APT 2025-2026: Mapping Active State-Sponsored Groups

The ANSSI 2025 Cyber Threat Landscape report confirms what CTI analysts have observed for two years: state-sponsored APT (Advanced Persistent Threat) groups have never been as active, sophisticated, and diverse in their targets. Here is an updated mapping of the main groups and their techniques.

Volt Typhoon, China: pre-positioning in critical infrastructure

Volt Typhoon is the group that has most alarmed Western agencies in 2024-2025. Attributed to China's MSS (Ministry of State Security), this group does not steal data: it pre-positions itself in the networks of critical infrastructure (energy, water, telecommunications, transport) of the United States and its allies.

The presumed objective: to be able to trigger major disruptions in the event of a geopolitical conflict, particularly around Taiwan. CISA, the FBI, and NSA published a joint advisory documenting the compromise of US telecommunications networks, water utilities, and transportation systems.

Signature technique: living-off-the-land (LOtL). Volt Typhoon does not use custom malware. It leverages native Windows tools (PowerShell, WMI, netsh, ntdsutil) for lateral movement, making signature-based detection virtually impossible.

Salt Typhoon, China: telecom espionage

Salt Typhoon compromised at least nine US telecommunications operators in 2024, including AT&T, Verizon, and T-Mobile. The group accessed lawful intercept systems used by law enforcement, potentially obtaining call metadata for government targets.

The scope of this compromise is considerable: CALEA (Communications Assistance for Law Enforcement Act) systems are designed to enable legal wiretaps, and Salt Typhoon turned these systems against their owners. Senator Mark Warner called the incident "the worst telecom hack in United States history."

Sandworm, Russia: cyber warfare in Ukraine

Sandworm (GRU Unit 74455) remains the most destructive group worldwide. Responsible for NotPetya (2017, $10 billion in damages), attacks on the Ukrainian power grid (2015, 2016, 2022), and multiple sabotage operations during the Russia-Ukraine conflict.

In 2024-2025, Sandworm continued operations against Ukrainian energy infrastructure, combining cyberattacks with kinetic strikes. The group uses destructive wipers (CaddyWiper, SwiftSlicer) and malware targeting industrial systems (Industroyer2). ANSSI has warned about similar techniques observed against European entities.

APT28 / Fancy Bear, Russia: all-front espionage

APT28 (GRU Unit 26165) is one of the most prolific groups. Unlike Sandworm (destructive), APT28 focuses on espionage: governments, political parties, media, international organizations, defense sector.

• In 2024, exploitation of vulnerabilities in Microsoft Outlook (CVE-2023-23397) and WinRAR (CVE-2023-38831) to target European organizations

• Spear-phishing campaigns against diplomats, journalists, and NGOs

• Email infrastructure compromise via compromised relays in third countries

Lazarus Group, North Korea: the crypto heist operation

Lazarus Group (Bureau 121, North Korean RGB) is unique: it is the only state-sponsored APT group whose primary mission is financial theft. According to Chainalysis, North Korean groups stole over $1.3 billion in cryptocurrency in 2024 alone, including the Bybit hack ($1.5 billion) and Stake.com.

Techniques are evolving: social engineering targeting blockchain developers via fake LinkedIn job offers, supply chain attacks on npm libraries, DeFi protocol compromise via smart contract vulnerabilities.

Living-off-the-land: the invisible enemy

The dominant technique of 2025-2026 is living-off-the-land binaries (LOLBins). Instead of deploying EDR-detectable malware, attackers use native system tools:

• PowerShell: in-memory payload download and execution

• WMI: lateral movement and persistence

• certutil: file download disguised as certificate operation

• mshta/cscript: malicious script execution

• ntdsutil: Active Directory database extraction

This approach makes behavioral detection essential. An agent like ThreatClaw that analyzes tool usage context (who runs PowerShell, at what time, with what parameters) is more effective than signature-based detection.

How to protect against APTs

• Threat Intelligence: integrate IoCs from APTs targeting your sector via CTI feeds

• Behavioral detection: LOtL techniques are not detected by signatures. An AI agent correlating behaviors is necessary

• Network segmentation: limit lateral movement through microsegmentation

• AD monitoring: Active Directory is the primary target. Monitor GPO modifications, account creations, and abnormal authentications

• Red Team exercises: regularly test your defenses against these groups' documented TTPs

FAQ

Is my company an APT target?

If you operate in defense, energy, telecom, finance, research, healthcare, or technology sectors, or if you are a subcontractor for an organization that does, you are a potential target. APTs work up supply chains: compromising a small vendor to access the enterprise client is a documented tactic.

How to detect living-off-the-land techniques?

Through behavioral analysis: baseline normal usage of PowerShell, WMI, certutil in your environment, then detect anomalies. An advanced EDR combined with a correlation agent like ThreatClaw can distinguish a legitimate system administrator from an attacker using the same tools.

What does ANSSI recommend against APTs?

ANSSI regularly publishes reports on attacker operational modes (MoA sheets). Recommendations include: system hardening, segmentation, privileged account monitoring, network equipment updates, and incident reporting via CERT-FR. Check our plans for guidance.

What is the difference between APT and regular cybercrime?

An APT group is backed by a nation-state, has virtually unlimited resources, and pursues strategic objectives (espionage, sabotage, pre-positioning). A regular cybercriminal is motivated by financial profit and abandons if the target is too difficult. An APT persists for months or years. This persistence justifies continuous monitoring.