Inside the mind of an APT: what China, Russia, Iran and North Korea want, and where that leads them in.

Why start from intent

Mandiant's on-demand course Inside the Mind of an APT teaches analysts to start from a state's priorities rather than from its malware. Google Cloud. The idea is simple. A government's priorities decide which organisations its operators are sent after, and what they do once inside. A state under sanctions tasks its hackers with earning money. A state that wants to catch up in technology or military power tasks them with taking research. Defenders tend to guard what they value most, and that is not always what the attacker came for.

The course concentrates on what Mandiant calls the "Big Four": China, Russia, Iran and North Korea. This article applies the same approach to public reporting from the past ten months. For each state, it sets out what it wants, who it hits, how it got in, and what that means for your detection work.

Figure 1. Start from the mandate, then follow it to the way in. Targeting shares are Microsoft's; the "watch first" column is this article's analysis. Original graphic.

What is confirmed

The targeting figures below come from the Microsoft Digital Defense Report 2026, released on 1 October. They are shares of Microsoft's nation-state notifications to customers between July 2025 and June 2026: what Microsoft saw, not all activity. Microsoft Digital Defense Report 2026 (PDF). Microsoft's summary for all four is that they now aim for long-term, trusted access to critical systems, identities and digital ecosystems.

China: collect at scale, and stay

Mandate and targets. Microsoft describes large-scale information collection through long-lived access. The most targeted countries were the United States (27%), Taiwan (24%) and Japan (20%). In last year's report, Japan's share was 4%. The top sectors were IT (15%), government (14%), research and academia (8%) and think tanks and NGOs (7%).

Techniques. Microsoft lists living-off-the-land techniques, covert networks, exploited public-facing applications followed by web shells and remote-access trojans, cloud persistence, and data taken out through compromised or newly created service principals and OAuth applications. It adds that some actors now use AI to look for vulnerabilities.

Cases:

Backup appliance zero-day. On 17 February 2026, Google Threat Intelligence Group (GTIG) reported that UNC6201, a suspected China-nexus cluster, had exploited a zero-day in Dell RecoverPoint for Virtual Machines (CVE-2026-22769) since mid-2024. The cluster deployed the BRICKSTORM backdoor and a newer one, GRIMBOLT. It added temporary network ports to virtual machines on ESXi hosts and used them to pivot into internal and SaaS systems. GTIG.
Extreme dwell time. Mandiant's M-Trends 2026 says espionage groups now optimise for persistence on edge and core network devices that nobody monitors. BRICKSTORM intrusions reached nearly 400 days. M-Trends 2026. GTIG's 2025 report gave an average of 393 days, often longer than victims kept logs. GTIG, BRICKSTORM.
Hiding in other people's devices. On 23 April 2026, sixteen agencies, including Japan's National Cybersecurity Office (NCO), warned that China-nexus actors such as Volt Typhoon and Flax Typhoon route their operations through covert networks of compromised home and small-office routers, IoT devices, firewalls and NAS boxes. Many of these devices are end-of-life. Because each network has many nodes and is shared by several actors, static IP blocklists lose value. The agencies recommend allowlists for VPN access, baselining normal connections, and machine certificates. CISA AA26-113A.

Russia: intelligence, and a new appetite for destruction

Mandate and targets. Russia still concentrates on Ukraine and the states that support it. The most targeted countries were the United States (21%), Ukraine (14%) and the United Kingdom (11%); the top sectors were government (25%), education (13%) and think tanks and NGOs (13%). Microsoft describes less malware and more identity and cloud abuse: OAuth applications, token replay, and adversary-in-the-middle (AiTM) interception at the network edge and at internet service providers.

Cases:

Hijacked home routers. On 7 April 2026, the FBI with the NSA and partners in 15 countries, and separately the UK's NCSC, described an APT28 operation. APT28 is unit 85th GTsSS of Russia's military intelligence agency, the GRU. Since at least 2024, it compromised small-office and home routers, including TP-Link models through CVE-2023-50224, and changed their DHCP settings so that connected laptops and phones used actor-controlled DNS servers. Those servers returned false answers for services such as Outlook on the web. Users who clicked through the certificate warning were exposed to interception. The GRU harvested passwords, authentication tokens and email, then filtered victims for military, government and infrastructure value. The US Department of Justice and the FBI disrupted the router network. FBI PSA; NCSC.
Destruction in Poland. On 29 December 2025, coordinated attacks hit more than 30 wind and solar farms, a combined heat and power plant serving almost half a million customers, and a manufacturer. The aim was purely destructive: damaging controller firmware, deleting system files and running wiper malware. At the power plant, EDR blocked the wiper. Electricity production and heat supply were not interrupted. CERT Polska. CISA adds that access came through vulnerable internet-facing edge devices, and that the attacks cut operators' view and control of the farms and corrupted firmware on OT devices. CISA. CERT Polska found infrastructure overlaps with the cluster tracked as Static Tundra, Berserk Bear, Ghost Blizzard and Dragonfly. Microsoft attributes the attack to a Russian actor and reads it as a new willingness to destroy critical infrastructure outside Ukraine.

