Crimelords and spies for rogue states are working together, says Google

Google’s Threat Intelligence Group warns that state-backed actors in Russia, China, Iran, and North Korea increasingly leverage cybercriminal markets and services—accelerating ransomware and financially motivated operations that hit critical sectors like healthcare—and urges governments to treat cybercrime as a national security priority, incentivize secure-by-design practices, expand international cooperation and information sharing, and disrupt enablers such as bulletproof hosting and crypto intermediaries; despite takedowns of groups like LockBit and ALPHV, the ecosystem remains resilient, with actors including APT44 (Sandworm), Turla, and APT29 sourcing capabilities from criminal marketplaces.