Beyond Fancy Bear: An Intelligence Analyst’s Report on Under-the-Radar State-Sponsored Threat Actors

How can quieter, surgical cyber operations reshape national security without ever making headlines?

This unknown state-sponsored hacker groups threat report maps quieter campaigns that hit governments, critical infrastructure, and private organizations. Recent data shows a sharp rise in espionage operations and a 150% surge in Chinese cyber activity in 2024, with sector attacks spiking as much as 300%.

By “under-the-radar” we mean deliberate campaigns that avoid noisy disruption. These operators blend into normal traffic, quietly extract data, and shape outcomes over months.

This synthesis helps executives and security teams prioritize monitoring, tighten controls, and pressure-test incident response. It focuses on supply-chain exposure, cloud risks, and third-party vulnerabilities that amplify U.S. risk.

Read on for methods, regional patterns, sector risks, case files, and prioritized defenses. The goal is simple: tie incidents to concrete TTPs so organizations can act now with evidence-based steps.

Key Takeaways

• Quieter campaigns matter: They steal data and influence without loud disruption.
• Recent spikes: 2024–2025 intelligence shows sustained pressure across telecom, finance, and defense.
• Focus on supply chains: Third-party and cloud links widen exposure even when internal controls look strong.
• Actionable TTPs: This analysis ties incidents to detectable behaviors for faster response.
• Prioritize detection: Small changes in monitoring yield big defensive gains.

Executive context: why lesser-known state actors are eclipsing the headlines

Quiet cyber campaigns often cause the deepest damage because they trade spectacle for steady access. These operations map systems, siphon information, and reshape outcomes long before any outage makes the news.

Recent intelligence shows the global tempo rising. The U.K.’s NCSC recorded a three-fold rise in significant attacks in late 2024, with China linked to multiple breaches of government departments and critical infrastructure.

Ukraine reported a 70% surge in Russian attacks, focused on government services, energy, and defense. Taiwan faced roughly 2.4 million daily attempts against government systems and telecoms in 2024.

• Persistence over spectacle: low-noise campaigns keep long dwell times and take modest data slices to avoid detection.
• Strategic targets: attackers focus on logistics, delivery chains, and service providers that amplify risk for organizations.
• Actionable takeaway: prioritize detection and rapid response for slow, continuous campaigns that erode security over months.

Security leaders must recalibrate risk models to treat continuous campaigns as the default posture. That shift helps protect government assets, commercial organizations, and national infrastructure from quieter adversaries and skilled hackers.

Methodology and attribution caveats that shape this threat report

Our method blends public feeds, vetted advisories, and cyclical reviews to build a defensible dataset. We focus on verifiable signals so security teams get usable evidence rather than speculation.

We rely on open-source intelligence (OSINT) from reputable trackers, primary bulletins, and peer-reviewed research. Quarterly updates let researchers reclassify events as new data arrives. The dataset records espionage, denial-of-service, defacement, sabotage, and doxing since 2005.

How evidence, aliases, and code sharing complicate attribution

Attribution is difficult. False flags, shared malware, and public toolkits blur origin. Multiple aliases can point to the same actor; we map labels to TTPs and foreign-policy context while noting uncertainty.

Bias, incomplete records, and provisional findings

English-language sources skew coverage toward a few countries. Some incidents remain single-source or incomplete, so we treat them as provisional until corroborated by authorities or multiple researchers.

unknown state-sponsored hacker groups threat report: defining “under‑the‑radar” actors and campaigns

Some covert cyber actors favor long, quiet access over headline-grabbing disruption. They trade spectacle for steady collection and clean operational hygiene.

What signals separate emerging crews from classic APTs?

Look for narrow campaign scope, minimal on-host traces, and cloud staging for command-and-control. These operators often use compromised admin paths and targeted emails to pull sensitive data while blending into normal traffic.

• Small target sets: limited roles inside agencies rather than broad domain compromise.
• Stealth exfiltration: staged transfers using collaboration platforms to avoid detection.
• Infrastructure hygiene: short-lived hosts, recycled tooling, and false flags that muddy attribution.