Iran: retaliation, and OT within reach

Mandate and targets. Microsoft describes a period of regional tension and episodic military escalation. Iranian actors kept up their campaigns against Israel and regional rivals, and sharply increased their targeting of the United States, largely in retaliation for the war. The most targeted countries were Israel (39%), the United States (23%) and the United Arab Emirates (9%); the top sector was research and academia (28%). Microsoft also notes a shift towards destruction: data wiping and attacks on operational technology (OT). Iranian actors mostly get in through known vulnerabilities, weak authentication and exposed systems, and abuse cloud services, including Azure, for persistence.

Case: PLCs on the open internet. On 7 April 2026, the FBI, CISA, NSA, EPA, DOE and US Cyber Command warned that Iranian-affiliated actors had been disrupting internet-exposed programmable logic controllers (PLCs) since at least March 2026. The targets were in government (including local municipalities), water and energy. The actors connected from leased overseas servers using Rockwell Automation's own engineering software. They extracted project files, manipulated what operators saw on HMI and SCADA screens, and installed Dropbear SSH for remote access. The advisory was updated on 22 July 2026: Schneider Electric and Siemens PLCs were also being targeted. The agencies tie the activity to the earlier CyberAv3ngers campaign of the Islamic Revolutionary Guard Corps (IRGC). CISA AA26-097A.

North Korea: revenue first, through people and packages

Mandate and targets. Microsoft says North Korea prioritises IT, financial and blockchain organisations to generate revenue, while still collecting intelligence on government and defence. The United States accounted for 50% of its targeting and Italy for 13%; IT was the top sector at 33%. Techniques include OAuth consent phishing that impersonates SaaS platforms, the remote IT worker scheme, and AI for fake personas, social engineering and malware development.

Cases:

A hijacked npm package. On 31 March 2026, an attacker took over a maintainer account for axios, a JavaScript library with tens of millions of weekly downloads. It published versions 1.14.1 and 0.30.4, which pulled in a malicious dependency, plain-crypto-js. That dependency's install script dropped a remote-access trojan on Windows, macOS and Linux. The versions were removed about three hours later. Huntress saw a first infection 89 seconds after publication. GTIG attributes the attack to UNC1069, a suspected North Korean actor. GTIG; Huntress.
Fake job interviews. On 18 September 2026, Japan's National Police Agency (NPA) and NCO, the FBI, the US Defense Cyber Crime Center, Australia's ACSC and Germany's BND and BfV publicly attributed the WaterPlum group, also known as Contagious Interview. NCO advisory (PDF). What they report:
- The lure. WaterPlum poses as employers, often AI, crypto or NFT companies. It asks developers to run a coding test or fix an error in a video call. The code installs malicious npm packages or runs a task hidden in a VS Code project. The malware families are BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle.
- The scale. From December 2025 to July 2026, it infected at least 30,000 devices in more than 100 countries, emptied or took credentials from over 7,000 crypto wallets, and moved at least ¥1.7 billion ($10.71 million) to North Korea.
- The IT worker link. Some WaterPlum operators also work as North Korean IT workers, from the same IP addresses. The NPA and the FBI place both under the Munitions Industry Department's 313 General Bureau.
- Japan. Japan dismantled its first "laptop farm", run by an enabler in Japan. One IT worker extorted a client and published its source code; another defaced a client's website.

Mandiant's figure ties this back to detection: in 2025 the median dwell time for espionage and for North Korean IT worker cases was 122 days, against 14 days for all intrusions.

Figure 2. Ten months of public cases. Original graphic for this article.

What changes in the security review

Build a four-line threat profile

Editorial assessment. "Everyone is out to get us" does not tell a detection team what to build next. Ask one question per state instead:

State	The question to ask	If yes, start with
China	Do we hold, or connect to, technology, policy or industrial information a state would want? Do we supply IT or services to organisations that do?	Edge devices, backup appliances and hypervisors; new credentials on cloud apps
Russia	Do we support Ukraine or work for government or defence? Do we run energy or other infrastructure in Europe?	Remote workers' routers and DNS; sign-in tokens; OT recovery
Iran	Do we have links to Israel, the US or the Gulf? Can anyone on the internet reach our OT?	OT exposure; known vulnerabilities on internet-facing systems
North Korea	Do we hire remote developers or contractors? Do we hold crypto? Do we build software from public packages?	Hiring checks; developer endpoints; npm and VS Code

IT and service providers top China's and North Korea's lists because they lead to their customers. Even if every answer is no, these actors may still use your devices: covert networks and hijacked routers are made of other people's equipment.

