Documented cases attributed to nation-state / apt threat actors, sourced and fact-checked.
A Ukrainian-language "shared document" phishing wave used a fake reCAPTCHA "verify you are human" ClickFix page to trick victims into pasting and running.
ConfirmedRussia's Sandworm Team used spear-phishing emails with malicious Office macro attachments to plant BlackEnergy3 malware inside three Ukrainian power.
ConfirmedA nation-state cyberweapon crossed an air gap into Iran's Natanz nuclear facility on infected USB drives carried in by trusted contractors.
ConfirmedNorth Korean operators spear-phished Sony Pictures staff with fake Apple ID "verify your account" emails, harvested reused credentials.
ConfirmedA single spear-phishing email titled "2011 Recruitment Plan," with a booby-trapped Excel attachment.
ConfirmedGoogle's GTIG and Ukraine's CERT-UA documented PROMPTSTEAL (aka LAMEHUG).
ConfirmedChinese state-linked hackers used spear-phishing links and an unpatched Internet Explorer zero-day to breach Google, Adobe.
ConfirmedKnowBe4 unknowingly hired a North Korean operative for a software engineering role after he passed four video interviews using an AI-enhanced stock photo.
ConfirmedRussian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
ConfirmedRussian GRU officers spoofed Google security-alert emails to phish 300+ Democratic campaign staff, stealing 50,000+ of John Podesta's emails.
ConfirmedTreasury/OFAC sanctioned North Korean Ministry of National Defense and Munitions Industry Department front companies in Laos, China.
ConfirmedTwo New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers pose as American remote employees at 100+ US firms.
ConfirmedOperation Buckshot Yankee: a malware-laden USB drive plugged into a U.S. military laptop in 2008 spread the agent.btz worm onto classified DoD networks.
ConfirmedA compromised Constant Contact account let Russia-linked Nobelium send USAID-spoofed phishing emails to 150-350 government and NGO organizations.
ConfirmedLazarus-linked operators built polished fake job-interview sites impersonating Coinbase, Kraken, Circle and other crypto firms.
ConfirmedIn late December 2012, attackers rigged the Council on Foreign Relations website to silently exploit an Internet Explorer zero-day and drop malware.
ConfirmedA suspected Chinese state-sponsored group jailbroke Anthropic's Claude Code by role-playing a "defensive security" pretext and used it to autonomously run.
ConfirmedA single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that stole data on 78.8 million people.
ConfirmedLazarus operators spear-phished a senior Sky Mavis engineer through a fake LinkedIn recruiting process and a spyware-laced job-offer PDF.
Social Engineering Examples