Skip to content

Topic

State-Sponsored Hacking

Computer intrusion carried out by or for governments, usually for espionage, data theft, or disruption of rival states.

Current stories

scienceOne report1 publisher

NCSC's Chichester says state hackers now use AI at every stage of an attack on the UK

Paul Chichester, the NCSC's director of operations, says Russia, China, North Korea and Iran all use AI to attack the UK. New Scientist's report of the interview includes no attack counts, so the size of any rise in volume is unstated.

Publishers:newscientist.com

Reality

Evidence30
Adoption35
Hype gap+20
Incentives
Not scored
Confidence35
securityOne report1 publisher

Integrity Tech loses seven domains tied to its Microscan and FishHub tools

DOJ and FBI seized seven domains tied to Integrity Tech's Microscan and FishHub tools, the second action against the Flax Typhoon contractor. The company still had live scanning and phishing infrastructure to seize after the September 2024 botnet takedown.

Publishers:justice.gov

Reality

Evidence55
Adoption
Not scored
Hype gap+15
Incentives60
Confidence55
securityConfirmed5 publishers

Montenegro extradites Amir Barati, accused of hacking US universities for Iran

Montenegro extradited Turkish-Iranian Amir Barati to face US charges over a university hacking campaign that US officials say did $3.4 billion in damage. Where he chose to travel decided the case: police picked him up on holiday in Kotor, nine years after the charged hacking ended.

Perspective Coverage

6 publishers
Builder
Builder 12%
Operator
Operator 77%
Investor
Investor 11%

Reality

Evidence72
Adoption
Not scored
Hype gap+20
Incentives40
Confidence70
securityConfirmed4 publishers

Dream Job now ships a kernel exploit: Lazarus pairs recruiter lures with a fresh AFD zero-day

Check Point says the Operation Dream Job chain now escalates through CVE-2026-68820 to install FudModule v3.1. CISA has told federal agencies to patch by August 25.

Perspective Coverage

4 publishers
Builder
Builder 34%
Operator
Operator 61%
Investor
Investor 5%

Reality

Evidence70
Adoption
Not scored
Hype gap+15
Incentives50
Confidence72
securityConfirmed6 publishers

Cisco's own July 23 log indicator predates its August date for FMC exploitation

CVE-2026-20079 hands unauthenticated attackers root on Secure Firewall Management Center. CISA wants federal boxes fixed by September 12. The hot fix closes the path but does not evict anyone who already walked it.

Perspective Coverage

6 publishers
Builder
Builder 23%
Operator
Operator 65%
Investor
Investor 12%

Reality

Evidence80
Adoption
Not scored
Hype gap+15
Incentives60
Confidence74
productOne report1 publisher

San Francisco's city attorney orders Meta to stop allowing AI child abuse ads its review missed

New research counted roughly 350 of the ads on Meta's platforms, some built from images of real children, and lawmakers have said they will investigate. In the same week Meta launched a personal AI agent it says was built with security and privacy in mind.

Publishers:wired.com

Reality

Evidence56
Adoption58
Hype gap+12
Incentives72
Confidence48