State-sponsored hackers, sanctions and conflicts shape which organizations get targeted and what they're allowed to do in response. This page tracks the four states U.S. agencies warn about most, with live updates on state-sponsored activity, sanctions and export controls, all linked to official sources.
Businesses are targets
State actors go after private companies for data, intellectual property, money and access to critical infrastructure, not just governments.
Sanctions limit your options
Paying a ransom, hiring a contractor or using a vendor can break sanctions law if a sanctioned party is involved.
Tensions spill over
Conflicts bring retaliation, hacktivism and supply chain disruption, often against easy targets far from the conflict.
The four state actors U.S. agencies warn about most
Profiles drawn from the U.S. intelligence community's 2026 Annual Threat Assessment and joint advisories from CISA, FBI, NSA and partners. Each links to its sources.
CN
China
Espionage & pre-positioning
“the most active and persistent cyber threat” to U.S. government, private-sector and critical infrastructure networks (ODNI, 2026)
What they want
Large-scale espionage and data theft, plus pre-positioning inside critical infrastructure so it could disrupt operations in a crisis.
Who they target
Government, communications, energy, water, transportation, critical manufacturing, healthcare, IT providers and education.
How they operate
Exploiting flaws in internet-facing routers, VPNs and firewalls
“Living off the land” with built-in admin tools to avoid detection
Password spraying against email and Microsoft 365, then stealing mailboxes and directory data
Intelligence collection and pre-positioning for disruptive attacks, alongside “gray-zone” pressure on countries supporting Ukraine: cyber attacks, disinformation and sabotage, while often denying its role.
Who they target
Government, private-sector and critical infrastructure networks in the U.S. and allied countries, especially those supporting Ukraine.
How they operate
State intelligence and military cyber units, plus criminal groups operating from Russia
Disruptive and destructive attacks alongside espionage
Influence and disinformation operations that accompany cyber activity
Plan for disruptive attacks: tested offline backups and manual fallback for critical operations
Phishing-resistant MFA and prompt patching of known exploited flaws
Brief leaders on disinformation that may accompany an incident
IR
Iran
Retaliation & industrial systems
“persistent intent” to target the U.S. and its allies and partners (ODNI, 2026)
What they want
Espionage and disruptive attacks, often timed to regional tensions, against poorly defended targets. Proxies and hacktivists add less sophisticated but noisy attacks.
Who they target
Water and wastewater, energy and local government facilities, especially industrial control systems exposed to the internet.
How they operate
Exploiting internet-exposed programmable logic controllers (PLCs) and default passwords
Exploiting unpatched software and weak passwords on internet-connected accounts
Working with ransomware affiliates to steal, encrypt and leak data
Verify identity carefully when hiring remote staff, with live video and document checks
Flag mismatched names and payment accounts, and laptops shipped to unexpected addresses
Remember that paying these workers may violate sanctions laws
Live: state activity, sanctions and export controls
Updated automatically from trusted security newsrooms and the Federal Register, the U.S. government's official journal.
Sanctions and export controls: why security teams should care
Ransom payments and sanctions
Treasury's Office of Foreign Assets Control (OFAC) warns that paying a ransom to a sanctioned person or group can violate U.S. law, and that it “may impose civil penalties for sanctions violations based on strict liability”, even if you didn't know who you were paying. Reporting the attack to law enforcement promptly and cooperating fully are significant mitigating factors.
The Commerce Department's Bureau of Industry and Security (BIS) restricts exports to listed companies and countries, including technology and software. Sanctions and export rules can affect who you buy from, sell to and hire.
Screen key vendors and customers against sanctions and export lists
Country names refer to state-sponsored and state-affiliated cyber actors as described by U.S. government sources, not to the people of those countries. Profiles summarize the linked public sources as of October 2026; live sections update automatically and reflect each publisher's reporting. This page is for general awareness and is not legal advice on sanctions or export controls. Strat Cyber Advisors is not affiliated with ODNI, CISA, FBI, NSA, Treasury or Commerce.
