Nation-state hackers generally pursue objectives tied to a government’s interests—such as intelligence gathering, strategic access, disruption or sabotage—while cybercriminals usually seek money through ransomware, data theft and extortion. Their techniques can overlap, so motive and operational context are more useful clues than any single tool or tactic.
How do nation-state hackers differ from cybercriminals?
The clearest distinction is usually the operation’s apparent purpose. A state-linked operation may collect intelligence or preserve access for a strategic reason; a criminal operation is commonly organized to make money. That difference affects which targets matter, what attackers do with stolen data and whether they make a public demand.
As an Amazon Associate I earn from qualifying purchases.
| Dimension | Nation-state-linked operation, often | Financially motivated criminal operation, often |
|---|---|---|
| Primary objective | Intelligence collection, strategic access, disruption or sabotage; sometimes reputational harm. | Ransom payments, extortion, theft or other monetization. |
| Target logic | Targets may be valuable for their intelligence, strategic or geopolitical significance. A 2025 CISA and NSA advisory described activity involving telecommunications, government-related, transportation, lodging and military infrastructure. See the advisory. | Victims may be selected for their ability to pay or the value of their data or access. LockBit affiliates attacked organizations across many sectors. |
| Use of stolen data | Data can support intelligence work, including identifying or tracking targets. | Data may be sold, used as leverage or threatened for disclosure to increase pressure to pay. |
| Visible demand | A public ransom demand may be absent when covert access or intelligence is the objective. | A ransom or extortion demand is a strong financial signal, though not definitive proof of who is behind an operation. |
The target and data-use examples for Chinese state-sponsored activity come from a CISA and NSA advisory last revised September 3, 2025: Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. CISA said stolen information could help Chinese intelligence services identify and track targets’ communications and movements.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteHow criminal ransomware makes money
Ransomware operations can function as businesses. CISA’s June 2023 LockBit advisory describes a ransomware-as-a-service model in which developers maintain the operation and affiliates deploy the ransomware. The arrangement distributes the work and shares the financial proceeds among participants. In 2022, LockBit was the most deployed ransomware variant globally, according to that 2023 advisory; this is a historical ranking, not a current one. Read CISA’s LockBit advisory.
Extortion is not limited to encrypting files. CISA’s September 2023 #StopRansomware Guide describes double extortion: attackers encrypt files and threaten to disclose stolen data. Some incidents use data theft and disclosure threats without encrypting files at all.
#1 Best Overall
State-linked operations can pursue more than espionage
Government-linked activity is not limited to quietly collecting information. A September 2024 CISA advisory says cyber actors associated with Russian military intelligence Unit 29155 conducted operations for espionage, sabotage and reputational harm since at least 2020, including activity during and after the deployment of WhisperGate against Ukraine. Read the advisory.
These are government agencies’ reported examples, not a description of every state-linked actor or criminal group. The underlying objectives and methods vary between operations.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy tactics alone do not identify the attacker
Both categories can exploit vulnerabilities, abuse credentials, use malware and build or rent infrastructure. A technique may offer investigators a clue, but it does not establish attribution by itself.
- Network access and persistence: CISA and NSA reported that PRC state-sponsored actors compromised network devices, exploited publicly known vulnerabilities and modified routers or access control lists to maintain access. The advisory references MITRE ATT&CK Enterprise and ICS version 17. See the technical details.
- Credential theft and scanning: A joint CISA, FBI and Department of Energy advisory documents Russian state-sponsored actors using scanning, spearphishing for credentials and malware in energy-sector campaigns dated 2011–2018. These are historical examples, not evidence of current campaign frequency. Read the advisory.
- Criminal access methods: CISA’s Play ransomware advisory describes valid-account abuse and exploitation of public-facing applications as observed initial-access techniques. LockBit affiliates’ tactics varied, as expected in an affiliate-based operation. Read the Play advisory.
It is misleading to divide attackers into technically sophisticated states and unsophisticated criminals. Public advisories describe technical exploits, credential abuse, infrastructure and malware in both contexts; no single technique is exclusive to either category.
Rank #3
When the categories overlap
Ransomware is typically financially motivated, but the label does not guarantee a purely criminal purpose. CISA’s Threat Evaluation Working Group notes that ransomware may also be used by nation-state actors or serve as a red herring for another objective. A visible encryption event or payment demand should therefore be treated as evidence to investigate, not a complete explanation of the operation. See CISA’s Information Technology: Threat Scenarios, Version 2.0.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to read an incident report
When assessing a reported operation, separate what happened from what analysts believe it was intended to accomplish:
- Start with the reported activity. Identify the affected organizations, access method, malware or other observed behavior, and the source’s reporting period.
- Look for the apparent payoff. Intelligence collection, persistent strategic access, sabotage, reputational damage, payment demands and data-leak threats point toward different possible objectives, but none proves attribution alone.
- Check how the assessment is framed. Distinguish confirmed observations from an agency’s assessment of an actor’s identity or motive. Keep the advisory’s date and campaign period attached to the claim.
- Allow for mixed or concealed objectives. A criminal-looking extortion incident might obscure another purpose; an actor can also pursue more than one objective.
Because attribution and tactics change, the cited examples should be read within their stated dates and reporting periods. Later advisories may update what is known about current activity.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