Low-attribution operations versus unclaimed incidents

The OCC case is a clear example. In April 2025, hackers spied on roughly 103 OCC regulators’ emails for over a year, accessing about 150,000 messages via a compromised administrator account. Attribution remains unresolved.

Analysts should weigh targeting logic, timing, and infrastructure overlaps when labels are murky. For context on Russian activity and tactics, see Russian cyber attack campaigns and actors.

China-linked operations: breadth, intensity, and quiet persistence

China-linked campaigns in 2024–2025 tilted toward continuous espionage rather than disruptive attacks. They hit government, finance, media, and manufacturing with measured, long-term collection operations.

Surge indicators

• Intel shows a ~150% rise in espionage and sector attacks up to 300% in finance, media, and manufacturing.
• Salt Typhoon exfiltrated call data and surveillance requests from multiple telecom providers in late 2024.
• December 2024 vendor breach exposed ~3,000 unclassified Treasury files; July 2025 access targeted National Guard network configurations.

Tradecraft and regional focus

Operators favor cloud C2 and living-off-the-land techniques. Dropbox and similar services were used for command channels across Southeast Asia, Taiwan, and Hong Kong.

Analyst takeaway: hunt for quiet lateral movement in government accounts, map telecom access patterns, and monitor third-party services for staged exfiltration.

Russia-aligned activity: espionage, elections, and defense logistics disruption

A pattern of measured interference has emerged, focused on logistics, elections, and persistent espionage. This activity aims to slow NATO-facing delivery chains and strain government workflows while avoiding major outages.

Targeted campaigns since 2024 show consistent use of credential theft and spearphishing to reach military and government systems.

How delivery chains and defense support are targeted

Allies warned in May 2025 of a campaign that seeks to disrupt defense and tech supply links tied to Ukraine. Operators probe logistics systems and service providers to create delays and information gaps.

Credential theft, phishing, and diplomatic lures

December 2024 attacks used phishing against Ukrainian armed forces and defense firms, stealing Telegram and local credentials. Threat actors also pushed HTML application droppers and malicious attachments in diplomatic-themed emails.

Political and public-facing compromises across Europe

Germany’s SPD emails were breached in May 2024. Poland and the Czech Republic reported Outlook exploits against government infrastructure. Romania faced 85,000 attacks on election systems with later credential leaks.

Defender takeaways: harden identity and email controls, monitor for HTML app droppers, and segment systems that support defense logistics. For broader context on cyber operations in the conflict, see cyber operations during the Russo‑Ukrainian war.

Iran’s focus zones: aerospace, defense, and regional government agencies

Iran-linked activity concentrates on aviation and defense professionals using credible recruiter personas. These operations combine social engineering with custom backdoors and hijacked email channels to quietly extract information.

Iranian actors used LinkedIn lures in November 2024 to target aerospace and defense personnel across Israel, the UAE, Turkey, India, and Albania.

How recruitment lures and LinkedIn tradecraft work

Attackers pose as recruiters and send tailored job offers. Documents and offer letters carry hidden malware or exploit macros. Targets open what looks like legitimate hiring material and expose sensitive systems.

Backdoors and hijacked email C2 in Iraq and Yemen

In March 2025, campaigns against Iraqi government entities and Yemen telecom used custom backdoors. Adversaries turned compromised emails into command-and-control channels to pull credentials and move laterally.

Gulf agencies and telecom operators face repeated probes for admin paths and privileged accounts. Defensive steps include hardening hiring workflows, sandboxing employment documents, and logging collaboration platforms for anomalous exfiltration.

North Korea’s dual mandate: espionage and funds theft at global scale

North Korea combines espionage and large-scale theft to finance long-term operations while gaining persistent access to foreign systems. This pattern mixes careful collection with rapid cash-out campaigns that strain digital-asset defenses.

April 2025 reporting shows operatives posing as remote workers to infiltrate European defense and government onboarding flows. These personas win contractor access, escalate privileges, and then extort users or harvest credentials for further movement.

