Five 'professional' hacker groups linked to foreign intelligence agencies, governments

KUALA LUMPUR: At least five of the world's leading "professional" hacker groups are linked to intelligence agencies or governments of certain countries.

Organised, structured and funded by influential individuals, these groups are among the most dangerous in the world.

The "Advanced Persistent Threat" groups quietly infiltrate networks, sometimes for years, to steal information, make a profit or cripple essential services.

Malaysia Cyber Consumers Association president Siraj Jalil said one of the groups was APT28, nicknamed Fancy Bear, which is linked to Unit 26165 of Russia's military intelligence.

Citing information from global cybersecurity firms, he said the group was first detected as active in 2004.

"In July 2018, the United States Department of Justice charged 12 Russian military intelligence officers over the 2016 hacking of the Democratic National Committee and the campaign of then presidential candidate Hillary Clinton.

"In October 2018, seven officers were charged over attacks on the World Anti-Doping Agency and the Organisation for the Prohibition of Chemical Weapons.

"The Netherlands expelled four Russian military intelligence officers in April 2018 after they attempted to breach the Organisation for the Prohibition of Chemical Weapons' network via a wireless Internet connection from a rental car," he said.

Siraj said that, in May 2025, US agencies and international partners issued a warning about the unit's campaign against logistics and technology firms involved in delivering aid to Ukraine.

"Apart from Fancy Bear, APT29, also known as Cozy Bear, is linked to Russia's Foreign Intelligence Service.

"The US government linked the SolarWinds supply chain attack, which was exposed in December 2020, to the group.

"The White House confirmed that nine federal agencies and about 100 private companies were breached," he said.

In January 2024, Microsoft detected an intrusion carried out through a password attack on a legacy test account that lacked multifactor authentication.

The intruders then accessed some of the company's source code and internal systems.

A North Korean hacker group has also made a name for itself globally under the alias Lazarus.

The group is linked to the Reconnaissance General Bureau of North Korea's armed forces.

In September 2018, the US charged a North Korean programmer as a member of the group over the 2014 attack on Sony Pictures.