Cyber Warfare: State Actors, Landmark Attacks and the New Digital Battlefield

Cyber warfare is the use of computer network operations by states, or by groups acting on their behalf, to spy on, disrupt, degrade or destroy an adversary's systems in pursuit of strategic goals. Over the past fifteen years it has moved from a speculative threat to a permanent feature of international competition, with attacks that have damaged nuclear centrifuges, frozen global shipping and cut satellite links at the start of a war. This guide examines the landmark cases, the state groups behind them, what the damage costs, how international law applies, and how governments are organizing their defense.

Key takeaways

• Cyber warfare spans espionage, disruption and destruction; most state activity is espionage and pre-positioning rather than open attack.
• Stuxnet, NotPetya, SolarWinds and the Viasat KA-SAT attack each changed how governments think about digital conflict.
• Russia, China, Iran and North Korea run the most prominent state-linked groups, with distinct goals ranging from intelligence to revenue generation.
• Reported cybercrime losses in the United States reached about $20.9 billion in 2025, and IBM put the global average breach cost at $4.99 million in 2026.
• States broadly accept that international law applies in cyberspace, but interpretation remains contested and the Tallinn Manual is still the leading expert reference.

What is cyber warfare?#

Cyber warfare has no universally agreed definition. In its narrowest sense it refers to cyber operations conducted during armed conflict or that themselves rise to the level of an armed attack, causing death, injury or physical destruction. In wider usage it covers the full spectrum of hostile state activity in cyberspace, including espionage, sabotage, influence operations and the theft of funds or intellectual property. Most analysts distinguish between these categories because they carry very different legal and political consequences.

Espionage, disruption and destruction#

The great majority of state cyber activity is espionage: quietly collecting information from government, military, corporate and research networks. A smaller share is disruptive, such as distributed denial-of-service attacks or ransomware-style wipers that knock systems offline. A smaller share still is destructive, causing physical damage or permanently erasing data. The boundary between categories can blur, because the same access used to spy on a network can later be used to disrupt it. That ambiguity is what makes pre-positioning in critical infrastructure so concerning to defense planners.

Why states use cyber operations#

Cyber operations are attractive because they are relatively cheap, can be conducted at distance, and offer a degree of deniability. They allow states to impose costs on rivals without crossing the threshold of armed conflict, which is why cyber warfare is often treated as a core instrument of hybrid and gray-zone strategy. At the same time, malicious code can spread far beyond its intended target, as NotPetya demonstrated, creating risks of unintended escalation and collateral damage.

Landmark attacks that defined the field#

A small number of incidents have shaped how governments, militaries and companies understand cyber warfare. Each revealed a new capability or a new category of risk.

Chart: Major publicly attributed or widely reported cyber operations. Sources: CSIS Significant Cyber Incidents, U.S. and allied government advisories, 2010–2025.

Stuxnet: the first digital weapon#

Stuxnet was discovered in 2010 and is widely regarded as the first cyber weapon to cause physical destruction. The malware targeted Siemens industrial control systems at Iran's Natanz uranium enrichment facility, altering the speed of centrifuges while feeding operators normal readings. The Institute for Science and International Security estimated that it may have destroyed about 1,000 centrifuges. Media reporting, notably by The New York Times, attributed the operation to the United States and Israel; neither government has officially confirmed involvement. Stuxnet showed that code could achieve effects previously requiring an airstrike.

NotPetya: the most costly cyberattack#

On 27 June 2017, malware disguised as ransomware spread from a compromised update of M.E.Doc, a Ukrainian accounting software package. NotPetya was a wiper: it encrypted systems with no realistic means of recovery. It spread rapidly through corporate networks worldwide, disrupting shipping giant Maersk, pharmaceutical company Merck, FedEx's European subsidiary TNT Express and many others. The White House estimated total damages at more than $10 billion. In February 2018, the United States and United Kingdom attributed NotPetya to Russia's military intelligence, the GRU, specifically the unit tracked as Sandworm. Russia denied responsibility.

