The State Actors
๐ Part F of the Kill Chain Economy series โ TI-2026-035
There is a thought experiment that every cybersecurity analyst should try exactly once. Look at a honeypot log. Pick an IP address. Trace it to its hosting provider. Ask yourself: is this a criminal, or a government?
You cannot answer. Not because you lack information. Because the answer does not exist at the network layer. The same commercial VPS, the same VPN exit, the same bulletproof hosting provider serves both โ simultaneously, through the same IP blocks, using the same protocols, targeting the same attack surfaces.
This investigation documents what happens when you stop asking "who is the attacker?" and start asking "who built the infrastructure they both use?" The answer is the same five intelligence agencies whose tools we documented in 035C. The foxes designed the henhouse. Then they moved in with the wolves.
The Five Agencies and Their Shared Landlord
๐๏ธ State Offensive Cyber Units Operating on Commercial Infrastructure
| Agency | Country | Known Units | Infrastructure Used | Documented By |
|---|---|---|---|---|
| NSA / TAO | ๐บ๐ธ USA | Tailored Access Operations | Commercial data centers, compromised routers, cooperative ISPs | Snowden documents (2013) |
| GRU | ๐ท๐บ Russia | Unit 74455 (Sandworm), Unit 26165 (Fancy Bear) | Commercial VPNs, bulletproof hosting, compromised infrastructure | DOJ indictments (2018, 2020) |
| PLA / SSF | ๐จ๐ณ China | Raspberry/Flax/Charcoal Typhoon | Commercial cloud (Aceville/Tencent), SOHO routers | Microsoft East Asia report (Sept 2023); honeypot data |
| GCHQ | ๐ฌ๐ง UK | TEMPORA, KARMA POLICE | Fiber optic taps at ISP level, cooperative telecoms | Snowden documents (2013) |
| Unit 8200/81 | ๐ฎ๐ฑ Israel | NSO, Candiru, Paragon alumni | Commercial vendor products deployed via client infrastructure | Google TAG (2024), TI-2026-034 |
Source: [OSINT-LIB] Snowden archive, DOJ indictments (GRU Units 74455/26165), Microsoft Digital Defense Report 2023, Google TAG Buying Spying 2024. [XREF] TI-2026-034 (Israel series), 031 (Aceville/Tencent).
Five intelligence agencies. Five different countries. Five different political systems. One shared characteristic: they all operate on commercial infrastructure.
NSA TAO doesn't build its own data centers for offensive operations. It uses commercial data centers and compromised routers โ the same routers that host websites, the same data centers that host VPS providers, the same infrastructure our honeypot monitors.
GRU Sandworm doesn't operate on Russian military networks for attacks against Ukraine. It uses commercial VPNs and bulletproof hosting โ the same VPNs (M247, documented in 9 investigations) and the same hosting providers (1337 Services, documented in 8 investigations) that serve cybercriminals.
Chinese state actors โ Microsoft names them Raspberry Typhoon, Flax Typhoon, Charcoal Typhoon โ target the same ministries and infrastructure โ and the commercial cloud our honeypot ties to Chinese state-adjacent operators is indistinguishable from criminal operators in our data. That cloud infrastructure includes Aceville/Tencent, which we documented in TI-2026-031 with 154 honeypot IPs at 86% abuse rate.
The intelligence agencies are not infiltrating commercial infrastructure. They are native to it. The commercial infrastructure was built to serve everyone. Intelligence agencies are part of everyone.
The Indistinguishability Proof
๐ฌ What Microsoft Actually Documented
"The primary Chinese threat groups in the region are Raspberry Typhoon and Flax Typhoon. Raspberry Typhoon targets Association of Southeast Asian Nations government ministries, military entities, and corporate entities associated with critical infrastructure, particularly telecommunications."
โ Microsoft Digital Defense Report 2023. Microsoft's East Asia threat report (Sept 2023) adds Charcoal Typhoon and describes Flax Typhoon entering targets through a custom VPN appliance.
Correction (2026-09-26): an earlier version of this box quoted Microsoft as saying these actors "operate from commercial cloud infrastructure indistinguishable from criminal operators." Neither Microsoft report contains that sentence. The indistinguishability finding below is this dossier's own, from honeypot correlation โ not Microsoft's.
Read that again. Microsoft โ the company that operates Azure, the second-largest cloud platform on earth โ documents Chinese state actors going after ministries and critical infrastructure โ and our honeypot shows the commercial cloud they are associated with cannot be distinguished from criminal hosting by traffic alone.
This is not an intelligence failure. This is a structural reality. The network does not encode intent. A TCP packet from a PLA operator and a TCP packet from a ransomware affiliate look identical. The IP address belongs to the hosting provider, not the customer. The hosting provider sees a paying customer with valid credentials. The target sees an SSH probe from a commercial IP. The honeypot records the same log entry regardless of who typed the command.
๐ What indistinguishability means in practice
Q: If state and criminal traffic cannot be told apart on commercial cloud, who can?
A: Nobody. At the network layer, the distinction does not exist. Attribution requires: post-compromise forensics (finding state-specific tooling), intelligence agency analysis (comparing to known state TTPs), or the attacker making a mistake (operational security failure). None of these happen at the initial access phase โ the phase our honeypot monitors. At the SSH probe level, state and criminal are the same thing.
Q: Does this mean attribution is impossible?
A: Attribution is possible after a successful attack, with months of forensic work and intelligence community analysis. It is impossible during the attack. And it is impossible at the scanning phase. Our honeypot captures the scanning phase. We can identify the infrastructure (M247, 1337 Services, Aceville) but not the operator's employer. The infrastructure serves both employers simultaneously.
Q: Then what does the honeypot actually tell us about state actors?
A: Two things. First: state actors use the same infrastructure we document โ confirmed by DOJ indictments and by the Snowden archive; Microsoft's threat reporting documents the same actors' targeting (corrected 2026-09-26). Second: the absence of visible state-actor signatures in our data is itself evidence of operational security. Israel (TI-2026-034): 7 IPs, 0 honeypot hits. Zero. From the world's largest exporter of offensive cyber tools. They are not absent from the internet. They are absent from our honeypot because they are good at what they do. The most capable state actors are invisible.
The Israeli Zero: A Statistical Anomaly Worth Reading Twice
๐ Israel in the Honeypot: The Dog That Didn't Bark
| Metric | Value | Context |
|---|---|---|
| Total IPs from Israel | 7 | vs. 80 from US, 64 from NL, 154 from SG (Aceville) |
| Honeypot hits from Israel | 0 | Zero. Not low. Zero. |
| Unit 8200 alumni companies | 5+ (NSO, Candiru, Paragon, Kape, Intellexa adj.) | World's largest concentration of offensive cyber talent |
| VPN providers owned by 8200 alumni | 3 of top 5 (Kape: ExpressVPN, CyberGhost, PIA) | 56M+ users routing traffic through 8200-alumni infrastructure |
| Countries using Israeli surveillance tools | 45+ | Documented Pegasus deployments |
Source: [HONEYPOT] threat_intel IP analysis. [XREF] TI-2026-034 (Israel series), 034C (Privacy Empire). Note: 7 IPs present in enrichment data; 0 hits means zero observed SSH probes.
Seven IPs. Zero hits. From a nation that:
- Exports offensive cyber tools to 45+ countries
- Operates Unit 8200 (one of the world's largest SIGINT agencies)
- Has alumni who own 3 of the top 5 VPN providers (56M+ users)
- Has alumni who founded NSO (Pegasus), Candiru (DevilsTongue), Paragon (Graphite)
- Used Pegasus sales as diplomatic currency for the Abraham Accords
Sherlock Holmes solved the case of the Silver Blaze because the dog didn't bark. The dog didn't bark because the intruder was someone the dog knew.
Israel's zero hits does not mean Israel is not present on the internet. It means Israeli operators do not make the kinds of mistakes that leave traces in a Cowrie honeypot. They are not using root/admin123. They are using zero-click exploits (Pegasus), supply chain compromises (SolarWinds pattern), and ISP-level interception (FinFly ISP, documented in 035C). They operate above the SSH layer. Our honeypot measures the floor. They work on the ceiling.
๐ What the zero means
Q: Is 7 IPs / 0 hits statistically significant?
A: The baseline: US has 80 IPs with thousands of hits. NL has 64 with thousands. China (via Aceville) has 154 with 86% abuse rates. Even countries with minimal tech industries show non-zero hit rates from compromised devices. Israel has 7 IPs and not a single hit. For a country with the world's highest per-capita concentration of offensive cyber capability, this is the statistical equivalent of a professional athlete failing a breathalyzer โ not because they don't drink, but because they know exactly how to beat the test.
Q: Could the Israeli IPs be VPN exit nodes or legitimate infrastructure?
A: They could. But if so, the same question applies: why do VPN exit nodes in every other country show non-zero abuse rates, but Israeli VPN exit nodes show zero? Either Israel has uniquely clean VPN users (improbable given Kape/Crossrider's adware history), or Israeli VPN infrastructure is managed with operational security that prevents honeypot detection. Both explanations confirm the thesis: Israeli cyber operations are more sophisticated than what a honeypot can see.
Q: What does this mean for the surveillance vendor findings in 035C?
A: It means the surveillance vendor market (Unit 8200 โ NSO/Candiru/Paragon) is supported by a state that knows how to be invisible. They build the tools but they don't leave fingerprints. The tools are visible (Pegasus, FinFisher, Vault 7 leaks). The operators are not. This is the difference between selling weapons and fighting wars. Israel sells weapons. The buyers fight wars. The weapon manufacturer's fingerprints are on the gun โ but not at the crime scene.
GRU: When the State Actor Gets Indicted
โ๏ธ DOJ vs GRU: Named, Charged, Still Operating
| Indictment | Unit | Officers Named | Operations | Damage |
|---|---|---|---|---|
| Jul 2018 | Unit 26165 (Fancy Bear) | 12 GRU officers | DNC hack, DCCC, Clinton campaign | US election interference |
| Oct 2020 | Unit 74455 (Sandworm) | 6 GRU officers | NotPetya, Olympic Destroyer, French elections, Ukrainian power grid | $10B+ (NotPetya alone) |
| Infrastructure used | Commercial VPNs, leased servers, compromised infrastructure, cryptocurrency payments โ the same infrastructure types documented in our corpus | |||
Source: [OSINT-LIB] DOJ indictments: Western District of Pennsylvania (2018, 2020). Named officers include Yuriy Sergeyevich Andrienko, Sergey Vladimirovich Detistov, Pavel Valeryevich Frolov, and others.
The DOJ named them. Published their photos. Detailed their operations. Described the infrastructure they used: commercial VPNs, leased servers, compromised routers, cryptocurrency for payments.
Read that infrastructure list. Commercial VPNs โ M247 provides NordVPN infrastructure, documented in 9 investigations. Leased servers โ 1337 Services provides bulletproof hosting, documented in 8 investigations. Compromised infrastructure โ our honeypot captures the compromising in real-time. Cryptocurrency โ 035E just documented the financial rails.
GRU Unit 74455 used the same infrastructure our honeypot monitors. The same VPNs. The same hosting types. The same cryptocurrency rails. NotPetya โ $10 billion in damage, the most destructive cyberattack in history โ was launched from infrastructure indistinguishable from a ransomware operation.
And that's the point. It was designed to be indistinguishable. NotPetya was disguised as ransomware. It demanded payment. But it was a wiper โ it destroyed data regardless of payment. The disguise was the criminal infrastructure itself. GRU used the appearance of criminal ransomware to mask a state attack against Ukraine that spiraled globally.
๐ What the GRU indictments reveal about infrastructure
Q: If GRU officers use commercial VPNs and bulletproof hosting, does that mean intelligence agencies are funding these providers?
A: Not necessarily funding โ but certainly sustaining. GRU officers are customers. They pay for VPN subscriptions, VPS hosting, domain registrations. Their money is as good as anyone's. The providers don't know (or don't ask) whether the customer is GRU or a teenager. But the cumulative effect is: intelligence agencies from multiple countries are paying customers of the same infrastructure providers. The providers' revenue includes state money. Shutting down the provider would disrupt intelligence operations โ not just the target country's operations, but potentially your own.
Q: Does NotPetya prove that state actors and criminals are indistinguishable?
A: NotPetya was literally designed to be mistaken for criminal ransomware. The GRU deliberately chose a criminal disguise for a military operation. This is not convergence โ it is intentional mimicry. The state actor adopted the criminal's appearance, the criminal's infrastructure, and the criminal's financial model (ransom demand) as cover for a destructive military attack. If a military intelligence unit deliberately uses criminal infrastructure and criminal tradecraft, then the infrastructure-level distinction between state and criminal has been deliberately erased โ by the state.
Q: Were the indicted GRU officers ever arrested?
A: No. They are in Russia. Russia does not extradite to the US. The indictment is a legal document, not an enforcement action. It serves the same function as an OFAC sanction: documentation without disruption. The indicted officers are presumably still serving. The infrastructure they used is still available. The techniques they employed are documented in the indictment โ publicly, for anyone to read and replicate.
Volt Typhoon: Pre-Positioning Is Already Complete
โก The Most Alarming Finding Nobody Panicked About
"Volt Typhoon has pre-positioned itself on US critical infrastructure networks โ water treatment, energy grid, transportation systems โ for potential disruption during a future conflict."
โ Joint advisory: CISA + NSA + FBI + Five Eyes partners, February 2024
- Technique: Living-off-the-land (no malware โ uses legitimate tools already present)
- Access method: Compromised SOHO routers โ legitimate credentials โ lateral movement
- Duration: Active since "at least 2021" โ three years of pre-positioning before public disclosure
- Purpose: Not espionage. Disruption. "Positioned to disrupt US critical infrastructure in the event of a major crisis or conflict with the United States."
Source: [OSINT-LIB] CISA Advisory AA24-038A (Feb 2024), joint with NSA, FBI, and Five Eyes intelligence agencies.
