Adversary Intelligence — 2026-08-17

South Korean Report Finds State-Sponsored Cyberattacks From North Korea China and Russia Rose 7.5 Percent in First Half 2026 With NK Accounting for 99 Incidents

BLUFNorth Korea's pivot to AI-generated lures and supply-chain infiltration signals a qualitative shift that outpaces the 7.5 percent volume increase and strains conventional perimeter defenses across allied crypto and IT sectors.

S2W's first-half 2026 APT threat trends report, released Sunday, tallied 158 state-sponsored cyberattacks from North Korea, China and Russia between January and June, a 7.5 percent rise from 147 in the prior half-year, concentrated in the first quarter and exploiting 15 unique CVEs across 19 incidents 123. North Korea accounted for 99 incidents, up 13.8 percent, striking South Korea 19 times and the United States eight, and increasingly used generative AI, deepfakes, fake job postings and code-repository infiltration against crypto, IT and software targets 24. Russia-linked activity rose 30 percent to 26 incidents from 20, ten against Ukraine and two each against Poland and Romania, blending espionage with destructive attacks on energy and government networks 12. Chinese-attributed incidents fell 17.5 percent to 33, with groups sustaining telecommunications-focused espionage while expanding to eight incidents in Southeast Asia and four in the Middle East 14.

Analysis
North Korea's shift toward AI-generated lures, deepfake identities and code-repository infiltration signals a move from one-off credential theft to persistent access inside software supply chains, widening exposure for crypto and developer platforms beyond the incidents counted. China's falling incident total alongside sustained telecom-focused espionage and expansion into Southeast Asia and the Middle East points to consolidation toward fewer, longer intrusions rather than reduced capability, though the overall rise may instead reflect improved detection and attribution at S2W rather than higher adversary tempo. Russia's parallel growth in espionage and destructive strikes on Eastern European energy and government networks suggests a lower threshold for pairing collection with disruption as the war continues. Sourcing rests entirely on S2W's own report, with other outlets merely recapitulating its figures, leaving defenders' email-based defenses increasingly mismatched against AI-enabled social engineering.

5 sources