Skip to main content
Return to TrendAI Deep Research
AI & emerging technologiesAPTsCyber crime

From State AI Ecosystems to Global APT Cyberthreats

TrendAI™ Research examines the unique dynamics and factors that influence the adoption of AI in state-aligned APT activity. The report looks into four countries (China, Russia, North Korea, and Iran) to understand why their state-aligned actors adopt AI in the ways that they do.

AIAPTsCyber crimeCyber threatsResearch featuresDeep dives
October 6th, 2026 10 min read Asako Koizumi , Feike Hacquebord

Key Takeaways

  • AI adoption among state-aligned actors is uneven, shaped by each country’s resources, constraints, strategic priorities, and access pathways.
  • China is best positioned to integrate AI into cyber operations due to the depth and redundancy of its domestic AI ecosystem, providing fallback domestic models when Western access is cut off.
  • Russia-aligned actors have moved from AI research support toward operational integration. This includes LLM-generated malware commands (e.g., LAMEHUG) and AI-generated decoy code (e.g., CANFAIL, LONGSTREAM), and at least one espionage campaign that applied AI across the full intrusion lifecycle.
  • North Korea substitutes access for infrastructure, using foreign AI services and its IT worker scheme (which has infiltrated more than 100 U.S. companies) to compensate for severe domestic compute constraints.
  • Cross-actor cooperation (Russia – China, Russia – North Korea, Iran – Russia) may create channels through which AI-relevant tools, techniques, and capabilities spread between actors.

With additional insights by: Joseph C Chen

AI has become a strategic capability for nations, shaping how they compete, defend, and project power, especially in cyberspace. How a government adopts AI reveals much about its priorities and constraints, and those same factors shape state-aligned cyber activity, particularly advanced persistent threats (APTs).

This research examines how national AI ecosystems, resource limitations, and access to domestic and foreign AI capabilities shape the way state-aligned actors in China, Russia, North Korea, and Iran adopt AI in cyber operations.

The full report, “AI Statecraft and Cyberthreats in 2026: How National AI Ecosystems Shape APT AI Adoption,” provides a comprehensive look at each state's adoption of AI, drawing on our own research as well as findings publicly reported in recent years; this article summarizes its key findings.

Figure 1. How national AI ecosystems have shaped APT AI adoption
Figure 1. How national AI ecosystems have shaped APT AI adoption

China

China has the strongest structural foundation for AI-enabled cyber operations. Its research base, domestic model ecosystem, military-civil fusion framework, and infrastructure investment provide both advanced capabilities and domestic fallback options.

Mirroring these developments, China-aligned actors have used AI for vulnerability research, exploit adaptation, malware development, and post-compromise activity, including one suspected case in which an operator switched from a Western model to a domestic Chinese model during an intrusion.

Russia

Russia uses AI selectively and as a force multiplier under resource constraints. Russia-aligned actors have used large language models (LLMs) for reconnaissance, scripting, malware development, obfuscation, and runtime command generation. In at least one espionage campaign, AI was applied across the full intrusion lifecycle. This proves that despite constraints in frontier-model development, actors have not been hindered from achieving operational gains.

North Korea

North Korea substitutes access for infrastructure. North Korea-aligned actors make up for limited domestic compute by combining foreign AI services, overseas personnel, and locally hosted models, supporting employment fraud, social engineering, malware-related activity, and intelligence collection.

Iran

Iran combines a constrained domestic frontier-AI ecosystem with extensive use of commercial AI services. Iran-aligned actors have used AI for targeted social engineering, reconnaissance, vulnerability research, coding, malware development, and influence operations, while reliance on hosted services also creates provider-side detection and disruption opportunities.

Takeaways for defenders

The key issue is not simply whether an actor has frontier AI. Access to capable models can already produce meaningful operational gains. Ecosystem depth, however, determines how reliably, independently, and at what scale those capabilities can be sustained.

The resilience of these AI-enabled strategies varies with the maturity of the domestic AI ecosystem and the availability of alternative channels. Defenders should assume that disrupting a single provider or account will not necessarily eliminate an actor’s access to capable models.

Defending against APT attacks therefore means accounting for each actor's national AI ecosystem and how they've circumvented constraints so far. Here are a few of our recommendations:

  • Defenders should treat connections to AI service endpoints as useful but incomplete indicators and place greater emphasis on endpoint and behavioral detection. Anomalous connections to AI service endpoints from servers or other unexpected hosts are a practical signal worth monitoring. However, this visibility may decline as actors move away from hosted services.
  • Attribution needs to lean more heavily on broader operational context, including infrastructure, targeting, access methods, victimology, and campaign behavior. As actors increasingly delegate code generation, modification, and obfuscation to widely available models, coding style and other implementation-level characteristics may become less reliable indicators of actor identity.
  • Organizations of interest to APT actors, including AI companies and other technology firms, should apply stronger identity verification, tighter contractor and remote-worker onboarding, and least-privilege access controls.
  • Hardening internet-facing systems, deploying phishing-resistant authentication, and monitoring for credential abuse and lateral movement remain the core countermeasures; what AI changes is the tempo and scale at which those attacks arrive.

Read the full paper for the complete picture: detailed case studies, technical indicators, and country-specific tradecraft behind each of these findings.

About the authors

The Forward-Looking Threat Research Team of TrendAI™ Research is a group that specializes in scouting technology for one to three years in the future, with a focus on three distinct aspects: technology evolution, its social impacts, and criminal applications. As such, the team has been keeping a close eye on AI and its potential misuses since 2020, when the team authored, in collaboration with Europol and the United Nations Interregional Crime and Justice Research Institute (UNICRI), a research paper on this very topic.