Nation State Cyber Activity Statistics: Cross Country Figures on Espionage, Targets and Theft

State-backed cyber activity is discussed constantly, but the numbers behind it are scattered across government reviews, breach datasets and vendor threat reports that count different things in different ways. This page brings together the cross-country figures we could trace to their publishers: the UK National Cyber Security Centre (NCSC) Annual Review 2025, the ENISA Threat Landscape 2025, the Verizon 2026 Data Breach Investigations Report (DBIR), the CrowdStrike 2026 Global Threat Report and FBI public service announcements. Each figure carries its source and period, and the caveats section explains why vendor counts and government counts should not be added together. The page is written for threat intelligence analysts, CISOs and risk teams who need defensible numbers for threat assessments. Country-by-country detail on groups and tradecraft sits in the country profiles, starting with the Russia State Cyber Operations Guide. Last reviewed: November 2026.

Source note: figures are quoted from the NCSC, ENISA, Verizon, CrowdStrike and FBI publications listed in the references, as checked in November 2026; CrowdStrike figures are single-vendor telemetry and labelled as such. Confirm against the official text before relying on it.

Key takeaways

• Nationally significant incidents more than doubled in the UK. The NCSC handled 204 nationally significant incidents in the year to August 2025, up from 89, out of 429 incidents in total.
• State-affiliated actors appear in close to 15% of breaches. The Verizon 2026 DBIR puts state-affiliated actors in close to 15% of the breaches it analysed, with espionage most concentrated in utilities (71%) and public administration (33%).
• Region changes the picture completely. The same DBIR finds an espionage motive in 36% of APAC breaches and 27% of EMEA breaches, against 3% in North America.
• Vendor telemetry shows sharp growth. CrowdStrike reports China-nexus activity up 38% in 2025, DPRK-linked incidents up more than 130% and state-nexus attempts on cloud environments up 266%.
• Theft is now a state activity. The FBI attributed the theft of about $1.5 billion in virtual assets from the Bybit exchange in February 2025 to North Korea.

Headline statistics

Statistics by theme

Government incident counts

Government agencies publish the most defensible counts, because they come from incidents the agency handled, but they rarely give a per-country attribution split.

• United Kingdom: the NCSC Annual Review 2025 (published 14 October 2025) records 429 incidents handled, 204 of them nationally significant, up from 89 the year before, and 18 highly significant, the third consecutive annual increase. That is roughly four nationally significant incidents a week. The review describes China as a "highly sophisticated and capable threat actor" and Russia as a "capable and irresponsible threat actor", assesses that Iranian activity highly likely extends to UK entities, and says DPRK IT workers almost certainly target UK firms. It does not publish the share of incidents attributed to each state.
• Botnets as state infrastructure: the same review cites the NCSC's exposure of a botnet of more than 260,000 compromised devices run by a China-linked company (the group tracked as Flax Typhoon). See the Flax Typhoon Threat Actor Profile Guide.
• European Union: ENISA analysed 4,875 incidents between 1 July 2024 and 30 June 2025. Public administration was the most targeted sector at 38.2%. DDoS made up 77% of incidents, mostly by hacktivists, and hacktivism accounted for almost 80% of incidents overall, yet only 2% of hacktivist incidents caused service disruption. ENISA reports that state-aligned groups steadily increased cyber espionage against EU public administration, without giving a percentage.

Espionage in breach data

The Verizon DBIR codes the motive behind each breach in its dataset. Espionage is the motive most associated with state actors, and the DBIR says state-affiliated actors appear in close to 15% of breaches. Because a breach can have more than one motive, the shares below do not sum to 100%.

Source for every row: Verizon 2026 Data Breach Investigations Report, industry and regional sections. By attack pattern, espionage was present in 25% of Social Engineering breaches, 23% of Basic Web Application Attacks and 12% of System Intrusion breaches in the same report. In our reading, the low North American figure most likely reflects the volume of financially motivated ransomware and fraud in that region's data, not an absence of state activity.

Vendor telemetry by country nexus

Security vendors see activity across their customer base and publish year-on-year changes. These are not population statistics, but they are the only regular per-country trend data.

CrowdStrike tracks more than 280 named adversaries and published the report on 24 February 2026. Its press release gives no Iran-specific figure, so none is shown here. Country detail is in the China State Cyber Operations Guide, the Iran State Cyber Operations Guide and the North Korea Cyber Operations Guide.

State-backed theft

North Korea is the clearest case of a state using cyber operations for revenue. The FBI's public service announcement of 26 February 2025 attributed the theft of approximately $1.5 billion in virtual assets from the Bybit exchange, on or about 21 February 2025, to North Korean actors it calls TraderTraitor. CrowdStrike, which tracks the same activity as PRESSURE CHOLLIMA, describes it as the largest single financial heist ever reported. The Bybit Hack 2025 page shows how a developer's AWS session tokens, stolen from a compromised laptop, let the attackers bypass MFA and alter wallet code. The NCSC also assesses that UK-based cryptoasset firms are currently at risk of being targeted by DPRK-linked hackers.

