Governments like Russia, China, and Iran are increasingly collaborating with criminal hacking groups to carry out cyber espionage and cyberattacks against adversaries, including the United States, according to a digital threat report released by Microsoft on Tuesday. This growing partnership between authoritarian regimes and cybercriminals is raising concerns among security experts and officials, who warn that it is becoming harder to distinguish between state-sponsored cyber operations and independent criminal activities aimed at financial gain.
The Microsoft report highlights how these alliances are being leveraged to both disrupt rivals and generate profit for cybercriminals. By aligning with criminal hacking networks, these governments can enhance their cyber operations without directly bearing the full cost or resources required for such activities. Meanwhile, hackers benefit from government protection and the opportunity to expand their illicit activities under the umbrella of state support.
Blurring the lines between state and criminal activity
One example cited in the report involves Iranian-linked hackers who targeted an Israeli dating website. The group reportedly infiltrated the platform’s systems, stealing sensitive personal data. According to Microsoft’s analysis, the hackers had dual motives: not only to embarrass and harm Israeli interests but also to profit by either selling the stolen data or leveraging it for financial gain.
Another case involved a Russian criminal network that targeted more than 50 electronic devices used by Ukraine’s military in June. The group appeared to be working in support of Russia’s invasion of Ukraine, seeking access to critical information that could assist military operations. Unlike typical ransomware attacks or financial scams, this operation had no apparent financial motive beyond payments potentially provided by the Russian government.
For authoritarian regimes like Russia, China, Iran, and even North Korea—another country with documented ties to cybercriminal groups—these partnerships represent a mutually beneficial arrangement. Governments gain additional tools to enhance their cyber capabilities, while criminal hackers receive both financial incentives and the implicit promise of protection from prosecution. This “marriage of convenience,” as experts describe it, allows both parties to further their respective goals.
A growing trend in cyber operations
Microsoft’s vice president for security and consumer trust, Tom Burt, noted that the convergence of state-sponsored activities and cybercriminal operations is becoming increasingly common across the globe. “In every country, we’re seeing a trend toward merging the activities of nation-states and cybercriminals,” Burt said.
He emphasized that while there is no evidence yet of direct coordination between Russia, China, and Iran through shared criminal networks, the reliance on private cyber “mercenaries” demonstrates the extent to which these nations are willing to weaponize the internet. By outsourcing certain operations to criminal groups, these governments can obscure their involvement and maintain plausible deniability when conducting cyberattacks.
Strategic advantages for authoritarian regimes
For authoritarian states, the benefits of collaborating with criminal hackers are clear. Partnering with existing cybercriminal networks allows these governments to scale up their cyber activities without developing the necessary infrastructure themselves. In essence, they can outsource the technical expertise required for hacking campaigns while focusing their own resources on broader strategic goals.
This approach also provides an added layer of protection for state actors. By working through criminal intermediaries, governments can distance themselves from direct responsibility for cyberattacks, making it more difficult for targeted nations to respond. Attribution in cyberspace is already a challenge, and the involvement of criminal groups further complicates efforts to hold governments accountable for malicious activity.
For cybercriminals, the arrangement is equally advantageous. State sponsorship provides them with new revenue streams and access to resources they might not otherwise have. Additionally, the implicit protection offered by these governments ensures that hackers face little risk of prosecution, as long as they target individuals or institutions outside their home country.
Implications for global cybersecurity
The increasing overlap between state-sponsored cyber operations and criminal hacking activity poses significant challenges for global cybersecurity. It complicates efforts to identify and attribute cyberattacks, making it harder for nations to respond effectively. Moreover, the involvement of profit-driven criminal groups introduces an additional layer of unpredictability, as their motivations may not always align with those of the states they work for.
While the Microsoft report stops short of suggesting that these nations are coordinating their efforts through shared networks, the growing reliance on private hackers underscores a broader trend: cyber warfare is becoming more decentralized and harder to counter. As the lines between government-sponsored hacking and independent criminal activity continue to blur, the threat landscape evolves, requiring new approaches to defense and deterrence.
For the United States and its allies, addressing this challenge will require not only strengthening cybersecurity defenses but also enhancing international cooperation to hold both state actors and their criminal partners accountable. As the use of cyber “mercenaries” grows, it is clear that the fight against cyber threats will demand greater vigilance and innovation in the years to come.