State-Backed Hackers Target Defence Workers, Google Warns

State-backed hackers are increasingly targeting defence companies and their employees, Google has warned in a new report released ahead of the Munich Security Conference, reported The Guardian.

According to Google's threat intelligence team, cyber-espionage campaigns are no longer limited to large defence firms. Hackers are now focusing on individual employees, job applicants and even smaller companies connected to industrial supply chains in Europe and the United States.

The report describes a "relentless barrage" of cyber-attacks, most of them linked to state-sponsored groups. Targets range from German aerospace companies to British car manufacturers, showing how widely these operations have spread.

Luke McNamara, an analyst at Google, told The Guardian that hackers are increasingly using personalised methods to target individuals directly, often through their personal devices.

"It's much harder to detect when an attack happens on a personal system, outside a company network," he said, adding that employees themselves have become a major focus.

Google also noted a rise in extortion attacks against smaller firms not directly involved in defence, such as car parts and ball bearing manufacturers.

Russian-linked hackers recently attempted to steal information by creating fake versions of websites belonging to hundreds of defence contractors across countries including the UK, the US, Germany, France, Ukraine, Turkey and South Korea.

Russia has also developed tools to hack Signal and Telegram accounts used by Ukrainian soldiers, journalists and officials. Google warned that these techniques could be copied by other attackers.

Ukraine has seen a sharp rise in such threats. Dr Ilona Khmeleva of Ukraine's Economic Security Council said cyber incidents increased by 37% between 2024 and 2025. Many attacks involved monitoring individuals for weeks before striking.

Elsewhere, North Korean hackers have posed as recruiters, using fake job offers and AI profiling to infiltrate defence firms. US authorities say North Koreans secured remote IT jobs at over 100 US companies to fund their government.

Iranian and Chinese-linked groups have used similar tactics, sending fake emails linked to schools, charities, elections and security events to trick defence employees into giving away login details.

Experts warn that as Western defence projects expand, cyber threats are becoming a global security concern.