Experts debate non-state armed groups in cyber
Atlantic Council panel discusses how cartels, militias, and hacktivist groups like Killnet and Wagner are adopting offensive cyber capabilities alongside kinetic operations.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This is a policy discussion piece from the Atlantic Council's Cyber Statecraft Initiative, featuring five experts debating the significance of cyber threats posed by non-state armed groups—including private military companies like Wagner Group, drug cartels, militant organizations such as Hezbollah and Boko Haram, and hacktivist collectives like Killnet. The panel explores how these groups' motivations (financial, ideological, geopolitical) shape their cyber strategies, and how state-sponsored training pipelines (e.g., mandatory military cyber service in Iran, China, North Korea, Russia) feed skilled individuals into independent criminal ecosystems that sell ransomware-as-a-service and phishing kits.
Key examples cited include SamSam ransomware (attributed to Iranian nationals, netting ~$6 million), Killnet's evolution from a DDoS tool into an umbrella pro-Russian hacktivist brand conducting attacks against European nations since March 2022, and the Ukrainian IT Army's civilian-driven cyber operations during the Russia-Ukraine conflict. Experts diverge on threat severity—some argue non-state actors pose minimal capability compared to state actors, while others emphasize the financial and reputational damage inflicted on under-resourced sectors like academia, healthcare, and municipal government.
The piece concludes with policy recommendations: better public-private intelligence sharing, monitoring of underground forums (Telegram, Discord, dark web), building international norms for acceptable cyber behavior, and combining counterterrorism, counter-narcotics, and cybercrime analysis given shared financial motives (e.g., ISIS funding via crypto). No specific technical indicators, exploited vulnerabilities, or active campaigns are detailed; this is a strategic/policy commentary piece rather than an incident report.
Mentioned in this report
Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-non-state-armed-groups-in-cyber-conflict
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs