What is cyber warfare?

Cyber warfare is the use of cyberattacks by a state, or by proxies acting for a state, against another state to cause harm comparable to conventional conflict: disrupting critical infrastructure, sabotaging military or economic systems, stealing secrets, or shaping public opinion. Cyberwarfare covers espionage, sabotage, denial-of-service attacks, and information operations. The term is contested, and most state activity in cyberspace sits below the threshold of armed conflict, in the gray zone between war and peace.

Cyberwarfare involves state-sponsored actors and the hacktivists and criminal groups that act for or alongside them, each with geopolitical or ideological motivations. Its goals may include intelligence gathering, political influence, economic disruption, or military advantage.

At a glance

• Cyber warfare is the use of cyberattacks by a state or its proxies against another state to cause harm comparable to conventional conflict.
• The main types include espionage, sabotage, denial-of-service, and influence operations, among the 13 types covered below.
• It is hard to attribute, cheap relative to its impact, and frequently aimed at critical infrastructure.
• Documented examples include the 2007 attacks on Estonia, Stuxnet (2010), NotPetya (2017), and Volt Typhoon (2024).
• Much of it happens in peacetime through pre-positioning inside networks, as the Cybersecurity and Infrastructure Security Agency (CISA) documented with Volt Typhoon in 2024.

Key characteristics of cyber warfare

Four characteristics separate cyber warfare from other cyberattacks:

• Attribution is hard. Attacks route through proxies, front groups, and borrowed infrastructure, so governments often take months or years to name a culprit, and some attacks are never formally attributed. The 2007 attacks on Estonia are still in that category.
• It is asymmetric. Cyber operations cost far less than conventional forces, so smaller states and proxy groups can cause damage well beyond their military power.
• It targets critical infrastructure. Power, water, hospitals, transport, and finance are frequent targets alongside military systems.
• It blurs war and peace. Intrusions are often planted in peacetime, ready for use in a crisis. In advisory AA24-038A (7 February 2024), CISA, the NSA, the FBI, and international partners described People’s Republic of China (PRC) state-sponsored actors pre-positioned in U.S. critical infrastructure using built-in tools and valid accounts, with access in some networks for at least five years.

What are the motivations for cyberwarfare?

Cyber warfare is driven by three main motivations: military advantage, political activism, and state-directed financial gain.

Military

Nation-states may engage in cyber warfare to cripple an enemy’s critical infrastructure, disrupt military operations, steal classified information, or gain a strategic advantage. Targets can include power grids, financial systems, communication networks, or weapon control systems. The goal is to weaken an opponent’s military capabilities and potentially coerce them into meeting the aggressor’s demands.

Hacktivism

Hacktivist groups are often politically motivated and use cyberattacks to promote a social or political cause. They may target government websites, corporations, or organizations they believe are acting unethically, by leaking sensitive data, defacing websites, or launching denial-of-service attacks. Their aim is to raise awareness, influence public opinion, or embarrass their targets.

State-directed financial gain

Ordinary cybercrime is not cyber warfare. Criminal activity becomes part of cyber warfare when a state directs it, profits from it, or shelters the groups behind it. North Korea is the most commonly cited case: in February 2025, the FBI attributed the theft of about $1.5 billion in cryptocurrency from the Bybit exchange to North Korean actors, part of a pattern of state-directed theft used to raise revenue.

13 types of cyber warfare

Cyber warfare spans 13 main types of operation, from covert espionage to open attacks on infrastructure. Where a type has a well-documented case, it is named with its year so you can find it in the timeline below.

1. Cyber espionage

Cyber espionage uses digital tools to gain unauthorized access to sensitive information for political, military, or economic advantage, often carried out by a state-sponsored hacker. Nation-states, intelligence agencies, and organized groups use malware, phishing, social engineering, and advanced persistent threats (APTs) to keep long-term access and steal trade secrets, government secrets, or intellectual property. Because espionage is covert and leaves little visible damage, it is a significant threat to national security and corporate confidentiality.

2. Cyber sabotage

Cyber sabotage is the deliberate disruption or destruction of computer systems, networks, or digital infrastructure to cause harm or hinder operations. Attackers deploy malware that corrupts data, shut down industrial control systems, or disable networks with denial-of-service attacks, and the impact can extend to physical harm when energy, transportation, or healthcare systems are affected. Do not assume insurance covers it: war and state-backed attacks are a common exclusion in cyber insurance policies. Example: Stuxnet (2010).

