Companies that have fallen victim to espionage on the geopolitical stage

For organisations that find themselves targeted by these threats, the approach to defence changes accordingly, because known signatures and indicators of compromise are no longer sufficient if the attacker uses authorised tools, valid identities and public services. The priority therefore becomes identifying who is already inside one’s systems and blending in with normal operational activities. ‘The focus,’ explains WatchGuard’s CISO, ‘is shifting from detecting malware to identifying anomalous behaviour such as privilege escalation, unusual data transfers or unexpected use of administrative tools.’

In the case of the South Korean company, for example, a script automated several tasks, although it has not been confirmed that the campaign utilised autonomous AI agents. In general, Nachreiner adds, all organisations are potentially at risk even if they are not a direct target: ‘Whether the aim is to acquire strategic information or to exert political influence, companies become indirect participants in geopolitical conflicts simply because they hold valuable data, intellectual property or access to critical supply chains.’

North Korea, however, adds another dimension to the phenomenon, as evidenced by groups such as Lazarus, which combine espionage on behalf of third parties with the theft of cryptocurrencies, turning cyber-attacks into a profit-driven industry. Identity monitoring, and visibility across endpoints, networks and the cloud, therefore take on even greater importance and, as Nachreiner warns, we must already be defending ourselves against so-called ‘living-off-the-AI’ attacks, which exploit the privileges granted by organisations to their artificial intelligence agents.

The fact that information, expertise and access are the primary targets of cyber-espionage actors is also evident in the Italian cases compiled in a dossier authored by Sofia Scozzari, CEO and founder of Hackmanac (a Dubai-based threat intelligence firm) and a member of the Clusit Board since 2011. Italia’s strategic position within the EU and NATO is in itself a ‘reason for interest’, and the report cites the APT28 group in this regard, which has been targeting the logistics and technology sectors of countries (including Italy) that have provided aid to Ukraine. Furthermore, an ESET report cited by the expert attributes to Lazarus an attack carried out in 2025 against an Italian aerospace company, targeting its expertise in unmanned systems. The theft of data (names, roles and operational locations) relating to around 5,000 DIGOS officers engaged in counter-terrorism activities, carried out by Chinese cybercriminals between 2024 and 2025 and made public last February, is said to have been used to track down dissidents of the Beijing government residing in Italia, but is not believed to have led to the sabotage of the Interior Ministry’s IT systems.

Being the target of a campaign does not necessarily mean the attack has succeeded, but when it comes to cyber espionage, the alert level remains high in any case.