Google Warns of ‘Relentless’ Cyber Siege on Defense Industry

Cyberthreats targeting the defense industrial base are expanding beyond traditional espionage into supply-chain attacks, workforce infiltration and battlefield-adjacent cyber operations, according to a new threat intelligence report published Tuesday by Google.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

Google’s Threat Intelligence Group describes a “relentless barrage” of cyber operations against defense contractors, aerospace firms and manufacturing suppliers supporting military capabilities, driven in large part by Chinese, Russian, Iranian and North Korean threat actors. The expanded operations targeting the U.S. defense industrial base come as geopolitical conflicts have increasingly featured campaigns targeting commercial supply chains and contractor networks.

Google warns in the report that Russian espionage groups and hacktivists are continuing attempts to compromise organizations involved in aiding Ukraine push back Russian invaders, targeting firms involved in building drones and developing battlefield communications systems and surveillance technologies. Recent campaigns have included phishing operations against Ukrainian military personnel, malware targeting mobile battlefield-management applications and attempts to access encrypted messaging platforms used by troops, the report said.

“In modern warfare, the front lines are no longer confined to the battlefield; they extend directly into the servers and supply chains of the industry that safeguards the nation,” the report says.

Researchers also warn that Chinese-linked cyberespionage groups are the most active threat to the defense industrial base by sheer scale and volume of operations, with campaigns increasingly focused on exploiting network edge devices – including VPN appliances, routers and firewalls – to gain long-term access to contractor environments. According to the report, Chinese-linked groups have exploited more than two dozen previously unknown vulnerabilities in edge infrastructure since 2020, allowing attackers to bypass traditional endpoint detection tools and maintain persistent access to targeted networks (see: How China and North Korea Are Industrializing Zero-Days).

Some of the most sophisticated activity has been attributed to clusters tracked as UNC3886 and UNC5221, which have targeted aerospace and defense organizations alongside telecommunications and technology companies as part of broader intelligence-collection campaigns. Federal officials were forced to scramble during the government shutdown last year to contain Chinese-linked hackers believed to be associated with UNC5221 that exploited stolen source code from software maker F5 (see: US Scrambles to Patch F5 Amid China-Linked Breach).

The report also highlights growing efforts by adversaries to target the “human layer” of DIB organizations, including job applicants, recruiters and employees’ personal communications. North Korean operations placing remote IT workers inside Western companies have continued to intersect with defense programs, including cases involving contractors connected to U.S. government projects, according to the report (see: North Korea’s Hidden IT Workforce Exposed in New Report ).

“Given global efforts to increase defense investment and develop new technologies, the security of the defense sector is more important to national security than ever,” the report says. “The broader trend is clear: the defense industrial base is under a state of constant, multi-vector siege.”