Documented cases attributed to nation-state threat actors, sourced and fact-checked.
An attack attributed to Russia's Sandworm Team used compromised credentials to remotely open substation breakers at three Ukrainian utilities and cut power to about 225,000 customers. Government investigators reported BlackEnergy infections but did not confirm the malware's role in acquiring the credentials.
DocumentedA nation-state cyberweapon crossed an air gap into Iran's Natanz nuclear facility on infected USB drives, first through a recruited insider and later on media carried in by unwitting contractors, then physically destroyed roughly 1,000 uranium centrifuges.
DocumentedNorth Korean operators spear-phished Sony Pictures staff with fake Apple ID "verify your account" emails, harvested reused credentials, and detonated wiper malware that crippled the studio.
DocumentedA spear-phishing email titled "2011 Recruitment Plan," with a booby-trapped Excel attachment, breached security giant RSA; RSA said the stolen SecurID data was later used in an attempted attack on defense contractor Lockheed Martin, a link Lockheed still stands behind and RSA's own former chairman disputed in 2021.
DocumentedGoogle's GTIG and Ukraine's CERT-UA documented PROMPTSTEAL (aka LAMEHUG), Russian APT28 malware that queries an LLM (Qwen2.5-Coder via the Hugging Face API) at runtime to dynamically generate the Windows recon and data-theft commands it then executes against Ukrainian government targets, which GTIG describes as its first observation of malware querying an LLM in live operations.
DocumentedChinese state-linked hackers used spear-phishing links and an unpatched Internet Explorer zero-day to breach Google, Adobe, and dozens of other US tech and defense firms in a campaign that stole intellectual property, targeted Gmail accounts of human-rights activists, and led Google to publicly confront China and stop censoring its search results.
DocumentedKnowBe4 unknowingly hired a North Korean operative for a software engineering role after he passed four video interviews using an AI-enhanced stock photo and a stolen US identity; malware began loading the moment his company laptop arrived, but according to KnowBe4, EDR and the SOC detected and contained the device within about 25 minutes.
DocumentedRussian GRU officers spoofed Google security-alert emails with Bitly-masked links to phish 300+ individuals affiliated with the Clinton campaign, DCCC, and DNC, stealing 50,000+ of the campaign chairman's emails after an IT aide's fateful 'legitimate' typo.
DocumentedIn separate January and July 2025 actions, Treasury/OFAC sanctioned DPRK ministry-linked front companies and associated individuals involved in overseas IT-worker revenue schemes, as well as a China-based equipment supplier. The related Christina Chapman laptop-farm scheme generated more than $17 million, while Treasury's hundreds-of-millions estimate concerns the wider DPRK IT-worker program.
DocumentedTwo New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers use the stolen identities of real Americans to hold remote jobs at more than 100 US firms, generating over $5 million for the DPRK regime and enabling theft of ITAR-controlled defense data before both were sentenced to federal prison in April 2026.
DocumentedA compromised Constant Contact mass-mailing account let Russia-linked Nobelium (APT29) send USAID-spoofed phishing emails that funneled roughly 3,000-7,000 accounts across 150-350 government, IGO, and NGO organizations toward an ISO-file/Cobalt Strike infection chain, prompting a joint CISA/FBI advisory (AA21-148A) and a DOJ domain seizure.
DocumentedNorth Korea-linked operators built polished fake job-interview sites impersonating Coinbase, Kraken, Circle and other crypto firms, then used a fabricated camera-driver error to trick applicants into pasting a 'fix' command into their terminal, installing the GolangGhost backdoor. The roles used as lures were deliberately non-technical, and on macOS a second fake dialog harvested the system password.
DocumentedA suspected Chinese state-sponsored group jailbroke Anthropic's Claude Code by role-playing a "defensive security" pretext and used it to autonomously run 80-90% of an espionage campaign against roughly 30 global targets.
DocumentedA single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that quietly stole personal data on 78.8 million people over the next 11 months.
DocumentedLazarus operators spear-phished a senior Sky Mavis engineer through a fake LinkedIn recruiting process and a spyware-laced job-offer PDF, then pivoted to the Ronin bridge validator keys and drained crypto worth about $540M as it left the bridge on March 23, 2022, and over $615M by the time the loss was noticed six days later.
Social Engineering Examples