploits

Iran-linked campaigns use fake job materials to deliver malware

North Korean actors abuse defense hiring and IT worker channels

Russia-linked clusters target Ukrainian military communications and Android users

Attackers shift to edge-device exploitation for covert pre-positioning

State-backed groups intensify targeting of the defense industrial base

Related entities

Threat actors

Sources

See the full picture, correlated to your attack surface.

Related stories

State-Sponsored Cyber Espionage Targeting Defense and Critical Infrastructure

Google Warns of Escalating State-Backed Cyber-Espionage Targeting Europe’s Defense Industrial Base

Reports Highlight China-Led Expansion of Offensive Cyber Operations and Targeting of Defense and Critical Infrastructure