Can you attribute an attack to a country?

We link to groups as attributed by named governments and say who attributes them. We do not make our own attribution.

Does it work for several agencies?

You can enter the domains of each agency. The demo can show how findings are grouped.

What does CISA say about public sector networks?

CISA's advisory on state-sponsored activity against network devices says government networks are among the targets, besides telecommunications.

NIS2 covers public administration in the EU. National rules differ, so check with your legal team.

Which state-backed groups target public bodies?

Governments have attributed APT28 and APT29 to Russia's military intelligence service (the GRU) and Foreign Intelligence Service (SVR). MITRE ATT&CK attributes Turla to the FSB. Each of these groups has run espionage against public bodies, and each profile on the site names who attributes it.

What happens when remote support software is abused?

In late 2024 a hacker reached a US government network. CISA worked with the agency and the maker of the remote support software involved. It shows how a tool used by a supplier can become the way in.

What is targeted phishing against a public office?

It is messages written for one person or office to get a login or a click. Executive and VIP Protection watches for threats aimed at your leaders. Dark Web Monitoring alerts you when staff logins or data tied to your domains are offered for sale.

How can agencies find systems that one office set up alone?

External Attack Surface Management lists the internet-facing systems of your agencies, including ones set up by a single office. You then see what is exposed even when no central team knows about it.

How does vulnerability intelligence help a public body?

Vulnerability Intelligence tells you which flaws are being exploited now. Attacks on exposed servers are a real risk for public bodies, so knowing which flaws matter helps your team patch the right ones first.

Industry · Government And Public Sector

I Need To See The Threat. Before It Lands.

Public bodies are targeted by state-backed groups and by criminals. Both prepare their attacks outside your network, where you can watch for them.

Request A Demo See The Platform

What We Watch For Government And Public Sector 4 Threats

01Espionage Watched
02A Breach Linked To Remote Support Software Watched
03Attacks On Internet-Facing Servers Watched
04Targeted Phishing Watched

In Short

Public bodies hold sensitive data and run services people depend on. State-backed groups and criminals both target them, and they prepare outside the network: exposed systems, leaked logins and phishing. Knowing who is active and what you expose gives your team time to act.

At A GlanceState-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.

Main Threats

What Threatens Public Bodies.

Glossary term Espionage State-backed groups that steal information over long campaigns. See The Definition → Incident A Breach Linked To Remote Support Software In late 2024 a hacker reached a US Treasury network. CISA worked with Treasury and the maker of the remote support software involved. Read The Incident → Incident Attacks On Internet-Facing Servers In July 2025 attackers exploited flaws in on-premises SharePoint servers that faced the internet. CISA and European and UK bodies urged fast patching. Read The Incident → Glossary term Targeted Phishing Messages written for one person or office to get a login or a click. See The Definition →

Threat Actors

Who Targets This Sector.

These profiles cover groups that governments have attributed to state intelligence services and that have run espionage against public bodies. Each profile names who attributes it.

APT28 Russia · Since 2004 The US, UK, EU and other governments attribute APT28 to Russia's military intelligence service, the GRU, specifically its 85th Main Special Service Center (military unit 26165). Open Profile → APT29 Russia · Since 2008 The US, UK and other governments have attributed APT29 to Russia's Foreign Intelligence Service (SVR). Open Profile → Turla Russia · Since 2004 Attributed by MITRE ATT&CK to Russia's FSB, Turla has run espionage against governments, embassies and the military since at least 2004. Open Profile →

Compliance

Which Rules Apply To You.

NIS2 Directive The European Commission lists public administration at central and regional level among the sectors the directive covers. It asks covered entities to take appropriate cybersecurity risk-management measures and to notify authorities of significant incidents. Official Site ↗

GDPR The EU's main data protection law. It applies to organisations established in the EU that process personal data, and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. Official Site ↗

A plain summary of who each rule covers, taken from the official page. Not legal advice. Your legal team decides what applies to you.

Products

How Brandefense Helps.

