State-sponsored cyber attacks: what they are, who's behind them, and why small businesses should care
By Jera IT
Originally published December 2024. Refreshed November 2026: state-linked groups have broken into telecoms networks worldwide, and North Korea now gets fake remote IT workers hired inside UK firms, so we've updated this guide for today.
“State-sponsored hacking” sounds like something for governments and defence firms to worry about. But the groups behind it regularly pass through ordinary businesses on the way to bigger targets, and some of them are simply after money.
The short answer: a state-sponsored cyber attack is one a government carries out or pays for. Small businesses are rarely the final target, but they’re often the way in.
What is a state-sponsored cyber attack?
It’s an attack backed by a nation state, either by its own intelligence or military units or by criminal groups working with its protection. The usual goals:
- Espionage. They steal government, defence and commercial secrets.
- Disruption. They damage infrastructure or services in another country.
- Intellectual property theft. They take designs, research and trade secrets.
- Money. Some states, notably North Korea, use cyber crime to raise funds.
What sets these groups apart is resources and patience. They can spend months inside a network, quietly watching, before they act.
Which countries are behind state-sponsored attacks?
The UK’s National Cyber Security Centre (NCSC) singles out four states in its Annual Review 2025:
| Country | Typical focus |
|---|---|
| Russia | Disruption, espionage, and attacks on organisations supporting Ukraine |
| China | Large-scale espionage and intellectual property theft, including deep access to telecoms networks |
| Iran | Espionage and disruption, often targeting critics and organisations in the Middle East |
| North Korea | Raising money: crypto theft, fraud, and fake remote IT workers |
Why small businesses end up in the firing line
- Supply chains. If you supply a council, a utility, a law firm or a larger company, your systems can be a back door into theirs.
- Shared software. When a widely used product has a flaw, attackers scan the whole internet for it. Small businesses get caught in the net.
- Stolen logins. Credentials taken from one business are used to get into another.
- Fake job applicants. North Korean operatives use false identities to get hired as remote IT workers, collecting salaries and access to company systems. The NCSC says UK firms are almost certainly being infiltrated this way.
What has changed since we first wrote this
- AI at scale. State groups use AI to write convincing phishing and to find weaknesses faster (NCSC).
- Telecoms compromised. China-linked groups have broken into telecoms providers in many countries, mostly through known flaws that timely patching would have closed (NCSC, August 2025). So don’t assume the network is safe: encrypt what matters. See what is encryption.
- Hiring as an attack route. The fake-IT-worker schemes mean identity checks on remote hires and contractors are now a security control as well as an HR task.
How to protect your business
You don’t need a government-sized budget. The groups behind these attacks mostly get in through the same gaps as everyday criminals:
- Keep everything updated, especially internet-facing systems like firewalls, VPNs and email.
- Use multi-factor authentication on every account.
- Monitor devices with endpoint detection and response. See what is an endpoint.
- Keep backups you can restore, including one copy attackers can’t delete. See business data backup.
- Check who you connect to. Ask about suppliers’ security, and confirm the real identity of remote hires and contractors.
- Have a plan for when something happens. See incident response plans.
Where an AI agent helps
The groups behind these attacks count on nobody watching:
- AI Security-Monitoring Agent ↗: watches for threats around the clock and raises the alarm.
See all our agents in the solutions library on jerait.ai ↗, or find the right agent for your business on jerait.ai ↗.
The catch: the AI an agent runs on is paid for by use. With Jera IT support, your first agent is built, supported and maintained free; we give you a rough idea of the usage cost before you commit, and a real figure from the trial.
How Jera can help
We protect businesses across Edinburgh, Glasgow and Aberdeenshire with the basics done properly, and our security monitoring runs 24/7 through an external security operations centre. If a larger client has started asking about your security, book a call and we’ll talk through where you stand.
Frequently asked questions
What is a state-sponsored cyber attack?
It's a cyber attack carried out or paid for by a national government or its agencies. The aims are usually espionage, disrupting another country or stealing intellectual property, and in some cases raising money for the state.
Which countries are behind state-sponsored cyber attacks?
The UK's National Cyber Security Centre singles out Russia, China, Iran and North Korea as the state cyber threats to the UK in its Annual Review 2025, though many countries run offensive cyber programmes.
What is a key characteristic of state-sponsored attackers?
They're well resourced and patient. Unlike most criminals, they will spend months quietly inside a network, aiming for long-term access rather than a quick payout.
Why would a state target a small business?
Usually as a stepping stone. A small business may supply a larger organisation, or hold logins that open doors elsewhere. Some state groups, notably North Korea's, also simply steal money.
How can a small business protect itself from state-sponsored attacks?
Mostly with the same basics that stop ordinary criminals: keep systems updated, use multi-factor authentication everywhere, monitor devices with endpoint detection and response, keep backups you can restore, and verify new suppliers and remote hires carefully.
Sources
- NCSC Annual Review 2025: the cyber threat to the UK, National Cyber Security Centre
- UK and allies expose China-based technology companies for enabling global cyber campaign against critical networks, National Cyber Security Centre