SolarWinds: the supply chain compromise#

In December 2020, it emerged that hackers had inserted a backdoor into updates of SolarWinds Orion, a widely used network management tool. Around 18,000 customers downloaded the compromised update, though the attackers selected a much smaller group for follow-on intrusion; U.S. officials said in 2021 that nine federal agencies and about 100 private companies were compromised. In April 2021, the U.S. government formally attributed the operation to Russia's Foreign Intelligence Service, the SVR. SolarWinds was an espionage campaign rather than a destructive attack, but its scale reshaped thinking about software supply chain security.

Colonial Pipeline: when crime hits infrastructure#

In May 2021, a ransomware attack by the criminal group DarkSide forced Colonial Pipeline to shut down the largest refined-fuel pipeline in the United States, triggering fuel shortages along the East Coast. The company paid a ransom of 75 bitcoin, then about $4.4 million; the Justice Department later recovered 63.7 bitcoin, worth around $2.3 million at the time. Colonial was not a state operation, but it is central to the cyber warfare debate because it showed how criminal groups operating from jurisdictions that do not extradite can paralyze critical infrastructure, and how blurred the line between state and criminal actors can be.

Viasat KA-SAT: cyber at the start of a war#

On 24 February 2022, around the time Russian forces invaded Ukraine, a cyberattack disabled tens of thousands of satellite modems on Viasat's KA-SAT network, which Ukrainian military and civilian users relied on. Researchers identified a wiper, dubbed AcidRain, designed to erase modem firmware. The effects spilled across Europe, with about 5,800 wind turbines operated by Germany's Enercon losing remote monitoring connectivity. In May 2022, the EU, UK and U.S. attributed the attack to Russia. The case became the clearest example of a cyber operation integrated into the opening phase of a conventional war.

Incident	Year	Attributed actor	Type	Reported impact
Stuxnet	2010	U.S. and Israel (media reports, unconfirmed)	Sabotage	Up to about 1,000 centrifuges at Natanz (ISIS estimate)
NotPetya	2017	Russia, GRU / Sandworm (U.S., UK, 2018)	Destructive wiper	More than $10 billion (White House estimate)
SolarWinds	2020	Russia, SVR (U.S., 2021)	Espionage	About 18,000 downloads; 9 federal agencies, about 100 companies
Colonial Pipeline	2021	DarkSide criminal group	Ransomware	$4.4 million ransom; East Coast fuel shortages
Viasat KA-SAT	2022	Russia (EU, UK, U.S., 2022)	Destructive wiper	Tens of thousands of modems; 5,800 Enercon turbines lost monitoring
Bybit	2025	North Korea (FBI, 2025)	Theft	About $1.5 billion in crypto assets

Table: Landmark cyber incidents and public attribution. Sources: ISIS, EuRepoC, U.S. Department of Justice, CISA, EU Council, Chainalysis.

China's Typhoons and the pre-positioning threat#

The most significant shift in cyber warfare since 2023 has been public exposure of Chinese state-linked groups that appear focused not only on espionage but on positioning for potential disruption. U.S. and allied agencies label these clusters with "Typhoon" names, following Microsoft's threat-actor naming convention.

Volt Typhoon#

Microsoft publicly identified Volt Typhoon in May 2023. In February 2024, CISA, the NSA, the FBI and partners in Australia, Canada, New Zealand and the UK issued a joint advisory stating that the group had compromised networks across U.S. communications, energy, transportation and water sectors, and had maintained access to some environments for at least five years. The agencies assessed that the activity was not consistent with traditional espionage and that the group was pre-positioning to disrupt critical infrastructure in the event of a crisis or conflict, for example over Taiwan. China's government has rejected the allegations.

