Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber Operations

State-Sponsored Defense Sector Multi-Nation Coordination Supply Chain Attack

Overview

Google's Threat Intelligence Group discovered persistent, multi-vector cyber operations by state-linked threat clusters associated with China, Iran, Russia, and North Korea targeting defense sector systems, personnel, supply chains, and technologies. These operations focus on modern warfare systems including drones, autonomous vehicles, battlefield communications, and security products used by defense contractors and government agencies. The attackers leverage personal recruitment processes, secure messaging apps, and edge devices to bypass traditional defenses, employing sophisticated social engineering, phishing, custom malware, and obfuscation techniques to maintain persistent access and exfiltrate sensitive intelligence.

Technical Specifications

Attribute	Details
Incident Type	State-sponsored coordinated cyber operations
Threat Actors	China, Iran, Russia, North Korea-linked clusters
Primary Targets	Defense sector, contractors, supply chain, personnel
Attack Vectors	Phishing, social engineering, edge device exploitation, malware
Malware Families	VERMONSTER, MESSYFORK, COOKBOX, GREYBATTLE, STALECOOKIE, GALLGRAB, INFINITERED
Key Techniques	Credential theft, data exfiltration, persistence, lateral movement, obfuscation
Scope	Multi-national coordinated operations, ongoing campaigns

Threat Actors & Attribution

China-Linked Clusters

• UNC6508: Targeted U.S. research institutions using REDCap exploits to deliver INFINITERED malware for persistent access and credential theft
• UNC3236 (Volt Typhoon): Conducted reconnaissance against North American military and defense contractor login portals using ARCMAZE obfuscation framework
• APT5 (Keyhole Panda, Mulberry Typhoon): Targeted aerospace and defense contractor employees with tailored phishing campaigns

Russia-Linked Clusters

• UNC5976: Conducted phishing campaigns delivering malicious RDP files mimicking Ukrainian telecommunications companies
• UNC6096: Delivered malware via WhatsApp using DELTA-themed lures; Android GALLGRAB malware targets battlefield application data
• UNC5114: Deployed CraxsRAT variants masquerading as Kropyva combat control system updates

Iran-Linked Clusters

• UNC6446: Used resume builders and personality tests to distribute custom malware targeting aerospace and defense sectors in the U.S. and Middle East

North Korea-Linked Clusters

• UNC2970 (Lazarus Group): Conducted Operation Dream Job campaigns targeting aerospace, defense, and energy sectors using AI-assisted reconnaissance
• UNC1549 (Nimbus Manticore): Attacked Middle Eastern aerospace, aviation, and defense industries with MINIBIKE, TWOSTROKE, DEEPROOT, CRASHPAD malware families

Ukraine-Focused Threat Actors

• APT44 (Sandworm): Executed Signal and Telegram data theft operations via physical device access; deployed WAVESIGN batch script for Signal decryption
• TEMP.Vermin (UAC-0020): Distributed VERMONSTER, SPECTRUM, FIRMACHAGENT malware using drone production and defense system lures
• UNC5125 (FlyingYeti, UAC-0149): Targeted frontline drone units with Google Forms reconnaissance and MESSYFORK/COOKBOX malware; deployed GREYBATTLE Android trojan spoofing Ukrainian AI companies
• UNC5792 (UAC-0195): Exploited Signal's device linking feature to hijack accounts targeting Ukrainian military, government entities, and organizations in Moldova, Georgia, France, and the U.S.
• UNC4221 (UAC-0185): Targeted Ukrainian military messaging apps using STALECOOKIE Android malware mimicking DELTA battlefield platform; delivered TINYWHALE via ClickFix

Additional Threat Actors

• APT45 (Andariel): Targeted South Korean defense, semiconductor, and automotive sectors with SmallTiger malware
• APT43 (Kimsuky): Deployed THINWAVE backdoor via infrastructure mimicking German and U.S. defense entities

