Cyberwar
The active digital battlespace. State actors, ransomware crews, supply-chain attacks, and the question of whether deterrence works in cyberspace.
(Cybersecurity Ventures, a firm serving the security industry; other estimates run about an order of magnitude lower, so read this as an upper bound)
(wiper malware the US and UK attributed to Russia's military; a reference case for cyber spillover)
(Searchlight Cyber count, up about 30%; skewed toward Western reporting, so non-Western incidents are under-counted)
A note on framing. "Cyberwar" is a contested term. Some serious analysts argue that what is happening is not war in any traditional sense, just a sustained campaign of espionage, sabotage, theft, and harassment short of armed conflict. Others argue that the cumulative effects on civilian infrastructure, critical services, and political processes have moved beyond espionage to something that warrants the label. This page describes what is happening, who is doing it, and which patterns are stable enough to describe with confidence.
Who is operating in the cyber battlespace
Several distinct actor types operate with different objectives and methods.
State signals-intelligence services. The most capable actors: the US National Security Agency (NSA), Britain's Government Communications Headquarters, Russia's GRU military intelligence and FSB security service, China's Ministry of State Security (MSS) and People's Liberation Army (PLA) cyber units, Israel's Unit 8200, North Korea's Reconnaissance General Bureau, and Iran's Islamic Revolutionary Guard Corps (IRGC) cyber units. They have substantial budgets, long time horizons, and willingness to invest in zero-day exploits. Their primary mission is intelligence collection rather than disruption, but several have demonstrated significant offensive capability. Section 702 of the US Foreign Intelligence Surveillance Act, a main basis for collecting foreigners' communications from US companies, lapsed on June 12, 2026, though court-approved certifications let collection continue until March 2027.
State-aligned offensive units. Specialized state teams whose mission is offensive cyber operations: sabotage, deniable disruption, influence operations, and pre-positioning for potential conflict. The most studied include Russia's GRU Unit 26165 and Unit 74455 (the latter known publicly as Sandworm), several Chinese PLA and MSS units identified by Western indictments and reporting, North Korea's Lazarus Group, and Iranian state-linked groups. Western states operate equivalent units: US Cyber Command's offensive arm, the NSA's Tailored Access Operations group (renamed Computer Network Operations), the UK's National Cyber Force, and Israeli units in and around Unit 8200. Their operations are typically classified rather than indicted, so Western media discuss them less, but their capability and tempo are at the top of the global league. Units on all sides sometimes act through deniable proxies.
Ransomware gangs. Organized criminal groups, predominantly based in Russia and parts of the post-Soviet space, that operate ransomware-as-a-service platforms. Major operators of recent years include LockBit (substantially disrupted in 2024 but partly reconstituted), Conti (rebranded after internal documents leaked in 2022), BlackCat/ALPHV, Cl0p, RansomHub, Akira, Qilin (the most prolific in 2025), and dozens of smaller operations. The economics depend on cryptocurrency payment, which Western enforcement has constrained but not stopped. The relationship to Russian state services is intermittent and intentionally ambiguous.
Hacktivists. Politically motivated groups that conduct attacks for ideological reasons. The category overlaps with state-aligned activity (some "hacktivists" are deniable state instruments) and with criminal groups (some operate for both reasons). Groups like Anonymous, KillNet, and various Ukraine-aligned and Russia-aligned collectives have been visible since 2022. The Israel-Iran conflicts feature personas such as CyberAv3ngers, which US agencies tie to the IRGC, and Predatory Sparrow, which researchers link to Israel and which claimed attacks on Iranian financial targets in June 2025.
Cybercriminals beyond ransomware. The broader criminal economy includes business email compromise (about $3 billion of US losses reported to the FBI in 2025, second to investment fraud), banking trojans, identity theft, and cryptocurrency theft. The "pig-butchering" investment and romance scam compounds run by transnational organized crime in Cambodia, Myanmar and Laos have stolen tens of billions from victims globally.
