Top Nation-State Cyber Threats Targeting the United States

This SOCRadar report profiles top nation-state cyber threats to the United States in 2025–2026, detailing China-linked operations (Salt Typhoon targeting email/telecom and APT5 spearphishing of defense personnel), Russia-linked campaigns (GRU/APT28 targeting logistics and defense supply chains), North Korea activity (Kimsuky QR-code spearphishing and recruitment/remote IT worker schemes), and Iran-linked credential-harvesting via spoofed hiring/vendor workflows (UNC1549, UNC6446); it emphasizes credential- and identity-focused tactics, persistence through third-party and telecom access, and recommends hardening identity, treating personal email/mobile as enterprise risk, and tightening third-party exposure management.