What the numbers mean for defenders

• Use sector and region, not headlines: a utility in Asia Pacific and a retailer in North America face very different espionage rates in the DBIR data. Build threat assessments from the rows that match you.
• Prioritise edge devices: CrowdStrike's finding that 40% of the vulnerabilities China-nexus actors exploited were in internet-facing edge devices is consistent with many government advisories. See the Edge Device Exploitation by Threat Actors Guide.
• Watch cloud and identity: a 266% rise in state-nexus cloud targeting and the Bybit token theft both point at credentials and sessions. Monitor for valid account abuse (ATT&CK T1078) as closely as exploitation (T1190).
• Screen hiring for DPRK IT workers: with FAMOUS CHOLLIMA activity more than doubling and the NCSC assessing UK firms are almost certainly targeted, identity verification in remote hiring is now a security control.
• Do not dismiss hacktivist noise, but size it: ENISA found hacktivism behind almost 80% of EU incidents but only 2% caused disruption. Resilience to DDoS matters; panic over defacements does not.

Building a threat assessment from these figures

Cross-country statistics are most useful as the opening section of an annual threat assessment. A repeatable approach:

1. Pick your baseline rows: take the DBIR espionage share for your industry and region, for example 33% for public administration or 36% for Asia Pacific. This sets how much weight state activity gets against ransomware and fraud.
2. Add your national view: use your national agency's figures (for UK organisations, the NCSC's 204 nationally significant incidents and its country assessments). National agencies also publish the advisories you will act on.
3. Add the trend layer: use vendor year-on-year changes, clearly labelled as one vendor's telemetry, to show direction: China-nexus up 38%, DPRK up more than 130%, cloud targeting up 266%.
4. Name the likely actors: move from statistics to the country profiles and actor pages that match your sector, such as the Salt Typhoon Threat Actor Profile for telecoms or the Volt Typhoon Threat Actor Profile for critical infrastructure.
5. Translate into controls and KPIs: map the highlighted techniques to controls you can measure, using the metrics table below.
6. Review annually: the NCSC, ENISA, Verizon and CrowdStrike reports are all annual. Note each figure's edition so next year's update is a straight replacement.

NHI Mgmt Group recommendation: small organisations can stop at steps 1, 2 and 5: the main lesson of the data for them is that edge device patching and identity hygiene cover most state techniques. Large organisations in utilities, government, defence supply chains or Asia Pacific markets should complete all six steps and keep a named owner for state threat intelligence.

Where identity fits

Several of the figures above are identity stories. State actors increasingly use stolen credentials, session tokens and fraudulent employee identities rather than malware alone: DPRK IT workers pass hiring checks with false identities, the Bybit theft turned on a developer's cloud session tokens, and cloud intelligence collection depends on access to accounts and service principals. Threat assessments should name the identities most likely to be targeted, including machine identities with access to source code and cloud control planes. See the Threat Intelligence for Identity and NHI Guide.

Measuring your exposure to state activity

Common failure patterns when using these statistics

• Adding vendor and government counts together: the NCSC counts incidents it handled, ENISA counts incidents it analysed from open sources, and vendors count activity in their telemetry. They overlap and cannot be summed.
• Reading vendor growth as global growth: a 38% rise in China-nexus activity is what one vendor observed in its customers. It shows direction, not a global count.
• Treating espionage as identical to state activity: the DBIR's espionage motive is a proxy; some espionage is commercial and some state activity (such as DPRK theft) is financially motivated.
• Ignoring the reporting year: the NCSC year runs September to August, ENISA July to June, and vendor reports cover calendar years. Always state the period.
• Taking attribution at face value: attribution is a judgement with confidence levels. See the Cyber Threat Attribution Guide.
• Missing hacktivist proxies: pro-Russia hacktivist groups, which the NCSC says target the UK and NATO countries less predictably, may not be counted as state activity even when aligned with state goals.

Methodology notes and caveats

NCSC figures cover incidents reported to and handled by the UK NCSC between 1 September 2024 and 31 August 2025; many incidents are never reported. ENISA analysed 4,875 incidents from 1 July 2024 to 30 June 2025, largely from open sources, which favours visible activity such as DDoS. Verizon DBIR shares are of breaches in its contributor dataset and are non-exclusive. CrowdStrike figures are from its own telemetry and intelligence for 2025 and use its own adversary naming. FBI attributions are formal government statements for specific incidents. No public source gives a reliable global count of state-sponsored attacks by country, so this page does not offer one.

Framework mapping

Practitioner checklist

• Quote every figure with publisher, report name and period.
• Select the DBIR industry and regional rows that match your organisation.
• Keep government counts and vendor telemetry in separate rows of any briefing.
• Map the country profiles relevant to your sector and region, and review them each year.
• Track edge device patching against state-actor advisories as a standing KPI.
• Add identity proofing for remote hires and review long-lived developer tokens.
• Record attribution confidence alongside any state attribution you repeat.
• Refresh this page's figures when the NCSC, ENISA, Verizon and CrowdStrike publish their next editions.

Standards and references

• NCSC: UK experiencing four nationally significant cyber attacks every week (Annual Review 2025)
• NCSC: Annual Review 2025, Chapter 1, Cyber threat to the UK
• ENISA: Threat Landscape 2025
• Verizon: 2026 Data Breach Investigations Report
• FBI IC3: North Korea responsible for $1.5 billion Bybit hack
• CrowdStrike: 2026 Global Threat Report press release

Related NHI Mgmt Group resources: Russia State Cyber Operations Guide · China State Cyber Operations Guide · North Korea Cyber Operations Guide · Threat Intelligence Guide