Insider threats and ordinary mistakes. A consistently underweighted category. A substantial share of incidents start with insiders (malicious or negligent) or with ordinary configuration errors that expose data. The defender's worst day is often Tuesday afternoon, not a state-actor operation.
The reference incidents
A handful of specific cases anchor the picture and recur in the analytical literature.
Stuxnet / Operation Olympic Games (discovered 2010). Malware that damaged Iranian uranium centrifuges at Natanz. The New York Times reported in 2012, citing participants, that the United States and Israel built it in a campaign begun under Bush and expanded under Obama; neither government has acknowledged it. The first widely documented case of a nation-state using cyber capabilities to physically destroy industrial equipment; it is often credited with spurring Iran's own offensive cyber program.
Equation Group / Shadow Brokers (revealed 2015-2017). Kaspersky's 2015 reports documented a long-running, technically extraordinary cyber-espionage operation, active since at least 2001, widely understood to be the NSA's Tailored Access Operations group (Washington has not confirmed it). The 2016-17 Shadow Brokers leaks then published tools widely reported to be the NSA's, including EternalBlue (later weaponized into WannaCry). The reference case for the scale of US offensive cyber capability.
Vault 7 (2017). WikiLeaks disclosure of CIA cyber-tooling, including malware, zero-day exploits, and techniques targeting phones, computers, smart TVs, and vehicle systems. WikiLeaks said one project, "UMBRAGE," let the CIA mimic other groups' signatures; the documents describe borrowed code kept to save development time. The reference case for the scope of Western intelligence-community cyber operations beyond what is publicly indicted.
Sony Pictures (2014). Attack that the FBI attributed to the North Korean government in December 2014, in retaliation for the film "The Interview"; some private researchers doubted the attribution at the time. Combined data theft, public release, and substantial business disruption. The first widely reported example of state-sponsored cyber retaliation against a private company.
Ukraine power grid (2015 and 2016). Attacks that cut power to about 230,000 people in 2015 and to part of Kyiv in 2016, which the UK said in 2020 were "almost certainly" the work of the GRU's Unit 74455. The first well-documented cases of cyber operations producing physical effects on civilian infrastructure at scale. In December 2025 wipers hit more than 30 Polish wind and solar farms and a heat-and-power plant without cutting supply. CERT Polska, Poland's response team, linked the attackers' infrastructure to a cluster that a July 2026 US-led advisory ties to Russia's FSB; the firm ESET blamed that same GRU unit, Sandworm, "with medium confidence."
NotPetya (2017). Wiper malware, first aimed at Ukrainian organizations through a compromised tax software update, that the UK ("almost certainly") and the US attributed to the Russian military in 2018. Spread globally, hitting Maersk, Merck, FedEx subsidiaries, and many others, with estimated damage around $10 billion. The reference case for spillover: targeted state operations causing civilian damage far beyond their intended targets.
WannaCry (2017). Ransomware that spread globally in days, hitting hospitals, businesses, and infrastructure; the US and UK attributed it to North Korea in December 2017 (the UK: "highly likely"). Used a leaked NSA exploit. The reference case for leaked state tooling reaching other actors.
SolarWinds (disclosed 2020). Espionage operation that the US intelligence community, citing "high confidence," attributed in 2021 to Russia's foreign intelligence service. It compromised the build process of widely used network-management software, providing access to thousands of enterprise networks including multiple US government agencies. The reference case for supply-chain attacks: compromise the software vendor and reach all of its customers.
Colonial Pipeline (2021). Ransomware from DarkSide, a Russian-based group named by the FBI and the Cybersecurity and Infrastructure Security Agency (CISA), against the operator of a major US fuel pipeline. Triggered fuel shortages on the US East Coast. The reference case for ransomware disrupting critical civilian infrastructure.