Salt Typhoon#

Salt Typhoon came to public attention in 2024 after intrusions into major U.S. telecommunications providers, reportedly including systems used for lawful intercept. In August 2025, 16 agencies from 13 countries published a joint advisory; the FBI said the group had targeted more than 600 organizations in 80 countries. The advisory named three China-based companies, Sichuan Juxinhe Network Technology, Beijing Huanyu Tianqiong Information Technology and Sichuan Zhixin Ruijie Network Technology, as providing cyber products and services to China's Ministry of State Security and the People's Liberation Army.

Chart: Pre-positioning pattern described in U.S. and allied advisories on Volt Typhoon and Salt Typhoon; the dashed step is a capability, not an observed attack. Sources: CISA joint advisories, February 2024 and August 2025.

State APT groups by country#

Security researchers track state-linked hacking teams as "advanced persistent threats," or APTs. Naming is inconsistent across vendors, so a single group may carry several labels. The four states most frequently named in Western government attributions are Russia, China, Iran and North Korea, though many other states, including Western democracies, maintain offensive cyber capabilities.

Country	Group (common names)	Linked agency (per public attribution)	Known for
Russia	APT28, Fancy Bear	GRU Unit 26165	2016 U.S. election hack-and-leak, attacks on European parliaments
Russia	Sandworm	GRU Unit 74455	Ukraine grid attacks, NotPetya
Russia	APT29, Cozy Bear, Midnight Blizzard	SVR	SolarWinds, government and diplomatic espionage
China	APT40	Ministry of State Security, Hainan	Maritime and research espionage
China	APT41	MSS-linked contractors	Espionage combined with financially motivated intrusions
China	Volt Typhoon, Salt Typhoon	PRC state-sponsored	Infrastructure pre-positioning, telecom intrusions
Iran	APT33, APT35 (Charming Kitten)	IRGC-linked	Energy sector targeting, phishing of officials and dissidents
Iran	CyberAv3ngers	IRGC Cyber-Electronic Command	Attacks on Israeli-made industrial controllers in water systems
North Korea	Lazarus Group, APT38	Reconnaissance General Bureau	Sony 2014, WannaCry 2017, cryptocurrency theft
North Korea	Kimsuky	Reconnaissance General Bureau	Espionage against South Korea and foreign policy experts

Table: Selected state-linked APT groups and public attributions. Sources: U.S. Department of Justice indictments, CISA advisories, UK NCSC, U.S. Treasury.

Russia: disruption and influence#

Russia's cyber operations are closely tied to its military and intelligence services and are often integrated with information operations. Sandworm's attacks on Ukraine's power grid in 2015 and 2016 were the first publicly confirmed cyberattacks to cause blackouts. Since 2022, Russian groups have targeted Ukrainian government, energy and telecommunications systems, while Ukraine has received significant cyber defense support from Western governments and private companies.

China: scale and patience#

China fields the largest state-linked cyber apparatus by most estimates. Its historical focus was economic and political espionage, documented publicly as early as Mandiant's 2013 report on APT1, a unit of the People's Liberation Army. The Typhoon campaigns suggest that the emphasis now includes preparing for possible conflict. In April 2024, the PLA reorganized its information-related forces, creating a dedicated Cyberspace Force.

Iran and North Korea: asymmetric and financial#

Iran's operations frequently mirror regional tensions, targeting Israel, Gulf states and the United States, and they intensified around periods of military confrontation. North Korea is distinctive in using cyber operations to generate revenue. According to Chainalysis, North Korean actors stole just over $2 billion in cryptocurrency in 2025, out of about $3.4 billion stolen globally, with the February 2025 Bybit theft accounting for about $1.5 billion of the total. UN sanctions monitors have previously reported that such funds support the country's weapons programs.

Chart: Share of global cryptocurrency theft attributed to North Korea in 2025. Source: Chainalysis, December 2025.

The cost of cyber conflict#

Measuring the cost of cyber warfare is difficult because states rarely disclose the damage from espionage, and much of the data comes from criminal incidents. Still, several credible datasets show the economic weight of the threat and its upward trend.

