State-sponsored cyberattacks from N. Korea, China, Russia rise 7.5% in 1st half of 2026

Image from Gettyimagesbank

Cyberattacks orchestrated by state-sponsored hacking groups from North Korea, China and Russia increased by 7.5 percent in the first half of this year, driven primarily by a sharp surge in early-year activity.

According to a threat intelligence report by cybersecurity firm S2W, there were global Advanced Persistent Threat incidents between January and June, up from 147 in the preceding six months. The escalation was overwhelmingly concentrated in the first quarter, reflecting intensified digital offensives from Pyongyang and Moscow.

North Korea remained the world’s most active state-backed threat actor, accounting for 99 incidents — a 13.8 percent jump from the previous six-month period. Pyongyang disproportionately targeted South Korea with 19 recorded attacks, followed by eight against the United States. To breach defenses, North Korean actors increasingly weaponized cutting-edge tools, leveraging generative artificial intelligence (AI), deepfakes, compromised code repositories and fraudulent job recruitment schemes. These sophisticated tactics focused heavily on infiltrating cryptocurrency markets, IT service providers and software development ecosystems.

Meanwhile, Russian-backed cyberoperations surged 30 percent to 26 incidents, widening their geographic footprint beyond Ukraine. While Ukraine absorbed 10 attacks, Kremlin-linked operatives expanded into Eastern European nations like Poland and Romania. Moscow blended traditional intelligence gathering with destructive, operational-disruption attacks designed to cripple energy grids, government networks and military systems.

In contrast, Chinese state-sponsored activity declined 17.5 percent to 33 incidents. Rather than scaling back, Beijing-linked groups shifted toward stealthy, long-term espionage. Chinese actors maintained a relentless focus on the telecommunications sector while expanding operations into Southeast Asia and the Middle East. To maintain persistent access, they extensively exploited legitimate cloud application programming interfaces, virtual private networks and edge network devices.

Across all three regimes, common intrusion vectors included phishing campaigns, unpatched public server vulnerabilities and the abuse of proxy networks and cloud services. Cybersecurity experts at SBS News and S2W warn that threats to software supply chains, critical infrastructure and developer ecosystems will likely intensify through the second half of the year. Analysts strongly advise organizations to move beyond basic email filtering toward comprehensive, zero-trust security frameworks that safeguard cloud infrastructure, open-source repositories and AI integration platforms.