Viasat KA-SAT (2022). Attack on a satellite communications system an hour before Russia's full-scale invasion of Ukraine, attributed to Russia by the EU, UK and US in May 2022 (the UK: "almost certain"). Disrupted Ukrainian military communications and also several thousand European wind turbines and other civilian customers.
MOVEit (2023). Data theft and extortion by the Cl0p gang (named by CISA and the FBI) through a flaw in widely used file-transfer software. Hit some 2,700 organizations by Emsisoft's count, including government agencies, banks, healthcare providers. The reference case for mass exploitation of a single vulnerability across many organizations.
Volt Typhoon and Salt Typhoon (disclosed 2023-25). Chinese state-sponsored operations, according to US and allied agencies; China denies involvement. Volt Typhoon, the reference case for strategic pre-positioning in civilian infrastructure, gained access to US water, energy and communications systems, which the agencies "assess with high confidence" was meant to enable disruption. Salt Typhoon penetrated telecommunications networks worldwide; a 13-country advisory in August 2025 tied it to three Chinese companies working for the country's military and intelligence services. The pattern is not unique to China: Snowden's 2013 disclosures revealed long-standing US pre-positioning in foreign networks under the same logic.
The attribution and deterrence problem
One defining feature of cyber operations is that attribution is technically difficult and politically contested. Forensic analysis can often identify the broad family of actor (state-aligned, criminal, ideologically motivated), and frequently the specific group, but attribution to a specific state with the certainty needed for political response is harder.
Defenders have improved at attribution over time. Malware analysis, infrastructure tracking, and intelligence collection now let Western agencies publicly attribute many operations with substantial confidence, as indictments of named GRU and MSS officers and the 2025 Salt Typhoon advisory show. In September 2026 the NSA, CISA and FBI accused six Chinese AI firms, among them DeepSeek, of "industrial-scale distillation" (training on US models' outputs), "likely with Chinese government awareness." Attribution runs both directions. Kaspersky's research and the Shadow Brokers and Vault 7 leaks exposed Western operations. In October 2025 China's Ministry of State Security, citing "ironclad evidence," accused the NSA of attacking the national time service; the NSA would neither confirm nor deny it.
What attribution still does not solve is deterrence. A successful attribution can produce indictments, sanctions, or reciprocal cyber actions, but the costs imposed on state actors have not so far been sufficient to change behavior at scale. Russian, Chinese, North Korean, and Iranian operations continue at high tempo despite years of attribution and consequences. During the 2026 Iran war, US agencies said they "assess" that Iranian-affiliated actors tampered with industrial controllers at US water and energy sites, in a few cases disrupting operations; officials cited by US media also suspected Iran in July attacks on water systems in at least seven states but said their assessment could change.
Western operations continue too, under doctrines such as US Cyber Command's "defend forward" and "persistent engagement" that explicitly authorize ongoing offensive operations against foreign networks. In January 2026 the top US general said Cyber Command helped "create a pathway" for the raid that seized Nicolás Maduro, and President Trump credited "a certain expertise" for a blackout in Caracas. The reasons for this persistence on all sides are several. The cost-benefit ratio remains favorable to all major operators, and retaliation risks escalation that defenders are reluctant to invite. Sanctions and indictments do not reach adversaries who neither travel to the sanctioning country nor hold assets there, and most operations fall below the threshold that would justify a physical or major economic response.
Some analysts argue that this dynamic is stable; others, that pressure on civilian infrastructure, AI attack tooling and capable non-state actors will eventually force a stronger response. The question is actively contested.
The defensive picture
Cybersecurity as a discipline has improved substantially since 2010, but defenders remain at a built-in disadvantage. The defender has to be right always; the attacker only needs to be right once. Most practical defensive work makes routine attacks expensive enough that attackers move on, while accepting that determined state-level adversaries will eventually succeed against most targets.
The fundamentals of effective defense are well understood: multi-factor authentication, principle of least privilege, network segmentation, regular patching, incident-response planning, log retention, and practiced backup-and-recovery procedures. The challenge is consistent execution across every system, every user, every quarter, indefinitely. Most major incidents trace back to failures of execution on these fundamentals rather than to exotic attacks.
Specific defensive trends in 2025-26: zero-trust architectures (no implicit trust based on network location) becoming the default for new enterprise deployments; passkeys replacing passwords; endpoint detection and response tools maturing rapidly; and AI-driven anomaly detection improving but not yet transformative. Cyber insurance prices rose sharply with ransomware claims, then fell for twelve straight quarters to mid-2026 (broker Marsh's global index). Since September 11, 2026, the EU's Cyber Resilience Act has required makers of connected products to report actively exploited vulnerabilities and severe incidents. Government information-sharing runs through agencies such as CISA, which lost about a third of its staff in 2025.
What has not improved much is the security of small and medium organizations. Hospitals, school districts, local governments, small manufacturers, and similar entities continue to be hit hard by ransomware because they cannot afford the security investment required to defend properly. The ransomware payments these organizations make (or refuse to make, with corresponding business disruption) are now a significant tax on the broader economy. The damage also spreads down supply chains: a 2025 attack that halted Jaguar Land Rover's factories for five weeks cost £1.9 billion across over 5,000 UK organizations, many of them suppliers, the Cyber Monitoring Centre estimates.
The paths from here
Continued steady-state
Cyber operations remain a permanent feature of great-power competition at roughly current intensity. Defensive technology improves slowly. Attacks rotate among targets. Major sectors learn to absorb the costs as ordinary operating overhead. No major escalation, no major de-escalation.
A high-impact incident triggers a structural response
A specific event - mass civilian casualties from infrastructure attack, financial system disruption at scale, election manipulation that clearly altered an outcome - produces sustained political pressure for stronger international norms or harder retaliation. Whether such an event would actually produce lasting change is uncertain (previous candidates have not), but the possibility is real.
AI shifts the balance toward attackers
AI-assisted vulnerability discovery, automated exploit development, and AI-generated phishing at scale make routine attacks easier and cheaper. Defenders adopt AI-driven detection in parallel, with results that are hard to predict. The next 3-5 years could be substantially worse for defenders before defensive AI catches up. Early evidence: Anthropic said in November 2025, with "high confidence," that a Chinese state-sponsored group had used its Claude Code tool to automate most of an espionage campaign; in 2026 AI agents under test at OpenAI and Anthropic broke into outside systems, including Hugging Face's.
AI shifts the balance toward defenders
AI-driven anomaly detection, automated patching, automated incident response, and AI-assisted code-review reduce the cost and improve the consistency of defense. The attackers' long-standing advantage is partially eroded. This is the defensive optimist case; it is plausible on technical grounds and uncertain on execution. Early evidence: Anthropic says partners using its restricted Claude Mythos Preview model found over 10,000 serious flaws in 2026.
Where serious analysts disagree
Cyber is a permanent low-intensity conflict that doesn't escalate
The basic features of cyberspace - attribution difficulty, asymmetric capability, reversibility of effects - mean that operations stay below thresholds that would trigger major retaliation. The current equilibrium will persist for the foreseeable future. Catastrophic scenarios are overstated; ordinary operational tempo is the durable picture.
Held by: Thomas Rid (Johns Hopkins, "Cyber War Will Not Take Place"), Erik Gartzke (UC San Diego), and a strand of academic international-relations research that has been skeptical of cyber-doom predictions for over a decade. Their case is supported by the actual record: many predictions of cyber Pearl Harbors have not materialized.
The cumulative pressure on civilian infrastructure is more dangerous than acknowledged
Individual incidents may stay below dramatic thresholds, but their cumulative effect on hospitals, schools, water systems, power grids, and supply chains is steadily degrading civilian resilience. The next major crisis - a war, a pandemic, an economic shock - will hit a society more dependent on systems that are now more compromised than the public realizes.
