Nation-State Threats

Report to CISA

Overview

As a nation, we are seeing continued cyber and physical threats targeting critical infrastructure Americans rely on every day.  Nation-state actors and nation-states sponsored entitiespose an elevated threat to our national security. On the cyber front these adversaries are known for their advanced persistent threat (APT) activity:

• The Chinese government—officially known as the People’s Republic of China (PRC)—engages in malicious cyber activities to pursue its national interests including infiltrating critical infrastructure networks.
• The Iranian government—officially known as the Islamic Republic of Iran—has exercised its increasingly sophisticated cyber capabilities to suppress certain social and political activity, and to harm regional and international adversaries.
• The North Korean government—officially known as the Democratic People’s Republic of Korea (DPRK)—employs malicious cyber activity to collect intelligence, conduct attacks, and generate revenue.
• The Russian government—officially known as the Russian Federation—engages in malicious cyber activities to enable broad-scope cyber espionage, to suppress certain social and political activity, to steal intellectual property, and to harm regional and international adversaries.

APT actors are well-resourced and engage in sophisticated malicious cyber activity that is targeted and aimed at prolonged network/system intrusion. APT objectives could include espionage, data theft, and network/system disruption or destruction. Organizations within the cybersecurity community conducting APT research assign names/numbers to APTs upon discovery. Because more than one organization engages in APT research, and there may be overlaps among APTs, there can be multiple names for a single APT. There is no ultimate arbiter of APT naming conventions. For examples of APT listings, see MITRE ATT&CK’s^® Groups, Mandiant’s APT Groups, and Microsoft’s Threat Actor Naming Taxonomy.

Note: Although CISA uses the APT names that the cybersecurity community most prevalently uses, any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.

CISA's Role

Improve Your Resilience Against Nation-State Threats

CISA consistently collaborates with cybersecurity community partners to provide the public with timely advisories to defend against APT cyber threats. Proactive steps to improve your steady state cyber resilience against these threats include: