State-sponsored cyberattacks from N. Korea, China, Russia rise 7.5% in 1st half of 2026

Cyberattacks orchestrated by state-sponsored hacking groups from North Korea, China and Russia increased by 7.5 percent in the first half of this year, driven primarily by a sharp surge in early-year activity. According to a threat intelligence report by cybersecurity firm S2W, there were global Advanced Persistent Threat incidents between January and June, up from 147 in the preceding six months. The escalation was overwhelmingly concentrated in the first quarter, reflecting intensified digital offensives from Pyongyang and Moscow. North Korea remained the world’s most active state-backed threat actor, accounting for 99 incidents — a 13.8 percent jump from the previous six-month period. Pyongyang disproportionately targeted South Korea with 19 recorded attacks, followed by eight against the United States. To breach defenses, North Korean actors increasingly weaponized cutting-edge tools, leveraging generative artificial intelligence (AI), deepfakes, compromised code repositories and fraudulent job recruitment schemes. These sophisticated tactics focused heavily on infiltrating cry