Reported losses keep rising#

The FBI's Internet Crime Complaint Center received more than 1 million complaints in 2025, with reported losses of about $20.9 billion, a 26 percent increase on 2024. These figures cover fraud as well as intrusions and include only what victims reported, so they understate the true scale. They nonetheless show a steady climb over five years.

Chart: Annual losses reported to the FBI Internet Crime Complaint Center. Source: FBI IC3 Internet Crime Reports, 2021–2025.

The price of a breach#

IBM's annual Cost of a Data Breach Report, published in July 2026, put the global average cost of a breach at a record $4.99 million, up 12 percent on the previous year. The average cost in the United States was $11.5 million, more than twice the global figure. Healthcare remained the most expensive sector for the thirteenth consecutive year, at $6.64 million per breach.

Chart: Global average data breach cost by report year. Source: IBM Cost of a Data Breach Reports, 2022–2026.

National incident load#

Government data points the same way. The UK's National Cyber Security Centre handled 429 incidents in the 12 months to August 2025, of which 204 were classed as nationally significant, up from 89 the year before, an average of about four per week. Eighteen incidents were rated highly significant, an increase of almost 50 percent.

International law and the Tallinn Manual#

States broadly agree that existing international law, including the UN Charter, applies in cyberspace. That principle was affirmed in the 2013 and 2015 reports of the UN Group of Governmental Experts, which also set out 11 voluntary norms of responsible state behavior, such as not knowingly allowing a state's territory to be used for wrongful cyber acts and not attacking critical infrastructure in peacetime. The difficulty lies in applying general rules to specific operations.

The Tallinn Manual#

The most influential reference is the Tallinn Manual, produced by an international group of legal experts under the auspices of the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn. The first edition, published in 2013, focused on cyber operations in armed conflict. Tallinn Manual 2.0, published in 2017, extended the analysis to peacetime operations and contains 154 rules. A third edition was launched in 2021 as a five-year project. The manual is not binding, but governments and courts frequently consult it.

Key unresolved questions#

Several issues remain contested. One is when a cyber operation amounts to a "use of force" or an "armed attack" triggering the right of self-defense under Article 51 of the UN Charter; most states accept that effects comparable to a kinetic attack would qualify, but disruption without physical damage is a gray area. Another is whether sovereignty is a binding rule that a cyber intrusion can violate, a position held by France and many other states but questioned by the United Kingdom. A third is the standard of evidence for attribution, which states have so far treated as a political decision.

The UN process#

At the United Nations, the Open-Ended Working Group on ICT security reached consensus on its final report in July 2025. The General Assembly then adopted, without a vote on 1 December 2025, a resolution establishing a permanent Global Mechanism on ICT security, open to all member states, which began formal operations in 2026. Whether it can narrow the gap between Western states and Russia and China, which favor new binding treaties and a stronger state role in internet governance, remains an open question.

Defense postures and the new digital battlefield#

Governments have reorganized their militaries and civilian agencies to compete in cyberspace. The dominant trend is toward continuous activity rather than episodic response.

Persistent engagement and defending forward#

U.S. Cyber Command was elevated to a unified combatant command in 2018, and the Defense Department's 2018 cyber strategy introduced the concept of "defending forward," disrupting malicious activity at its source, including outside U.S. networks. The related doctrine of persistent engagement holds that cyberspace is an arena of constant contact rather than a domain where deterrence works as it does with nuclear weapons. The UK established its National Cyber Force in 2020, combining personnel from GCHQ and the Ministry of Defence to conduct offensive operations.

Alliances and civilian resilience#

NATO affirmed at its 2014 Wales summit that cyber defense is part of collective defense and that a cyberattack could lead to the invocation of Article 5. In 2016 it recognized cyberspace as an operational domain, and Allies have since agreed to integrate national cyber capabilities into Alliance operations on a voluntary basis. In the EU, the NIS2 Directive expanded mandatory security requirements across critical sectors, with a transposition deadline of October 2024, and the Cyber Solidarity Act created mechanisms for mutual assistance in large-scale incidents.

