A new report by Microsoft has exposed how Russia, China, and Iran are increasingly enlisting criminal networks to conduct cyberespionage and hacking operations against nations they consider hostile, such as the U.S.
The revelation underscores the blurring of lines between state-directed activities and the illicit pursuits of cybercriminals, causing concern for national security officials and cybersecurity experts alike.
The report reveals how authoritarian governments are leveraging the skills of criminal hackers to enhance their cyber capabilities without incurring additional costs.
For these states, the partnership increases the scale and effectiveness of cyber operations, while providing hackers with new opportunities for profit and a semblance of official protection.
One striking case highlighted by Microsoft involved a criminal group with ties to Iran that successfully infiltrated an Israeli dating site, attempting to sell or ransom the personal data it obtained.
This operation appears to have dual motives: to embarrass Israelis and generate financial gain.
In another incident, a Russian criminal network accessed over 50 electronic devices used by the Ukrainian military in June, likely seeking intelligence to support Russia’s ongoing invasion.
But the group did not appear to be motivated by financial gain, apart from possible remuneration from the Russian government.
Tom Burt, Microsoft’s vice president of customer security and trust, said: “We’re seeing in each of these countries this trend towards combining nation-state and cybercriminal activities.”
However, he stressed that there is currently no evidence of resource-sharing between Russia, China, or Iran in their collaborations with criminal networks.
Microsoft’s analysis of cyber threats from July 2023 to June 2024 revealed that its clients face over 600 million cyber incidents daily, utilizing tactics such as hacking, spear phishing, and malware.
A hooded man with a laptop. Inset, Microsoft logo in Issy-les-Moulineaux, outside Paris, France, April 12, 2016. Russia, China and Iran are expanding their partnerships with cyber criminals to conduct cyberespionage and cyberattacks against the U.S. and other nations, according to a new report from Microsoft.
Tim Goode/PA via AP/Michel Euler/AP
Russia’s cyber operations have primarily targeted Ukraine, focusing on military and government systems while disseminating disinformation aimed at undermining international support for its war efforts.
Ukraine has actively countered these initiatives, launching its own cyber operations to disrupt Russian state media.
Additionally, networks linked to Russia, China, and Iran have targeted American voters through fake websites and misleading social media accounts, particularly concerning the upcoming 2024 election.
Microsoft analysts echo U.S. intelligence assessments that Russia is focusing on Vice President Kamala Harris‘s campaign, while Iran is reportedly attempting to undermine former President Donald Trump‘s candidacy.
Iran has also hacked into Trump’s campaign efforts, seeking to exploit the information against Democrats. Federal officials have accused Iran of covertly supporting protests in the U.S. related to the Gaza conflict.
Burt predicts an acceleration in cyber operations from both Russia and Iran targeting the U.S. as election day approaches.
Meanwhile, China has predominantly concentrated its disinformation efforts on down-ballot races, continuing its cyber activities aimed at Taiwan and other regional nations.
A spokesperson for China’s embassy in Washington dismissed the claims as baseless, accusing the U.S. of spreading disinformation about Chinese hacking threats.
“Our position is consistent and clear. China firmly opposes and combats cyber attacks and cyber theft in all forms,” said spokesperson Liu Pengyu.
Both Russia and Iran have also rejected accusations regarding their cyber activities targeting Americans.
Recently, federal authorities announced plans to seize hundreds of domains used by Russian operatives to disseminate election disinformation and target former U.S. military and intelligence figures.
However, investigations from the Atlantic Council’s Digital Forensic Research Lab revealed that seized websites can quickly be replaced; within a day of the Department of Justice‘s actions, researchers identified 12 new sites emerging to fill the void. One month later, many of these new sites remain operational.
This article contains additional reporting from The Associated Press
