Cyber Espionage.

What is cyber espionage?

Cyber espionage is the use of computer networks to secretly get information that someone wants to keep private. The focus is on watching and collecting information. The target can be a company, a public body or a person.

CISA lists espionage next to data theft and network or system disruption or destruction as objectives of advanced persistent threat activity. It describes such actors as well-resourced and says their activity is targeted and aimed at prolonged network or system intrusion.

How does cyber espionage work?

Cyber espionage is not one technique. It is a goal, and the steps used to reach it can differ. Two stages from the MITRE ATT&CK framework explain much of the data side.

• Collection. MITRE ATT&CK says the adversary is trying to gather data of interest to their goal. It says the data can come from sources such as drives, browsers, audio, video and email. Common methods include screenshots and keyboard input capture.
• Exfiltration. MITRE ATT&CK says the adversary is trying to steal data. This means removing the collected information from the target network. MITRE says it often involves packaging such as compression and encryption to avoid detection. The data often leaves through command and control channels or other means, and the transfer can have size limits.

What does a simple example look like?

This is a simple illustration, not a real case. An intruder gains access to a network, quietly gathers documents of interest, packages them and sends them out. The organization may notice nothing, because the goal is to stay unseen while the data leaves.

How can organizations reduce the risk?

CISA gives advice for defending against advanced persistent threat activity. It is also a useful base for espionage risk.

• Implement the Cybersecurity Performance Goals (CPGs) from CISA.
• Prioritize known exploited vulnerabilities.
• Apply the principle of least privilege, which means people and systems get only the access they need.
• Set up baseline monitoring so you can detect anomalous activity on endpoints, such as laptops and servers.

How does it relate to nearby terms?

Advanced persistent threat describes a type of actor, while cyber espionage describes a goal. Data exfiltration is the stage in which stolen data is moved out. Related terms: advanced persistent threat, data-exfiltration and tactics-techniques-and-procedures.

Is cyber espionage the same as a data breach?

Not always. A data breach is an event in which data is exposed or taken. Cyber espionage is about the purpose, which is secret information gathering. An espionage operation can involve stolen data, but the two terms describe different things.

Is cyber espionage the same as cyber crime?

Not by definition. Cyber espionage is defined by its aim of gathering information. CISA lists espionage as one objective among several, along with data theft and disruption or destruction. Which objective applies depends on who is behind the activity.

Can small organizations be targets?

CISA describes advanced persistent threat activity as targeted. Whether a given organization is a target depends on what information it holds, so every organization can review its own risk.

In Japan, the National Police Agency and the National Center of Incident Readiness and Strategy attributed the MirrorFace campaigns of 2019 to 2025 to MirrorFace, with suspected Chinese involvement.