How a $1.5B exchange theft worked

In February 2025, attackers exploited third-party wallet software during a transfer and stole $1.5B in Ethereum from ByBit. Fast laundering—over $160M in 48 hours—highlights mature cash-out pipelines and cross-chain obfuscation.

Reconnaissance using PowerShell and Dropbox

Observers found reconnaissance implants that run PowerShell scripts and use Dropbox as C2. That combo lets actors quietly inventory hosts, collect sensitive data, and stage exfiltration with reduced on-host artifacts.

Defender actions

• Harden contractor provisioning: validate identities and limit lateral access.
• Monitor cloud storage: flag unusual uploads to collaboration services.
• Protect exchanges: enforce key management and software integrity checks to reduce exchange and theft risk.

Emerging and proxied actors beyond the big four: Belarus, Turkey, Algeria, Pakistan

A constellation of proxied campaigns now targets specific governments and services with surgical intent. These actors focus on narrow gains—personnel files, supply details, and administrative access—rather than broad disruption.

Belarusian activity in June 2024 used phishing and malicious Excel attachments to reach Ukraine’s Ministry of Defense and a military base. These tailored attacks aimed to collect operational information and sustain pressure on front-line defenses.

How niche vulnerabilities change battlefield awareness

In May 2025 a Turkish espionage actor exploited a messaging-app zero-day to monitor Kurdish forces in Iraq. This shows how a single vulnerability can yield persistent surveillance and real-time insights.

Large-scale data compromises with strategic leverage

April 2025 saw Algeria-linked intrusion into Morocco’s National Social Security Fund. The leak exposed sensitive personal and financial information for nearly two million people and created broad leverage across the public sector.

Malware and phishing as low-cost force multipliers

Pakistani campaigns in May 2024 used malware-laced emails impersonating officials to target India’s government, aerospace, and defense sectors. These incidents underline how email remains a primary vector for access and escalation.

• Defender priorities: patch high-risk apps, disable legacy macros, and isolate suspicious attachments.
• Operational tip: tune detections for language-specific lures and government-process templates.
• Further context: see the analysis of state-backed cyber operations targeting South Asia for regional patterns and mitigation ideas.

Sector-specific risk patterns: government agencies, telecoms, defense, and finance

Different industries show distinct attack patterns that reveal where defenders must focus limited resources. This section highlights clear examples and the practical steps organizations should prioritize.

Government agencies: email compromise, data theft, and service disruption

Emails and admin accounts are prime entry points. April 2025 breaches exposed 150,000 OCC messages. December 2024 vendor access leaked thousands of Treasury files.

Telecom espionage: call data, lawful intercept requests, and persistent network access

November 2024 Salt Typhoon activity shows how attackers harvest call records and lawful-intercept requests. Persistent footholds in core network systems magnify downstream risk.

Defense and aerospace: supplier networks and technical documentation exposure

July 2025 Naval Group investigations into a 1 TB leak highlight supplier and documentation exposure across the defense supply chain.

Financial regulators, exchanges, and funds theft campaigns

High-velocity theft hit exchanges in 2025, including a $1.5B ByBit loss. Regulators and settlement systems face both data exposure and fast cash-out attacks.

• Action: map telecom and third-party email dependencies.
• Detect: insider-like movement and admin email compromise.
• Coordinate: joint playbooks to cut containment time across organizations.

Supply chain and third-party service provider exposure

Supply chains now act as force multipliers: one compromised vendor can cascade risk across many customers. Recent incidents show how provider failures concentrate sensitive records and give attackers broad, low‑noise access.

The MOVEit exploitation in July 2025 illustrates this plainly. Clop-linked activity touched insurers like Allianz Life and exposed large customer pools via third‑party file transfer software.

How MOVEit and file-transfer abuse ripple through services

Pivoting from a vendor into client systems is fast and stealthy. That attack pattern let adversaries stage exfiltration on shared servers and harvest backups without noisy disruption.

Why contact-center and loyalty platforms matter

• Concentration risk: Co-op’s Azpiral breach and Qantas contact‑center exposures show how outsourced services centralize authentication and customer data.
• Indirect pathways: Orange email platform and vendor access to the U.S. Treasury created routes into enterprise infrastructure.
• Practical steps: enforce contractual security, require SBOMs, and hunt for provider-linked tokens and unusual API use.

