HACKTIVISTS , state-sponsored actors, and profit-driven cybercrime groups have been identified as targeting the global defence industrial base, according to a Google Threat Intelligence Group (GTIG) analysis published on 12 February 2026. The report describes a relentless, multi-vector threat landscape involving actors linked to China, Russia, Iran and North Korea, plus pro-Russia and pro-Iran hacktivists and various cybercriminal groups conducting ransomware against manufacturing.
China-nexus cyber espionage is said to dominate in volume, with long-dwell intrusions into aerospace and defence entities often exploiting edge devices and zero-days; groups cited include UNC4841, UNC3886 and UNC5221. Russian actors such as APT44 (Sandworm), UNC5125 and UNC5792 have targeted battlefield-adjacent technologies like drones, while North Korea-linked groups including APT45 and APT43 have spied on or impersonated defence entities in the US, Germany and South Korea.
GTIG notes that some threat actors are using large language models to aid reconnaissance, social engineering, and post‑compromise activities, and stresses the need for integrated threat intelligence and expanded visibility to counter these multi-vector attacks.