The way in is usually something nobody watches

Editorial assessment. Look at the entry points across all four: a backup appliance, routers in homes and small offices, edge devices in front of wind farms, PLCs reachable from the internet. None of these runs a standard EDR agent. And unlike a phishing email, most of them leave no trace in the logs most teams collect.

Figure 3. They stay longer than most logs do. Sources: M-Trends 2026 and GTIG. Original graphic.

Three things to do:

Inventory and replace. List every internet-facing device and management interface, including backup, storage and virtualisation appliances. Replace anything past end of life.
Collect what these devices log. Forward administrative and application logs from edge devices, hypervisors and their management platforms to the SIEM. Mandiant's advice is to keep these well beyond 90 days. Against median dwell times of 122 days, a year is a reasonable minimum.
Make the management plane hard to reach. Restrict management interfaces to dedicated admin networks. Use allowlists rather than blocklists for VPN access, as the covert-network advisory recommends.

Identity is where espionage and theft meet

Editorial assessment. Three of the four now abuse cloud identity directly. China takes data through service principals and OAuth apps. Russia replays stolen tokens. North Korea runs consent phishing that impersonates SaaS platforms. A password reset does not remove an app that a user consented to, or a secret an attacker added to a service principal. Require admin approval for app consent, alert on new credentials added to applications, and review which apps hold mail or file permissions.

Hiring and dependencies are attack surface

Editorial assessment. North Korea's two main revenue streams both run through ordinary business processes: recruiting and installing software packages.

HR and procurement. Use the checks Japan's advisory lists:
- verify identity and location, and match IP addresses to the claimed country;
- question candidates in detail about the skills on their CV;
- be wary of refusals to meet, requests for payment in crypto, or payment to someone else's account.
Paying a North Korean IT worker may break sanctions law, so Legal should be involved when one is suspected.
Developers. Run take-home tests and unfamiliar projects in a disposable virtual machine. Open unknown VS Code projects in Restricted Mode. Treat a recruiter's request to "run this to fix the camera" as an attack.
Build systems. Install from lockfiles with npm ci. Disable install scripts where the build allows it. Wait a few days before adopting a new release of a critical dependency. The axios versions were live for about three hours.

Plan for destruction as well as theft

Editorial assessment. Russia and Iran have both moved from watching to breaking. In Poland, EDR on the IT side stopped the wiper at the power plant. On the OT side, there was no such control, and controller firmware was destroyed. In the US, the PLCs were simply reachable from the internet.

Take PLCs and HMIs off the internet.
On Rockwell controllers, set the physical mode switch to RUN, as the advisory recommends.
Keep offline copies of PLC project files and controller configurations, and practise restoring them.
Treat a firmware change or project download that nobody scheduled as an incident.

Japan in focus

Japan is third in Microsoft's China-linked targeting, at 20%. Japan's NCO co-signed the April advisory on covert networks. And WaterPlum's victims included freelance engineers and web designers in Japan. For Japanese organisations, two of the four are already at home: China in espionage, and North Korea in hiring and crypto. The Japanese edition of this article covers these cases in more detail.

Which teams should act

Team	Practical next step
SIEM / SOC	Collect logs from edge devices, backup appliances, hypervisors and their management platforms, and keep them for at least a year. Run the hunts below; alert on new app credentials and consent grants.
EDR	Cover developer endpoints fully, including macOS and Linux. Alert on Node.js or VS Code starting shells or downloaders. Make sure servers that could reach OT have EDR in blocking mode.
IT operations	Replace end-of-life routers, firewalls and NAS devices. Restrict appliance management interfaces. Use allowlists for VPN access. Take PLCs off the internet and keep offline copies of OT configurations.
Third-party risk	Ask suppliers of edge, backup and virtualisation products how they detect compromise of their own appliances and which logs they export. Ask staffing agencies and contractors how they verify developers' identity and location.
Email security	Expect recruiter lures with coding tests, OAuth consent requests that impersonate SaaS brands, and certificate warnings on Outlook sign-in pages. Teach staff to report all three.
Legal / privacy	Prepare for a suspected North Korean contractor: sanctions advice, how to stop payment, and evidence handling. If an intrusion is found late, check how far back your logs and notification duties reach.

IOCs and hunting

There is no single indicator set for four states. Where indicators exist, use the published lists rather than copies:

Iranian PLC activity: STIX files attached to AA26-097A.
axios compromise: C2 addresses and hashes in GTIG's post.
APT28 DNS hijacking: the Microsoft domains it spoofed, listed in NCSC's alert.

The hunts below target the techniques instead. All are illustrative and were not run against live data. Replace the YOUR_ placeholders and adjust field names to your sources.

