Experts debate non-state armed groups in cyber
Atlantic Council panel discusses how cartels, militias, and hacktivist groups like Killnet and Wagner are adopting offensive cyber capabilities alongside kinetic operations.
This is a policy discussion piece from the Atlantic Council's Cyber Statecraft Initiative, featuring five experts debating the significance of cyber threats posed by non-state armed groups—including private military companies like Wagner Group, drug cartels, militant organizations such as Hezbollah and Boko Haram, and hacktivist collectives like Killnet. The panel explores how these groups' motivations (financial, ideological, geopolitical) shape their cyber strategies, and how state-sponsored training pipelines (e.g., mandatory military cyber service in Iran, China, North Korea, Russia) feed skilled individuals into independent criminal ecosystems that sell ransomware-as-a-service and phishing kits.
Key examples cited include SamSam ransomware (attributed to Iranian nationals, netting ~$6 million), Killnet's evolution from a DDoS tool into an umbrella pro-Russian hacktivist brand conducting attacks against European nations since March 2022, and the Ukrainian IT Army's civilian-driven cyber operations during the Russia-Ukraine conflict. Experts diverge on threat severity—some argue non-state actors pose minimal capability compared to state actors, while others emphasize the financial and reputational damage inflicted on under-resourced sectors like academia, healthcare, and municipal government.
The piece concludes with policy recommendations: better public-private intelligence sharing, monitoring of underground forums (Telegram, Discord, dark web), building international norms for acceptable cyber behavior, and combining counterterrorism, counter-narcotics, and cybercrime analysis given shared financial motives (e.g., ISIS funding via crypto). No specific technical indicators, exploited vulnerabilities, or active campaigns are detailed; this is a strategic/policy commentary piece rather than an incident report.
Mentioned in this report
Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-non-state-armed-groups-in-cyber-conflict
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free