Tactics, techniques, and procedures shaping today’s campaigns

Quiet access wins: attackers blend in, take small amounts of data, and wait for advantage. They rely on familiar tradecraft—social engineering, targeted exploits, and cloud staging—to stay below detection thresholds.

Phishing, spearphishing, and impersonation

Initial access remains dominated by phishing and impersonation via email and documents. December 2024 operations used tailored lures against military personnel to steal credentials.

Defenders: enforce attachment isolation, apply content disarm and reconstruction, and run behavioral analytics on script execution.

Zero-days, HTML droppers, and file-based malware

Adversaries exploit zero-day vulnerabilities and drop HTML applications to install file-based malware. A May 2025 campaign in Tajikistan showed how HTML droppers blend into workflows.

Cloud-based C2 and monitoring evasion

Actors leverage Dropbox and similar services for command-and-control and reconnaissance, bypassing standard network monitoring by using allowed destinations.

Defacement, doxing, and pressure operations

Some campaigns add defacement or doxing-adjacent leaks to raise cost and coerce victims. Overlapping TTPs and shared tooling complicate attribution.

• Hunt: look for unusual uploads to collaboration platforms and odd egress patterns to servers.
• Patch: prioritize vulnerabilities in messaging apps and internet-facing systems.
• Control: use domain categorization and conditional access to close cloud C2 blind spots.

Case file: low-attribution and unclaimed incidents with strategic implications

When attribution is absent, defenders must treat access and exposure as facts, not mysteries.
These unclaimed incidents reveal systemic gaps that affect public services, defense programs, and commercial resilience.

OCC regulator email compromise: what the numbers show

In April 2025 a compromised admin account accessed roughly 150,000 emails. The event had long dwell time and no confirmed actor.

Takeaway: harden admin paths, enable rich email telemetry, and shorten detection-to-containment time.

Affidea clinical disruption: patient care and continuity risk

July 2025 disruption at Affidea impacted clinical systems across multiple countries. Interruptions delayed appointments and strained backups.

Takeaway: health providers need resilient failover, segmented systems, and rapid playbooks for care continuity.

Naval Group alleged 1 TB leak: scale and supplier exposure

If validated, July 2025 reports of a 1 TB leak include technical documents on submarines and warships. Such exposure magnifies supplier and program risk.

Takeaway: inventory sensitive repositories and limit broad access to engineering information.

Orange email platform breach: cascading customer impact

July 2025 vendor compromise at an email provider exposed customer personal data and message flows. Dependent organizations faced lost notices and reset vectors.

Takeaway: require proof of provider controls, monitor third-party egress, and assume provider incidents will affect customer communications.

What these incidents teach organizations: unclaimed events still qualify as serious incidents. Preserve evidence quickly, run targeted forensics, and follow playbooks that do not wait for attribution.

Case file: when criminal groups intersect with strategic targets

Criminal extortion campaigns now overlap with strategic espionage targets, exposing gaps in enterprise hygiene. This section reviews three July incidents that show how ransomware and leak actors exploit vendor software, test servers, and central data stores.

Clop and MOVEit: Allianz Life

Clop’s MOVEit exploitation hit Allianz Life customers and highlighted supply-chain risk. The July breach affected most of 1.4M customers after attackers abused file-transfer software to extract sensitive data.

World Leaks: Dell test environments

World Leaks confirmed access to a Dell test lab platform in July. Non-production servers stored customer metadata and config clues that proved valuable to the attackers.

Telefónica and a partial data sample

Telefónica faced a claimed leak tied to a HellCat-associated actor. A 2.6 GB sample of an alleged 106 GB set created ambiguity for response teams and raised pressure on disclosure decisions.

• Common vectors: third‑party software, test servers, and centralized repositories.
• Operational risk: extortion often begins with data exfiltration rather than immediate encryption.
• Defender actions: apply production controls to staging, enforce secrets management, and speed patch orchestration.

