Nation-State Cyber Attack Myths: What Threat Actors Actually Do
State-sponsored groups often mimic criminal gangs, use standard commercial tools, and target supply chains rather than launching direct, Hollywood-style assaults on your core infrastructure.
Nation-state actors rarely use custom, exotic malware for initial access. They prefer stolen credentials, compromised vendors, and open-source tools. Defending against them requires detecting abnormal behaviour, not just blocking known malicious signatures or relying on perimeter firewalls.
Myth: They Use Exotic, Custom-Made Malware
Reality: The belief that state-sponsored groups rely solely on bespoke, one-off malware is a dangerous oversimplification. While they do develop sophisticated tools for specific high-value targets, these are often reserved for the later stages of an operation.
In the early phases, these groups frequently use common commercial software or open-source tools. This practice, known as "living off the land," allows them to blend in with normal administrative activity. If you are only looking for unique signatures, you will miss the majority of their movement within your network.
You must treat standard administrative utilities with suspicion when they behave outside their normal patterns. This is why endpoint telemetry is so valuable; it records what applications do, not just what they are called. A standard system utility running in an unusual context is often more dangerous than an unknown executable.
Myth: They Always Aim for Your Core Systems Directly
Reality: Direct attacks on central servers are rare, noisy, and difficult to sustain. State actors prefer indirect routes that minimise their exposure to your defences.
They often target smaller, less secure organisations that have a trusted relationship with your business. This is known as supply chain compromise. By infiltrating a vendor, they gain a trusted foothold in your environment.
Imagine a software update vendor being compromised. The malware reaches your systems through a legitimate update channel, bypassing your perimeter checks entirely. This shifts the burden of security from your direct defences to your third-party risk management.
Myth: Attribution Is Immediate and Accurate
Reality: Determining who is behind an attack is complex, slow, and often inconclusive. Cyber operations are designed to obscure the true origin of the traffic.
Attackers use proxies, compromised servers in other countries, and false flags to mislead investigators. A group may intentionally leave clues pointing to a rival state or a criminal gang. This ambiguity is a feature, not a bug, of their operational security.
You cannot build a defence strategy on the assumption that you will know the attacker's identity in real-time. Instead, focus on the tactics, techniques, and procedures (TTPs) used. Understanding how they move is more actionable than knowing who they are. This aligns with frameworks like STIX and TAXII, which standardise the sharing of threat behaviour data rather than just attribution claims.
Myth: Social Engineering Is Rarely Used
Reality: State actors are highly effective at manipulating human psychology, just like criminal groups. They invest significant effort in reconnaissance to craft convincing pretexts.
Phishing emails, fake job applications, and impersonation of senior executives are common initial access vectors. The goal is to steal credentials or trick a user into running malicious code. This is not a technical failure but a human one.
They may spend months researching your organisation, mapping out relationships, and identifying key personnel. A generic phishing email is easy to spot. A tailored message referencing a recent internal project is not. This is where user and entity behavior analytics becomes critical, flagging accounts that suddenly access data they never touch.
Myth: They Never Use Common Attack Paths
Reality: The most effective attacks are the ones that look like normal noise. State actors have adopted the same playbook as ransomware gangs, including using stolen credentials and exploiting known vulnerabilities.
They may use pass-the-ticket attacks to move laterally within a network without triggering password-based alerts. By capturing authentication tokens, they can impersonate users across the domain.
This means your defences against criminal actors also apply to state-sponsored ones. There is no separate "nation-state" firewall. If you are not detecting PowerShell abuse or anomalous logins, you are vulnerable to both criminal and state actors. The distinction lies in the persistence and resources of the attacker, not the initial method of entry.
See also: Tactics, Techniques and Procedures (TTPs) for Security Decisions · Attacker Reconnaissance Myths: What Your Defenders Actually See
Myth: Detection Relies on Blocking Known Threats
Reality: Signature-based blocking is insufficient for advanced threats. State actors modify their tools slightly to evade detection, rendering static signatures useless.
You need to detect anomalies in behaviour, not just known bad files. This requires a shift from prevention to detection and response. You must assume breach and design your monitoring to catch movement, not just entry.
Network detection and response systems can identify lateral movement and data exfiltration attempts. They look for patterns that deviate from the baseline, such as a server communicating with an external IP at an unusual volume or time.
Myth: Physical Isolation Guarantees Safety
Reality: Air-gapped networks are not immune to cyber attacks. Data can be smuggled out via USB drives, Bluetooth devices, or even acoustic signals.
State actors have demonstrated the ability to bridge the gap between isolated and connected networks. They may infect a removable drive in a connected zone and then introduce it to the air-gapped system.
This requires strict physical security controls alongside technical defences. Monitoring for the insertion of unauthorized storage devices is essential. Port scanning of internal devices can also reveal unexpected connections that bypass network segmentation.
| Myth | Reality |
|---|---|
| They use custom malware | They often use commercial tools and living-off-the-land techniques |
| They attack directly | They target supply chains and trusted partners |
| Attribution is clear | It is often ambiguous and delayed |
| Social engineering is rare | It is a primary initial access vector |
| They use unique paths | They use common attack paths like credential theft |
| Blocking signatures works | Behavioural detection is required |
Key takeaways
- State actors often use commercial software and stolen credentials to avoid detection.
- Supply chain compromise is a primary vector, bypassing direct perimeter defences.
- Attribution is rarely immediate or certain, complicating incident response strategies.
State actors blend in with normal activity and exploit trusted relationships. Focus on detecting abnormal behaviour and securing your supply chain rather than hunting for exotic malware.
Frequently asked questions
How do I detect living-off-the-land attacks?
Implement **detection engineering** practices that baseline normal tool usage and alert on deviations, such as script execution from temporary directories.
Is encryption enough to protect against data theft?
No, encryption protects data at rest but not while it is in use or in memory. Attackers can capture unencrypted data from the screen or memory before it is encrypted.
Should I worry about IoT devices in air-gapped networks?
Yes, IoT devices can be used to bridge the gap. They may have wireless capabilities or be manipulated to exfiltrate data through side channels like sound or light.
How this guide was produced: written by the Phish Herald editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