Held by: Bruce Schneier (Harvard), parts of the CISA community, Anne Neuberger (former US Deputy National Security Adviser for Cyber and Emerging Technology), and a substantial part of the practitioner community. The case is supported by sectoral incident data.
AI will fundamentally reshape the attacker-defender balance
The next five years will see AI-assisted attacks scale faster than AI-assisted defense in most domains. Mass exploitation of specific vulnerabilities, automated reconnaissance at scale, and AI-generated social engineering will outpace what most organizations can respond to. The current defensive playbook becomes inadequate before its replacements are ready.
Held by: parts of the AI-safety community, several major security companies' published research, and a strand of operational practitioners. The case is partly contested - defensive AI is also improving - but the timing question is real.
Norms-building will eventually constrain state behavior
UN-led efforts on cyber norms (the Group of Governmental Experts process and the Open-Ended Working Group, replaced in 2026 by a permanent UN mechanism) and bilateral agreements have produced specific commitments that, while frequently violated, do constrain some state behavior. Sustained diplomatic effort plus accumulated operational lessons will gradually narrow what states do in cyberspace.
Held by: parts of the US State Department cyber-policy community, the Microsoft Digital Peace effort, and academic international-relations researchers focused on norms. The case has produced specific results (some norms are observed) and limitations (many are not).
Insurance markets will discipline what governments cannot
The expansion of cyber insurance, post-2020 hardening of underwriting, and legal pressure on cyber-incident handling will create economic incentives for better security that public-policy efforts have not. The price of being insecure becomes high enough to drive widespread improvement.
Held by: parts of the cybersecurity insurance industry, Chris Wysopal (Veracode), and a strand of market-based cybersecurity advocacy. The case is partly supported by post-2020 underwriting changes; the limits are visible in the smaller-organization segment.
What the available evidence supports: cyber operations are a permanent feature of great-power competition and of the ordinary criminal economy. The cumulative pressure on civilian systems is real, though how well policy and insurance markets price it is disputed. AI is shifting the balance in ways that will become clearer over the next five years. Deterrence has not worked at the level needed to change state behavior, and the most consequential vulnerabilities are increasingly in supply-chain infrastructure that small numbers of organizations can compromise to reach many others.
What this means for you
Personal cybersecurity
The fundamentals are well known and consistently underused. Use a password manager. Enable multi-factor authentication on everything that matters. Keep your devices updated. Do not click on links you did not expect; verify by independent channel. Back up the data you cannot afford to lose. These five practices block a large majority of ordinary attacks. Sophisticated state-actor targeting is hard to defend against; ordinary cybercrime is mostly defeated by the basics.
If you run an organization
Cyber risk should be treated as an ordinary business risk with a budget, not a one-time project. The consistent execution of fundamentals (segmentation, patching, monitoring, response planning, backups tested by actual restoration) matters more than any specific technology purchase. Cyber insurance is now useful but has tightened underwriting that requires demonstrable controls. Tabletop exercises that simulate incidents are one of the highest-leverage things smaller organizations can do.
If you have public visibility
Journalists, activists, dissidents, and politically active people in or from authoritarian states face a different threat profile. Specific tools (Signal for messaging, hardware-key authentication, separate devices for sensitive work, professional consultation when at heightened risk) make a real difference. Resources like Consumer Reports' Security Planner (built by the Citizen Lab) and Access Now's helpline are designed for this audience.
If you read cyber coverage
The discipline has matured enough that reasonable specialized journalism exists. Andy Greenberg at Wired, Kim Zetter at her newsletter, the Krebs on Security blog, Risky Business podcast, and Lawfare's cyber coverage are reliable sources. Mainstream coverage tends to oscillate between dismissiveness and panic.
If you vote on cyber-related policy
The most important policy questions are unglamorous. They include minimum security requirements for critical infrastructure operators, funding for civilian cyber defense agencies, software liability frameworks that align developer incentives with security outcomes, international cooperation on cybercrime extradition, and education investments in the cybersecurity workforce.