North Korea: Node.js or VS Code starting shells or downloaders with the strings Japan's WaterPlum advisory warns about.

// Illustrative. Microsoft Defender XDR advanced hunting, DeviceProcessEvents.
// Node.js or VS Code starting a shell or downloader with strings named in Japan's WaterPlum advisory.
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~ ("node.exe", "node", "code.exe", "code")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "curl.exe", "python.exe", "bash", "sh", "zsh", "curl", "python3")
| where ProcessCommandLine has_any ("curl", "base64", "-enc", "mshta", "Invoke-WebRequest", "iwr ", "hidden")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

China, Russia and North Korea: consents to applications and new credentials on applications or service principals.

// Illustrative. Microsoft Sentinel, AuditLogs (Microsoft Entra ID).
// Application consents and new credentials on applications or service principals, with who made them.
AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName has_any ("Consent to application", "Add service principal credentials", "Certificates and secrets management")
| extend Actor = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| extend Target = tostring(TargetResources[0].displayName)
| project TimeGenerated, OperationName, Result, Actor, Target
| order by TimeGenerated desc

China: SSH enabled on vCenter through its management interface, and domain controllers being cloned. Both appear in GTIG's BRICKSTORM investigation and should be rare.

index=YOUR_VCENTER_INDEX earliest=-90d latest=now ("PUT /rest/appliance/access/ssh" OR "VmBeingClonedEvent")
| rex "Cloning (?<source_vm>\S+) on"
| table _time host source_vm _raw
| sort _time

Iran: connections to common OT ports from outside your private address ranges, from firewall logs.

index=YOUR_FIREWALL_INDEX dest_port IN (44818, 2222, 102, 502) earliest=-30d latest=now
| where NOT (cidrmatch("10.0.0.0/8", src) OR cidrmatch("172.16.0.0/12", src) OR cidrmatch("192.168.0.0/16", src))
| stats count min(_time) AS first_seen max(_time) AS last_seen values(action) AS actions BY src dest dest_port
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Russia: on a laptop used for remote work, list DNS servers that are not on your approved list.

# Illustrative. Run on a Windows laptop used for remote work.
# Lists DNS servers on connected interfaces that are not in your approved list.
$approved = @('YOUR_RESOLVER_1', 'YOUR_RESOLVER_2')
Get-NetIPConfiguration | Where-Object { $_.NetAdapter.Status -eq 'Up' } | ForEach-Object {
  foreach ($server in $_.DNSServer.ServerAddresses) {
    if ($approved -notcontains $server) { [pscustomobject]@{ Interface = $_.InterfaceAlias; DnsServer = $server } }
  }
}

Read the results with these limits in mind:

Node.js and VS Code. Developers run shells from both all day. Build a baseline per team and look first at downloads and encoded commands.
App credentials. Consent and credential changes are routine in some tenants. Look at who made them and when, and at apps with mail or file permissions.
DNS. A home router's private address as the DNS server is normal. A public address you do not recognise is the lead.
Log retention. None of these sees inside appliances that do not export logs. If logs are kept for 30 days, a quiet result says little about an actor that stays for 122.

What remains unknown

Why Japan's share rose. Microsoft's China figure for Japan went from 4% to 20% in a year. The report does not explain the change, and notification data reflects Microsoft's own customers and visibility.
How UNC6201 got in. GTIG did not confirm the initial access vector.
Who disrupted the PLCs. The agencies describe "Iranian-affiliated" actors and link them to CyberAv3ngers' earlier activity, but do not name the group.
Poland's attacker. CERT Polska's attribution rests on infrastructure overlap. Microsoft names a Russian actor. No government attribution is cited here.
The axios reach. How many organisations installed the malicious versions in the three-hour window is not known.
WaterPlum in Japan. The 30,000 devices are global; the advisory does not give a Japanese count.

Reporting note

Reviewed for public information up to 4 October 2026, 15:30 UTC / 5 October 2026, 00:30 JST. The framework comes from Mandiant's course as described by Google Cloud; this article is not affiliated with it. Targeting percentages are Microsoft's notification data and reflect its visibility. Case details come from the government advisories and vendor reports linked in each section. Where a figure appears in both a vendor report and an advisory, the advisory's figure is used.

This is independent editorial analysis of public statements, not an investigation by SecOpsNomad.

30-second briefing

Why start from intent

What is confirmed

China: collect at scale, and stay

Russia: intelligence, and a new appetite for destruction

Iran: retaliation, and OT within reach

North Korea: revenue first, through people and packages

What changes in the security review

Build a four-line threat profile

The way in is usually something nobody watches

Identity is where espionage and theft meet

Hiring and dependencies are attack surface

Plan for destruction as well as theft

Japan in focus

Which teams should act

IOCs and hunting

What remains unknown

Reporting note

Sources