Chart: RAGE X analytical positioning of landmark operations by physical impact and initial deniability, based on public attribution timelines in CISA, EU and UK government statements, 2010–2025.

Public-private defense#

Most critical infrastructure is privately owned, and many of the most important detections, including SolarWinds and Volt Typhoon, were made by private security firms. Ukraine's experience since 2022 shows the value of cloud migration, rapid patching and close cooperation between government defenders and technology companies. The new digital battlefield is therefore shared: defense depends as much on utilities, telecom operators and software vendors as on military cyber units.

Frequently asked questions#

What is the difference between cyber warfare and cybercrime?#

Cyber warfare is conducted by states, or groups acting on their behalf, for strategic or military purposes, such as espionage, sabotage or disruption of an adversary. Cybercrime is carried out mainly for financial gain by criminal groups. The line can blur: North Korean state hackers steal cryptocurrency for revenue, and some Russian-speaking ransomware groups operate with apparent tolerance from authorities. Colonial Pipeline was a criminal attack, but its impact on national infrastructure made it a national security event. Attribution and intent largely determine which category an incident falls into.

Has cyber warfare ever killed anyone?#

There is no publicly confirmed case of a death directly caused by a state cyberattack. Cyber operations have caused physical damage, notably Stuxnet's destruction of centrifuges and the power outages in Ukraine in 2015 and 2016. Ransomware attacks on hospitals have disrupted patient care, and investigators in some countries have examined whether such disruptions contributed to deaths. The absence of confirmed fatalities is one reason many states and scholars hesitate to classify most cyber operations as armed attacks under international law.

Which country has the strongest cyber capabilities?#

There is no definitive ranking, because offensive capabilities are secret. The International Institute for Strategic Studies, in its 2021 assessment of national cyber power, placed the United States alone in its top tier, with China, Russia, the UK, France, Israel, Canada and Australia among the second tier. China fields a very large apparatus focused on espionage and pre-positioning, Russia has demonstrated destructive operations, and Israel and the UK are regarded as highly capable. Capability depends on intelligence integration, industrial base and alliances as well as technical skill.

What is the Tallinn Manual?#

The Tallinn Manual is a non-binding academic study of how international law applies to cyber operations, written by an international group of legal experts under the auspices of the NATO Cooperative Cyber Defence Centre of Excellence in Estonia. The first edition, in 2013, addressed cyber operations during armed conflict. The second edition, in 2017, covered peacetime operations and contains 154 rules. A third edition is in progress. Governments use it as a reference point when developing their own national positions on cyber law.

What are Volt Typhoon and Salt Typhoon?#

They are names for China-linked cyber activity clusters identified by Microsoft and U.S. agencies. Volt Typhoon has compromised U.S. critical infrastructure networks, including energy, water and transport, and according to a February 2024 joint advisory maintained access to some for at least five years, apparently to enable disruption in a future crisis. Salt Typhoon has breached telecommunications providers; an August 2025 advisory said it targeted more than 600 organizations in 80 countries. China denies the allegations.

Can a cyberattack trigger NATO's Article 5?#

Yes. NATO declared at its 2014 Wales summit that cyber defense is part of collective defense and that a decision on whether a cyberattack triggers Article 5 would be taken case by case. Later summits affirmed that the cumulative effect of malicious cyber activity could also be considered. NATO deliberately avoids setting a threshold so that adversaries cannot calibrate attacks just below it. No cyber incident has so far led to an Article 5 invocation.

The RAGE X view#

Cyber warfare has matured from a fear of a sudden "digital Pearl Harbor" into something more persistent and, in many ways, more consequential: a constant contest for access inside the networks that run modern societies. The decisive cases of the past fifteen years show three trends. Destructive operations have been rare but highly damaging when they escape their targets, as NotPetya did. Espionage has scaled through supply chains and telecom networks. And pre-positioning, exemplified by Volt Typhoon, means that the opening moves of a future conflict may already have been made.