3. Cyber influence operations

Cyber influence operations use digital platforms to manipulate public opinion, sway political outcomes, or advance an agenda through disinformation, propaganda, or covert online activity. State actors and political groups spread false or misleading information through social media, fake news sites, and bots, and run campaigns that exploit social divisions. The result is polarization and distrust that can undermine democratic processes and public trust in institutions.

4. Cyberattacks on critical infrastructure

Cyberattacks on critical infrastructure, such as power grids, water systems, or communication networks, can have far-reaching economic and societal consequences, because whole populations depend on these services. Examples: Viasat KA-SAT (2022), Volt Typhoon (2024), and FrostyGoop (2024).

5. Denial-of-service (DoS) attacks

Denial-of-service attacks flood websites or servers with traffic until they become inaccessible to legitimate users. They can take down online banking, communication networks, government services, and emergency response systems, and sometimes create a smokescreen for other attacks. Example: Estonia (2007).

6. Electrical power grid attacks

Power grid attacks infiltrate control systems to manipulate power flows, trigger blackouts, or damage physical equipment. The result can be widespread economic disruption and effects on military operations that depend on a functioning grid. Example: Ukraine power grid (2015).

7. Propaganda attacks

Propaganda attacks spread misinformation, fake news, or biased narratives through social media manipulation or by hacking news outlets. The aim is to erode trust in governments and institutions and to influence political outcomes in the attacker’s favor.

8. Economic disruption

Economic disruption targets financial institutions, stock markets, or critical economic infrastructure by stealing financial data, manipulating markets, or disrupting essential services. The result is financial loss, market instability, and a weaker economic position for the victim. Example: NotPetya (2017).

9. Surprise attacks

Surprise attacks are coordinated strikes across multiple fronts with minimal warning, designed to overwhelm defenses and maximize damage before the target can respond. They often coincide with conventional military action. Example: Viasat KA-SAT, disabled as Russia invaded Ukraine (2022).

10. Malware attacks

Malware attacks use malicious software, including viruses, worms, ransomware, spyware, and trojans, to disrupt, damage, or gain unauthorized access to systems. Malware typically spreads through phishing emails, infected downloads, and software vulnerabilities, and can steal data, monitor activity, encrypt files for ransom, or give attackers remote control of a system.

11. Ransomware

Ransomware attacks encrypt a victim’s files or lock them out of their systems until a ransom is paid, often in cryptocurrency, sometimes with a threat to leak stolen data. The impact includes financial loss, reputational damage, and operational downtime, which is why prevention, timely backups, and layered security controls matter. Example: WannaCry (2017).

12. Subversion

Subversion undermines a system, organization, or government from within by exploiting vulnerabilities or manipulating key people and processes. It relies on social engineering, disinformation, or trusted insiders who enable disruption, intentionally or not. Because the goal is long-term erosion of trust and decision-making rather than immediate damage, subversion is hard to detect.

13. Inside jobs

Inside jobs are attacks carried out by employees, contractors, or partners who use trusted access to steal data, sabotage operations, or help external attackers. Authorized access makes the activity hard to tell apart from normal work, so defense depends on access controls, monitoring, and insider threat detection.

Cyber warfare examples: a timeline

The best-documented cyber warfare examples run from the 2007 attacks on Estonia to the 2024 Volt Typhoon and FrostyGoop disclosures. Each attribution below names the government or agency that made it and when.

Alt text for graphic version: cyber warfare timeline from the 2007 Estonia attacks to Volt Typhoon and FrostyGoop in 2024, with type, impact, and attribution for each event.

What is a nation-state attack?

A nation-state attack, also known as a state-sponsored attack, refers to a cyber operation carried out by a government or its intelligence agencies against another nation, organization, or entity. These attacks involve significant resources and advanced tactics, and often have strategic or geopolitical motivations.

Nation-state attacks can target various sectors, including critical infrastructure, military systems, government agencies, businesses, and even individuals. Such attacks can involve espionage, data theft, disruption of services, or attempts to influence political or economic outcomes.

How are cyberwar attacks carried out?

Cyberwar attacks usually follow the stages of Lockheed Martin’s Cyber Kill Chain, a seven-stage model of how an intrusion progresses.

1. Reconnaissance

Attackers gather information about the target’s systems and networks through phishing, publicly available data, or automated scans for vulnerabilities.

