Increased Collaboration of Cybercriminals with Iran, Russia, and China Against the U.S. and Its Allies

On Tuesday, October 24, Microsoft released a report on digital threats indicating that the governments of Iran, Russia, and China are increasingly relying on criminal networks to conduct cyber espionage and hacking operations against the United States and other countries. According to the Associated Press, the growing collaboration between authoritarian governments and criminal hackers has raised concerns among national security officials and cybersecurity experts. They argue that this reflects an increasing blurring of lines between actions taken by Beijing or the Kremlin aimed at undermining rivals and the illegal activities of groups that typically have a greater interest in financial gain. For example, Microsoft analysts found that a criminal hacker group linked to Iran attempted to sell hacked personal information by infiltrating an Israeli dating site or extorting money through it. Microsoft concluded that the hackers had two objectives: to embarrass Israelis and to make money. In another instance, investigators identified a Russian criminal network that infiltrated over 50 electronic devices of the Ukrainian army in July 2023, apparently seeking access to information that could assist Russia's attack on Ukraine, but there was no clear financial motive for this group despite any payments that may have been made by Russia. The Associated Press described this situation as a kind of 'marriage of convenience with benefits for both sides.' The governments of Russia, China, Iran, and North Korea can amplify the impact of their cyber activities without additional costs, while criminals receive new ways to earn more profit and promises of support from governments. Tom Burt, Microsoft's Vice President of Customer Security and Trust, stated, 'We are witnessing this trend towards the merging of nation-state and criminal activities in each of these countries.' He emphasized that although there is still no evidence that Russia, China, and Iran share resources or work with common criminal networks, the increasing use of private 'mercenary' hackers indicates how far America's adversaries will go in weaponizing the internet. According to Microsoft's review of security threats from July 2023 to July 2024, Russia has focused most of its cyber operations on Ukraine, attempting to infiltrate military and government systems and spreading misinformation to undermine support for Ukraine's allies in the war against Russia. Ukraine has responded with its own cyber efforts, including taking some Russian media offline last week. Networks linked to Russia, China, and Iran have also targeted American voters by using fake websites and social media accounts to spread misleading information about the 2024 elections. Russia targets the campaign of Democratic candidate Kamala Harris, while Iran attempts to counter Republican candidate Donald Trump. U.S. federal officials also accuse the Iranian government of secretly supporting protests in the U.S. against the war in Gaza. Burt believes that Russia and Iran will increase the pace of cyber operations targeting the United States as the election day approaches. Meanwhile, China has focused on electoral competitions for Congress or state and local offices, and according to Microsoft's findings, networks linked to Beijing continue to target Taiwan and other countries in the region. A spokesperson for the Chinese embassy in Washington dismissed claims of China's partnership with cybercriminals as baseless and accused the United States of spreading 'disinformation about so-called Chinese hacking threats.' The governments of Russia and Iran also denied allegations of using cyber operations to target American citizens. Recently, U.S. federal officials announced plans to seize hundreds of domain names used by Russia for cybercriminal operations and hacking. However, the Atlantic Digital Forensics Laboratory found that these domains can be easily and quickly replaced. For example, researchers from this lab noticed 12 websites created to replace those seized by the Department of Justice just one day after several domains were confiscated in September, and they are still operational a month later.