Integrate extortion playbooks that align legal, communications, and technical containment so a provider or firm can act fast when data is exposed or threatened.

Signals of hybrid operations: espionage, influence, and infrastructure mapping

Hybrid campaigns now stitch online influence, physical surveillance, and quiet mapping of infrastructure into single, coordinated operations. These blended actions shape perceptions while they collect technical footholds for later access.

How large-scale messaging reaches real people

In February 2025, coordinated WeChat content targeted a public figure and reached roughly 2–3 million users. That volume lets narratives shift public opinion while masking backend operations.

Physical tradecraft at events

November 2024 reporting described a tracking chip hidden in a conference name tag for a former three-star U.S. general. Small devices at gatherings extend digital surveillance into the physical world.

Why stolen configs matter

July 2025 reporting shows theft of National Guard network configurations. Access to these files can let attackers pivot, evade defenses, and craft precise network-level attacks.

• Blend indicators: correlate unusual config access with spikes in platform influence or odd device presence at events.
• Protect repositories: log backups, version control, and restrict config downloads.
• Cross‑team play: security, legal, and communications should set joint escalation criteria for hybrid incidents.

Implications for United States organizations and government agencies

Quiet compromises of administrative paths and vendor services are the most consequential risks for U.S. institutions today. These intrusions target the defense ecosystem, telecom metadata, and sensitive regulator communications that feed national decision-making.

Defense industrial base and critical infrastructure targeting patterns

Suppliers, engineering repositories, and program configs are prime targets. July 2025 reports of National Guard configuration theft show how leaked settings let adversaries plan precise network moves.

Action: assume partial exposure, restrict access to technical data, and enforce least-privilege across supplier accounts.

Telecommunications metadata and lawful intercept risks for users and authorities

November 2024 Salt Typhoon activity accessed call records and lawful-intercept requests across multiple U.S. carriers. That data maps contacts and investigative patterns at scale.

Authorities and organizations must coordinate incident frameworks with carriers and limit bulk access to metadata stores.

Regulator and federal email systems: protecting sensitive institution data

The April 2025 OCC mailbox compromise exposed ~150,000 messages and underscores the risk in admin paths.

Defensive priorities: tighten privileged account controls, enable mailbox auditing, and monitor for subtle lateral movement to cut dwell time and protect critical information.

Priorities for detection, response, and resilience

Effective defense begins with pragmatic, repeatable actions. Focus hunting on cloud channels, harden identity and admin paths, assess providers, and practice incident response so recovery is fast and measured.

How should teams hunt for cloud C2 and stealth exfiltration?

Baseline allowed services and alert on abnormal token use, unusual API calls, and time-based anomalies across systems and network egress.

“Treat collaboration platforms as potential command channels; unusual uploads or token reuse are early signs of compromise.”

What actions harden email, identity, and admin access?

Enforce phishing-resistant MFA, disable legacy protocols, and log privileged session creation. Isolate attachments, rewrite links, and detonate suspicious content before delivery.

How to assess supply chain risk for providers and services?

Catalog dependencies, require secure development evidence, verify secrets management, and demand zero-trust controls from each provider.

How to improve incident response across agencies and firms?

Pre-approve communications, legal pathways, and partner contacts. Run tabletop exercises for provider failure and partial attribution scenarios. Measure recovery time objectives and validate immutable backups.

Note: for coordinated risks affecting critical infrastructure, review the critical infrastructure advisory and align playbooks with partners and providers.

Conclusion

Quiet campaigns have shifted risk from visible outages to long, erosive access. Small footholds now threaten government systems, critical industries, and partner organizations.

Action is clear: instrument for cloud command channels, tighten identity and admin paths, and test incident response against realistic attacks. Harder controls reduce dwell time and limit what attackers can take or misuse.

Protect your crown jewels: treat configuration files, communications, and sensitive data as assets that require strict access controls and continuous monitoring. Scrutinize providers and rotate trust assumptions often.

Resilience is ongoing: align operations, policy, and tech to shorten detection-to-containment windows. Watch emerging low-visibility campaigns and remember: quiet access can seed strategic compromise tomorrow.