Use Cases In This Sector All Use Cases →

Vulnerability IntelligenceKnow which flaws are being exploited now. Executive And VIP ProtectionWatch for threats aimed at your leaders. Threat Search And InvestigationSearch across sources to follow up an alert. Threat Actor LandscapeSee who targets your sector and how.

Threat Landscape

Who Targets Government And Public Sector, And Where.

8Base Disrupted 8Base is the name of a ransomware affiliate group that used the Phobos ransomware. Since 2019 · Ransomware affiliate group using Phobos (Phobos itself is a ransomware as a service) Conti ransomware group Inactive Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK. Since 2019 · Ransomware as a service, with a wage model per CISA Everest Active Everest is a financially motivated ransomware and data extortion group. Since 2020 · Extortion group with ransomware and initial access broker activity Hive Disrupted Hive was a ransomware as a service operation active from June 2021. Since 2021 · Ransomware as a service LockBit Disrupted LockBit is a ransomware as a service operation first seen in January 2020. Since 2020 · Ransomware as a service Play Active Play, also called Playcrypt, is a ransomware group active since June 2022. Since 2022 · Closed group (presumed, per the advisory) RansomHub Ransomware group RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service REvil ransomware group Disrupted REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says ran since at least April 2019. Since 2019 · Ransomware as a service Rhysida Active Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Since 2023 · Ransomware as a service (profit-sharing with associates) Royal Ransomware group Royal is a ransomware group that, according to a joint FBI and CISA advisory (AA23-061A, first published March 2, 2023), rebranded as BlackSuit. Rebranded · Since 2022 · Not stated as ransomware as a service in the sources; operated by the group itself

Australia Country Australia faces state-linked espionage, ransomware and large-scale customer data theft. Asia Pacific Azerbaijan Country Azerbaijan faces espionage by state-linked groups, hacktivist defacements, DDoS attacks on telecoms and widespread online fraud against citizens. Europe Brazil Country Brazil faces banking trojans and fraud, ransomware against health services and other organizations, and state-linked campaigns. Latin America Canada Country Canada faces state espionage, ransomware against hospitals, governments and critical infrastructure, and pro-Russia denial of service campaigns. North America Egypt Country Egypt's cyber risk is shown by surveillance of political figures, regional espionage, fraud and large personal data sales. Middle East France Country France faces espionage by state-linked groups, data theft and ransomware, and attacks around big events such as the Paris 2024 Games. Europe Germany Country Germany faces cyber espionage by state actors, ransomware against companies and local governments, and DDoS campaigns against critical infrastructure. Europe India Country India is one of the world's largest digital economies, and its government reports millions of cyber incidents a year, with over 29.44 lakh handled by CERT-In in 2025. Asia Pacific Indonesia Country Indonesia is a large digital economy where cyber risk is shaped by ransomware, data leaks and fraud against banks and public bodies. Asia Pacific Ireland Country Ireland is a European country whose national cyber center (NCSC) leads the response to major cyber incidents. Europe Italy Country Italy faces ransomware, DDoS campaigns by pro-Russian groups and data exposure. Europe Japan Country Japan faces cyber espionage linked by its police to China and North Korea, ransomware against manufacturers and smaller firms, and theft of crypto assets. Asia Pacific Kazakhstan Country Kazakhstan faces fast-growing cybercrime, mostly theft of personal data, and DDoS waves against its national internet and state sites. Asia Pacific Mexico Country Mexico faces attacks on banks and payment systems, attacks on state bodies and companies, and banking fraud. Latin America Netherlands Country The Netherlands faces cyber espionage by Russian and Chinese state actors, ransomware, DDoS attacks and data leaks through suppliers. Europe Nigeria Country Nigeria is one of Africa's largest digital economies, and its own cyber agency says government websites have been defaced and hit by ransomware. Africa Pakistan Country Pakistan appears in MITRE ATT&CK and US government texts as a target of South Asian and Chinese espionage groups and as one of the nations a North Korean bank-robbing team likely targeted. Asia Pacific Poland Country Poland faces cyber threats from state-linked actors such as APT28, Sandworm and Dragonfly, and from ransomware families such as LockBit. Europe Qatar Country Qatar is a small, wealthy Gulf state with a national cyber agency that runs yearly drills and sets security standards. Middle East Romania Country Romania is targeted by Russian state-linked actors and hacktivists, according to official sources. Europe Saudi Arabia Country Saudi Arabia is a Gulf state whose energy, aviation, government and telecommunications sectors have been named by official sources as targets of Iran-linked and other state-linked groups. Middle East Singapore Country Singapore faces state-linked espionage against its critical infrastructure, ransomware against businesses and a large volume of botnet infections. Asia Pacific South Africa Country South Africa has seen ransomware against national departments and state companies, and large leaks of personal data. Africa South Korea Country South Korea faces cyber espionage and destructive attacks linked by official sources to North Korean state groups, and large data breaches at telecom and retail firms. Asia Pacific Spain Country Spain faces fraud, malware and ransomware, and its public bodies have been hit directly. Europe Taiwan Country Taiwan faces constant cyber pressure that its National Security Bureau ties to China: 2.63 million intrusion attempts a day against critical infrastructure in 2025, by the Bureau's count. Asia Pacific Türkiye Country Türkiye faces cyber threats from state-linked groups and criminals. Europe Ukraine Country Ukraine is the country where Russian state cyber operations have been most destructive, from the 2015 power grid attack to wiper malware in 2022. Europe United Arab Emirates Country The United Arab Emirates is a Gulf state with a national Cyber Security Council and separate bodies in Dubai and Abu Dhabi. Middle East United Kingdom Country The United Kingdom faces cyber threats from states and from ransomware crews. Europe United States Country This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America