For governments and companies, the implication is that cyber defense is now part of national defense and of corporate strategy at the same time. Attribution has become faster and more collective, but law and norms still lag behind practice. RAGE X follows state cyber activity alongside other conflict indicators in RAGE INDEX, and reports new advisories and incidents as they break on RAGE Intel.

Sources#

1. CSIS Strategic Technologies Program. "Significant Cyber Incidents." https://www.csis.org/programs/strategic-technologies-program/significant-cyber-incidents
2. Institute for Science and International Security (2010). "Did Stuxnet Take Out 1,000 Centrifuges at the Natanz Enrichment Plant?" https://isis-online.org/isis-reports/did-stuxnet-take-out-1000-centrifuges-at-the-natanz-enrichment-plant/
3. European Repository of Cyber Incidents (EuRepoC). "NotPetya." https://eurepoc.eu/wp-content/uploads/2023/05/MACI_NotPetya.pdf
4. Dark Reading (2018). "White House: Russian Military Behind NotPetya Attacks." https://www.darkreading.com/threat-intelligence/white-house-russian-military-behind-notpetya-attacks/d/d-id/1331078
5. TechTarget. "The SolarWinds attacks: What we know so far." https://www.techtarget.com/cybersecurity/news/252494448/The-SolarWinds-attacks-What-we-know-so-far
6. The Hacker News (2021). "US Recovers $2.3 Million Ransom Paid to Colonial Pipeline Hackers." https://thehackernews.com/2021/06/us-recovers-23-million-ransom-paid-to.html
7. BleepingComputer (2022). "EU says Russia behind cyberattack on satellite modems in Ukraine." https://www.bleepingcomputer.com/news/security/eu-says-russia-behind-cyberattack-on-satellite-modems-in-ukraine/
8. Business Insurance (2022). "Internet outage takes thousands of users, 5,800 wind turbines offline." https://www.businessinsurance.com/Internet-outage-takes-thousands-of-users,-5,800-wind-turbines-offline/
9. CISA et al. (2024). "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure." https://www.cisa.gov/sites/default/files/2024-02/aa24-038a-jcsa-prc-state-sponsored-actors-compromise-us-critical-infrastructure_1.pdf
10. The Register (2025). "Salt Typhoon alert." https://www.theregister.com/2025/08/28/china_salt_typhoon_alert/
11. The Register (2025). "Kim's crypto thieving reached a record $2B in 2025." https://www.theregister.com/2025/12/18/north_korea_stole_2b_crypto_2025/
12. National CIO Review (2026). "FBI Cybercrime Report Reveals $20.8 Billion Lost in 2025." https://nationalcioreview.com/articles-insights/extra-bytes/fbi-cybercrime-report-reveals-20-8-billion-lost-in-2025/
13. eSecurity Planet (2026). "IBM 2026 Cost of a Data Breach Report: Key Findings." https://www.esecurityplanet.com/cybersecurity/ibm-2026-cost-of-a-data-breach-report-key-findings/
14. UK National Cyber Security Centre (2025). "UK experiencing four 'nationally significant' cyber attacks every week." https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly
15. NATO CCDCOE. "Tallinn Manual." https://ccdcoe.org/research/tallinn-manual/
16. Global Partners Digital. "UN Cyber Processes: OEWG and Global Mechanism." https://www.gp-digital.org/un-cyber-processes-oewg-global-mechanism/
17. IISS (2021). "Cyber Capabilities and National Power: A Net Assessment," executive summary. https://www.iiss.org/globalassets/media-library---content--migration/files/research-papers/cyber-capabilities-and-national-power---executive-summary.pdf
18. NATO. "Cyber defence." https://www.nato.int/cps/en/natohq/topics_78170.htm

About RAGE X: RAGE X is a global media, intelligence and technology organization delivering geopolitical intelligence, military and conflict analysis, OSINT and security insight through RAGE Intel, RAGE INDEX and its wider ecosystem.