Affected Products

• Defense sector organizations and contractors
• Government defense agencies and military personnel
• Supply chain partners and third-party vendors
• Personnel employed in defense roles and executives
• Standalone edge devices and unmanaged appliances
• Secure messaging platforms (Signal, encrypted apps)
• Defense technologies (drones, autonomous systems, communications equipment)
• Status: Ongoing active operations

Technical Details

Malware Families & Tools

• VERMONSTER: Reconnaissance and credential theft
• MESSYFORK/COOKBOX: Data exfiltration and persistence mechanisms
• GREYBATTLE: Remote access and lateral movement capabilities
• STALECOOKIE: Command-and-control communication
• GALLGRAB: Credential harvesting and account enumeration
• INFINITERED: Multi-stage payload delivery and exploitation

Attack Techniques (TTPs)

Social Engineering & Phishing

• Fake Google Forms designed to appear legitimate
• Resume builders and resume submission portals (typosquatting)
• Personality tests and psychological profiling lures
• Recruitment-oriented social engineering targeting job seekers
• Tailored phishing with organization-specific customization
• Business development and partnership opportunity scams

Malware Delivery

• Spoofed RDP files with embedded malicious code
• Malicious Android applications impersonating legitimate tools
• Trojanized software installers and update packages
• Malicious archives (ZIP/RAR) with multi-stage payloads
• Faux software updates and patches
• Watering hole attacks on defense industry websites

Infrastructure & Obfuscation

• Operational Relay Box (ORB) networks for traffic obfuscation
• Compromised third-party infrastructure for C2 communication
• Proxy chains and VPN obfuscation to complicate attribution
• Use of legitimate cloud services for command infrastructure
• Exploitation of edge devices and unmanaged appliances as pivot points
• Signal and encrypted messaging platform abuse for exfiltration

Credential & Data Harvesting

• Signal application hijacking techniques
• Encrypted messaging file exfiltration bypass methods
• Credential theft via keylogging and form interception
• Session token theft and account takeover
• Supply chain credential enumeration and harvesting
• Personnel communications and metadata extraction

Attack Scenario

1. Reconnaissance Phase:

   • Profile defense entities using public information (LinkedIn, company websites, job boards)
   • AI-assisted tools identify key personnel, decision-makers, and technical staff
   • Research supply chain partners and third-party vendors
   • Map organizational structure and technology infrastructure

2. Initial Access Vectors:

   • Send targeted phishing emails to defense personnel with tailored recruitment lures
   • Distribute spoofed Android applications impersonating legitimate tools
   • Compromise edge devices and unmanaged appliances for network access
   • Watering hole attacks on defense industry or supply chain partner sites
   • Social engineering via recruitment portals or business development channels

3. Execution & Delivery:

   • Deliver tailored malware via fake installers, fake update notifications, or survey lures
   • Use personally crafted social engineering designed for specific targets
   • Employ multi-stage payload delivery to evade detection
   • Leverage suppressed notification techniques to hide execution

4. Persistence & Data Theft:

   • Establish persistent backdoors on compromised systems
   • Harvest credentials from local authentication systems
   • Exfiltrate sensitive defense data and intellectual property
   • Steal personnel credentials for lateral movement
   • Monitor internal communications and gather intelligence

5. Lateral Movement & Expansion:

   • Use harvested credentials to access additional systems
   • Pivot through compromised edge devices and appliances
   • Establish C2 communication through ORB networks for stealth
   • Move laterally across supply chain and partner networks
   • Establish backup persistence mechanisms for long-term access

6. Data Exfiltration & Impact:

   • Exfiltrate classified or sensitive defense data
   • Steal intellectual property related to weapons systems, drones, communications
   • Harvest personnel data and internal communications
   • Maintain persistent access for ongoing intelligence gathering
   • Share intelligence among coordinating nation-states

Impact Assessment

Defense Industry CompromisePersonnel & Credential CompromiseNational Security Impact