FAQ

Frequently Asked Questions.

Can you attribute an attack to a country?

We link to groups as attributed by named governments and say who attributes them. We do not make our own attribution.
Does it work for several agencies?

You can enter the domains of each agency. The demo can show how findings are grouped.
What does CISA say about public sector networks?

CISA's advisory on state-sponsored activity against network devices says government networks are among the targets, besides telecommunications.
Which rules apply?

NIS2 covers public administration in the EU. National rules differ, so check with your legal team.
Which state-backed groups target public bodies?

Governments have attributed APT28 and APT29 to Russia's military intelligence service (the GRU) and Foreign Intelligence Service (SVR). MITRE ATT&CK attributes Turla to the FSB. Each of these groups has run espionage against public bodies, and each profile on the site names who attributes it.
What happens when remote support software is abused?

In late 2024 a hacker reached a US government network. CISA worked with the agency and the maker of the remote support software involved. It shows how a tool used by a supplier can become the way in.
What happened in the July 2025 attacks on exposed servers?

In July 2025 attackers exploited flaws in on-premises servers that faced the internet. CISA and European and UK bodies urged fast patching. Exposed servers are an easy first target for attackers.
What is targeted phishing against a public office?

It is messages written for one person or office to get a login or a click. Executive and VIP Protection watches for threats aimed at your leaders. Dark Web Monitoring alerts you when staff logins or data tied to your domains are offered for sale.
How can agencies find systems that one office set up alone?

External Attack Surface Management lists the internet-facing systems of your agencies, including ones set up by a single office. You then see what is exposed even when no central team knows about it.
How does vulnerability intelligence help a public body?

Vulnerability Intelligence tells you which flaws are being exploited now. Attacks on exposed servers are a real risk for public bodies, so knowing which flaws matter helps your team patch the right ones first.

Mentioned In

Other Ways In.

All Roles →

RoleCISOSee what is exposed outside your network in terms a board understands, and know what to… RoleMSSPs and service providersRun external threat monitoring for many clients from one platform, with findings you can send to… ArticleAgentic AI in Cybersecurity: How Autonomous Agents Are Transforming the SOCAgentic AI in cybersecurity explained: how autonomous agents triage alerts, investigate incidents and contain threats in… ArticleBlackTechBlackTech is a China-linked cyber espionage group that compromises routers and network devices. Learn its tactics,…

For Government And Public Sector

Stay Ahead Of Digital Threats.

Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.

Request a demo See The Platform