2. Weaponization

Attackers develop or acquire malware tailored to the vulnerabilities they found, designed to steal data, disrupt operations, or provide remote access.

3. Delivery

The malware reaches the target through phishing attachments, compromised websites, drive-by downloads, or vulnerable software.

4. Exploitation

The attack triggers, either by tricking a user into running it or by exploiting a weakness in outdated software.

5. Installation

The malware installs itself and establishes persistence so the attacker keeps access after reboots or password changes.

6. Command and control (C2)

Attackers open communication channels with infected systems to maintain control, receive stolen data, or launch further attacks. C2 servers can sit anywhere in the world, which makes them hard to track down.

7. Actions on objectives

The attacker carries out the mission: stealing data, encrypting or wiping systems, disrupting physical processes, or holding access in reserve for later.

Living off the land

Nation-state actors increasingly skip weaponization and delivery altogether. Instead, they use tools already built into the operating system and stolen valid accounts, so their activity looks like normal administration. CISA reports that Volt Typhoon worked this way and kept access in some victim networks for at least five years.

The future of cyber warfare

Cyber warfare is moving to machine speed, as state actors put AI agents to work on the tasks human operators used to run by hand. Two factors will shape what comes next.

AI applications in cyber warfare

The clearest documented case so far is GTG-1002. In November 2025, Anthropic disclosed an espionage campaign by a group it assessed with high confidence to be Chinese state-sponsored, in which the attackers directed Claude Code to carry out an estimated 80 to 90 percent of tactical operations against about 30 outside targets. GTG-1002 was an attacker-directed AI system used against other organizations, not a victim’s own enterprise agent being hijacked, but it shows how quickly a state-backed operation can now move.

On the offensive side, AI can automate vulnerability discovery, generate polymorphic malware, and run large-scale misinformation campaigns with minimal human input. On the defensive side, AI and automation help teams deploy and manage controls at the same speed.

Emerging threats

Emerging threats increasingly target complex systems such as smart grids, satellite communications, and Internet of Medical Things (IoMT) devices, where a compromise could disrupt civilian life and national defense. States are also combining cyberattacks with conventional, psychological, and economic pressure, an approach often called hybrid warfare.

Solutions to cyber warfare: how organizations defend

You defend against cyber warfare by hardening the systems state actors exploit first, watching for misuse of valid accounts, and adding a detection signal that does not depend on spotting known patterns. CISA’s Volt Typhoon guidance gives a vendor-neutral starting point:

• Patch and harden internet-facing devices such as routers, VPNs, and firewalls first, since these are frequent entry points.
• Require phishing-resistant multi-factor authentication (MFA) for remote and privileged access.
• Review account and VPN logins for unusual times, locations, or privilege use.
• Segment operational technology (OT) from IT and monitor every connection between them.
• Store logs centrally and keep them long enough to investigate an intrusion that may have started years earlier.

Where deception fits

Living-off-the-land activity is visible to your existing tools, but because it uses legitimate binaries and valid credentials, its intent is hard to judge in isolation. Deception closes that gap preemptively. Decoy assets and honeytoken credentials are placed where no legitimate user or process ever needs to go, so any interaction raises a simple question: why did anything touch an asset no legitimate process should need? That question is a high-confidence signal of intent, not an inference from weaker evidence.

Against attackers working at machine speed, deception has to be automated: a handful of hand-built decoys cannot keep pace. The ShadowPlex Preemptive Cybersecurity Platform uses AI and automation to deploy and refresh decoys and honeytokens at scale, while the detection itself comes from the interaction. Its 360 Deception approach applies deception across identity, endpoint, network, cloud, and cyber-physical environments to help defenders detect, divert, and degrade attacker activity across the intrusion path:

• In the identity layer, deceptive credentials and accounts surface credential misuse through ShadowPlex Identity Protection.
• In critical infrastructure, agentless decoys that mimic OT assets and protocols surface reconnaissance in industrial networks through OT and ICS security.

Deception is additive. It runs alongside your SIEM, EDR, XDR, identity and access management (IAM), privileged access management (PAM), and MFA controls rather than replacing them. Acalvio has been named a Leader and Outperformer in the GigaOm Radar for Deception Technology for the fourth consecutive year. To see how it applies to nation-state tradecraft, see how 360 Deception works in a demo.