Non-state armed groups adopt offensive cyber capabilities

26 October 2022 medium threat healthcareeducationgovernment-nationalmedia

Traditional kinetic-violence groups like Wagner, cartels, and militant organizations increasingly employ cyber operations, complicating defense as motivations range from financial to ideological.

Non-state armed groups historically rooted in physical violence are increasingly adopting offensive cyber capabilities to advance strategic objectives, according to a roundtable of experts convened by the Atlantic Council. While state-sponsored proxies like Russia's Wagner Group and Iran's troll operations currently pose the most significant threat, independent actors including Mexican drug cartels purchasing surveillance malware and militant groups like Hezbollah integrating cyber into existing operations represent a growing challenge. The proliferation is driven by low barriers to entry, pseudo-anonymity, and the absence of clear international legal frameworks for cyber conflict.

Experts disagreed on threat severity. Some assessed non-state cyber actors as a minor concern compared to state threats, noting that cyberattacks lack the visibility and impact of kinetic violence that terrorist and insurgent groups typically seek. Others warned that ransomware operations by independent actors generate millions in revenue while reputational damage compounds financial losses, and that the unpredictable motivations of non-state groups—ranging from ideology to financial gain to grievance—make traditional intelligence indicators unreliable. The underground ecosystem is further complicated by state-trained individuals who complete mandatory military cyber service and then operate independently, sharing sophisticated techniques and selling ransomware-as-a-service kits.

Recommendations centered on improved information sharing and cross-sector collaboration. Experts called for coordination among law enforcement, intelligence, military, and private sector entities; monitoring of underground forums and communication platforms; aggressive defensive and offensive measures including "hack back" capabilities; and strengthened international partnerships. Several noted that excessive focus on state-sponsored actors allows criminal networks to flourish, and that the legal and normative frameworks for prosecuting cyber activities remain underdeveloped, creating an attractive operating environment for malicious actors.

Mentioned in this report

Threat actors Internet Research AgencyKillnetWagner Group

Malware SamSam

Detection guidance

Shadow Copy Deletion Preceding Potential Ransomware Encryption

ATT&CK T1486

Detects use of vssadmin, wmic, or wbadmin to delete volume shadow copies and backups, a common precursor step used by ransomware operators (including non-state actors using RaaS kits) to prevent recovery before encrypting data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Volume Shadow Copy or Backup Deletion via Built-in Tools
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains|all:
    - delete
    - catalog
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
    - recoveryenabled
    - 'no'
  condition: 1 of selection_*
falsepositives:
- Legitimate backup administration or storage cleanup scripts run by IT staff
- System imaging or disk maintenance tools invoking vssadmin/wbadmin as part of scheduled
  maintenance
level: high
tags:
- attack.t1486
- attack.impact
id: 4c1dfa36-3a71-59a5-925c-e49b89dbbb25
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-non-state-armed-groups-in-cyber-conflict

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free