Read about the top 9 hacking groups who are sponsored by governments around the world1. Tailored Access Operations – Sponsor NSA, USA2. Sofacy Group – APT28 – Pawn Storm – Sponsor Russia3. Bureau 121 – Sponsor North Korea4. Unit 61398 / Comment Crew /Putter Panda – Sponsor China5. Hidden Lynx – Sponsor China6. Tarh Andishan – Sponsor Iran7. Dragonfly / Energetic Bear – Sponsor Eastern Europe8. Ajax Security Team / Flying Kitten Iran9. Axiom

Today we look at the top nine such state sponsored hacking groups who wreak havoc on the Internet :

1. Tailored Access Operations – Sponsor NSA, USA

Active since at least 1998, the Office of Tailored Access Operations is a cyber-warfare intelligence-gathering unit of the National Security Agency (NSA). A document leaked by former NSA contractor Edward Snowden describing the unit’s work says TAO has software templates allowing it to break into commonly used hardware like routers and switches. With 600 employees gathering information around the world, their motto is “Your data is our data, your equipment is our equipment – anytime, any place, by any legal means.”

2. Sofacy Group – APT28 – Pawn Storm – Sponsor Russia

Believed to have ties to the Russian Government and said to have been operational from 2007, the group is known to target government, military, and security organizations. Characterised as an advanced persistent threat, the group employs spear phishing attacks, using malware to gain control of systems via a command and control infrastructure. The group is said to have had involvement in the TV5Monde cyber attack and the six-month long attack on the German parliament that began in December 2014.

3. Bureau 121 – Sponsor North Korea

Bureau 121 is a North Korean cyberwarfare agency, which is part of the General Bureau of Reconnaissance of North Korea’s military. According to American authorities, Bureau 121 was created in 1998, with the agency coming to public attention following the Sony hack. Bureau 121 has been blamed for the cyber breach, but North Korea has rejected this accusation. It is thought that many of the agency’s activities are directed at South Korea and, Prior to the Sony hack, reports emerged that 30,000 PCs in South Korea had been attacked.

4. Unit 61398 / Comment Crew /Putter Panda – Sponsor China

Putter Panda is the name of bad actor responsible for a series of cyber espionage operations originating in Shanghai, with security experts linking its operation to the activity of the People’s Liberation Army 3rd General Staff Department 12th Bureau Unit 61486. The group has been operating since at least 2007 and appears very interested in research companies in the space and satellite industry, experts at CrowdStrike have collected evidence of a numerous attacks against these industries.

5. Hidden Lynx – Sponsor China

Dubbed Hidden Lynx by Symantec, the professional hackers for hire were dubbed best of breed by Symantec following various targeted attacks or Advanced Persistent Threats (APTs). Given the breadth and number of targets and regions involved, we infer that this group is most likely a professional hacker-for-hire operation that are contracted by clients to provide information. They steal on demand, whatever their clients are interested in, hence the wide variety and range of targets. The group are assumed to have extensive hacking expertise, up to 100 people in the group and enough time and effort to carry out attacks on a large and varied scale.

6. Tarh Andishan – Sponsor Iran

In 2009, Iran was left with a badly compromised and diminished computer infrastructure after the widely publicized Stuxnet worm attack. Iran responded by elevating its hacking capabilities from simple website defacement to full-blown cyber warfare. Thus, a state-sponsored hacker group dubbed “Tarh Andishan” (“Thinkers” or “Innovators” in Farsi) was born. The group gained prominence with “Operation Cleaver,” a campaign that has been active since around 2012 and has targeted at least 50 organizations throughout the world in the military, commercial, educational, environmental, energy, and aerospace fields. Chillingly, they have also targeted major airlines and in some cases even gained “complete access” to airline gates and control systems, “potentially allowing them to spoof gate credentials.” Cyber security firm Cylance, who has yet to reach a conclusion as to the group’s long-term goals, released an early report on Tarh Andishan (which represents only a fraction of the group’s activities) because of fears that Operation Cleaver already poses a “grave risk to the physical safety of the world.”

7. Dragonfly / Energetic Bear – Sponsor Eastern Europe

A group that Symantec calls “the Dragonfly gang” and other security firms have called “Energetic Bear” has been operating out of Eastern Europe and targeting mostly energy companies since around 2011. Before that, it was targeting airline and defense sectors, usually in the US and Canada. Symantec says that the hacker group “bears the hallmarks of a state-sponsored operation, displaying a high degree of technical capability.” It was first discovered by the Russian-based security firm Kaspersky Labs.Dragonfly uses remote access Trojans (RATs) such as their own Backdoor. Oldrea and Trojan.Karagany malware tools to spy on energy industry targets, although the methods could also be used for industrial sabotage. The malware is usually attached to phishing e-mails, although the hackers have recently upgraded to “watering hole” methods of targeting: compromising sites that a target is known to frequent. The targets are then sent on a series of redirects until Oldrea or Karagany can be introduced into a victim’s system. In the later stages of their campaign, they even managed to infect legitimate software, which would be downloaded and installed as usual along with unwanted malware.

8. Ajax Security Team / Flying Kitten

Iran

Ajax started out in 2010 as a group of “hacktivists” and website defacers from Iran, but they went from activism to cyber espionage and outing of political dissidents. They deny being state sponsored, but many believe that they were hired by the Iranian government—an increasingly common pattern where a group gains the attention of a government through its public activities in order to gain state sponsorship. Ajax came to the attention of security firms and groups like CrowdStrike when a series of mistakes (one of which gave investigators a member’s real e-mail address) exposed attempts to target the US defense industry and Iranian dissidents. The firm FireEye believes that Ajax was responsible for “Operation Saffron Rose”—a series of phishing attacks and attempts to spoof Microsoft Outlook Web Access and VPN pages in order to gain information and credentials within the US defense industry. The group also exposed dissidents by luring them in with corrupt anti-censorship tools.

9. Axiom

A coalition of security-related groups including Bit9, Microsoft, Symantec, ThreatConnect, Volexity, and others have identified another dangerous group, which they have dubbed “Axiom.” The group specializes in corporate espionage and targeting of political dissidents, and it may have been behind the 2010 attack on Google. Axiom is believed to come out of China, but no one has yet been able to identify where in mainland China the group operates. A report from the coalition stated that Axiom’s activities overlapped with “the area of responsibility” attributed to the Chinese government’s intelligence agencies, a judgment also supported by an FBI flash released to Infragard.