• Theft of classified and sensitive defense intellectual property
• Compromise of weapons system designs (drones, autonomous vehicles, communications)
• Access to defense contractor networks and ongoing projects
• Intelligence gathering on military capabilities and strategies
• Supply chain disruption and partner network compromise

• Theft of personnel credentials and security clearances
• Exposure of personal information for blackmail/extortion
• Account takeover of personal and work accounts
• Access to personal devices and communications
• Recruitment of compromised personnel as unwitting assets

• Loss of technological advantage in modern defense systems
• Exposure of military strategy and operational plans
• Degradation of trust in organizational security infrastructure
• Increased vulnerability of defense supply chain
• Multi-national intelligence sharing between coordinated state actors
• Potential influence on military capabilities and national defense posture

Mitigation Strategies

Immediate Detection & Response

• Threat Hunting: Deploy advanced threat intelligence and behavioral analytics for APT detection
• Incident Investigation: Audit systems for indicators of compromise (IOCs) from identified malware families
• Credential Audit: Review access logs for unusual credential usage or lateral movement
• Device Cleanup: Identify and remediate compromised personal and corporate devices
• Supply Chain Assessment: Contact potentially compromised supply chain partners for incident coordination

Zero Trust Architecture Implementation

• Continuous Verification: Enforce multi-factor authentication (MFA) for all access
• Least Privilege: Reduce default permissions and enforce role-based access control (RBAC)
• Network Segmentation: Isolate defense systems and data from general corporate networks
• Device Verification: Implement endpoint detection and response (EDR) for all devices
• Behavioral Monitoring: Alert on anomalous user behavior and lateral movement attempts
• Assume Breach: Design defense systems assuming perimeter compromise is possible

Secure Messaging & Communications Policy

• Messaging Platform Controls: Monitor or restrict use of external secure messaging platforms (Signal, Telegram) for sensitive communications
• Approved Channels: Direct all sensitive communications through government-approved encrypted channels
• DLP Integration: Implement Data Loss Prevention (DLP) on all communications channels
• Personal Device Policy: Enforce strict policies on use of personal devices for work communications
• Audit & Monitoring: Log and audit all sensitive communications for suspicious patterns

Supply Chain Risk Management

• Vendor Security Assessment: Audit supply chain partners and third-party vendors for security controls
• Third-Party Access Controls: Restrict and monitor third-party access to critical systems
• Software Bill of Materials (SBOM): Require and audit all software dependencies for vulnerabilities
• Secure Procurement: Verify authenticity and integrity of all software before installation
• Regular Audits: Conduct continuous security assessments of supply chain components

Employee Training & Awareness

• Phishing Resistance: Implement regular phishing simulations and interactive training
• Social Engineering Awareness: Train employees on recruitment scams and spoofed portals
• Security Culture: Develop security-first culture with reporting mechanisms for suspicious activity
• Cleared Personnel Training: Specialized training for personnel with security clearances on nation-state targeting
• Supply Chain Awareness: Educate supply chain partners on coordinated targeting

Long-term Defense Posture

• Advanced Threat Intelligence Sharing: Participate in information sharing with government and industry partners
• Behavioral Analytics: Deploy AI-driven behavioral analysis for anomaly detection
• Deception Technology: Implement honeypots and decoys to detect attacker movement
• Continuous Monitoring: Maintain 24/7 security operations center (SOC) for threat response
• Government Coordination: Work with national security agencies and defense counterintelligence

Resources and References

News Coverage

• Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber Operations
• Hacktivists, State Actors, Cybercriminals Target Global Defense Industry - SecurityWeek
• Google flags sustained cyber pressure on defense industrial base - Industrial Cyber
• State-sponsored hackers targeting defence sector employees, Google says - The Guardian
• Threats to the Defense Industrial Base - Google Cloud Blog

---

Last Updated: February 15, 2026