Stop. Read the quote again. A Chinese state actor has already pre-positioned inside US critical infrastructure โ water, energy, transportation. Not "could potentially" โ has already. Not for espionage โ for disruption. Not recently โ since at least 2021.
The access method: compromised SOHO routers and legitimate credentials. The same SOHO routers our honeypot sees being brute-forced daily. The same credential-stuffing our Go scanner campaign harvests. Volt Typhoon didn't need zero-day exploits. It needed the same credentials that sell for $50-500 on IAB markets (035A, 035E). The entry point to US critical infrastructure disruption is the same SSH probe our honeypot captures.
And if China has done this โ with confirmed pre-positioning announced by five intelligence agencies simultaneously โ then:
โข๏ธ Mutual Assured Digital Disruption
If Volt Typhoon is pre-positioned in US critical infrastructure (confirmed by CISA/NSA/FBI), then:
- The US (via TAO) is almost certainly pre-positioned in Chinese critical infrastructure. The US has demonstrated the capability (Stuxnet, 2010 โ pre-positioned in Iranian uranium centrifuges).
- Russia (via Sandworm) has demonstrated critical infrastructure attack capability (Ukrainian power grid 2015, 2016). Pre-positioning in US/EU infrastructure is the logical extension.
- The UK (via GCHQ) has ISP-level fiber tapping (TEMPORA). Pre-positioning is a different operation but uses the same access.
- Israel has the most sophisticated offensive cyber market on earth. Pre-positioning would be invisible (see: the zero).
The implication: Every major state has pre-positioned in every other major state's critical infrastructure. This is MAD โ Mutual Assured Disruption โ for the digital age. And it runs on the same commercial infrastructure that serves cybercriminals.
This is why nobody shuts down the bulletproof hosting providers. If you shut down the infrastructure that serves cybercriminals, you shut down the infrastructure that serves your own intelligence agency's pre-positioned operations in your adversary's critical infrastructure. The bulletproof hosting ecosystem is not just enabling crime โ it is enabling strategic deterrence. The hosting provider is not a bug. It is a feature of the nuclear posture, translated to the digital domain.
๐ The deterrence question
Q: Is this actually MAD, or is it different?
A: Nuclear MAD has formal doctrine, declared arsenals, and hotlines. Digital MAD has none of these. Pre-positioned cyber capabilities are classified. No state admits to pre-positioning in another's infrastructure. There is no arms control treaty for cyber weapons. There is no hotline. The deterrence is informal, undeclared, and based on assumed mutual capability rather than confirmed mutual capability. This makes it more dangerous than nuclear MAD โ because miscalculation is more likely when neither side knows exactly what the other has pre-positioned.
Q: Why did five intelligence agencies simultaneously announce Volt Typhoon?
A: Two hypotheses: (A) Genuine warning โ "we found this, please patch your routers." (B) Signaling โ "we know you're there, and now the public knows, so the cost of activation just increased." Option B is deterrence theory: by publicizing the pre-positioning, you increase the political cost of activating it. This is the cyber equivalent of a nuclear test โ demonstrating capability to prevent use. Either way, the announcement confirms that pre-positioning is happening, and that intelligence agencies consider it a strategic-level threat.
Q: What does this mean for the SSH probes in our honeypot?
A: Some percentage of the SSH probes our honeypot captures are not criminal credential harvesting โ they are state pre-positioning operations. We cannot distinguish them. The Go scanner harvesting credentials for IAB markets uses the same technique as Volt Typhoon's initial access method (compromised credentials, legitimate tools). The honeypot measures the scanning. It cannot measure the intent. The water treatment plant down the road is being scanned by the same campaigns โ and for some of those campaigns, the goal is not ransom. It is pre-positioned destruction, waiting for a political trigger.
The Five Eyes Landlord Problem
NSA TAO operates from commercial data centers. GCHQ taps fiber optic cables at ISP level. The Five Eyes nations (US, UK, Canada, Australia, New Zealand) host 60%+ of global internet infrastructure.
Our corpus confirms: the US hosts 80 infrastructure entries across 28 investigations โ more than any other country. The US is not just a victim of cybercrime infrastructure. The US is the cybercrime infrastructure โ because the US is the internet's largest landlord, and the landlord rents to everyone.
๐๏ธ When the Landlord Is Also the Surveillance Agency
| Role | Entity | Infrastructure Access |
|---|---|---|
| Landlord | US hosting providers (ColoCrossing, DigitalOcean, etc.) | Physical access to servers, network taps possible |
| Tenant (criminal) | Ransomware operators, botnets, IABs | VPS access, data in transit |
| Tenant (state) | GRU, PLA, intelligence operations | Same VPS access, same data in transit |
| Surveillance | NSA TAO, FBI, GCHQ (via Five Eyes) | FISA orders, National Security Letters, fiber taps |
Source: [OSINT-LIB] Snowden archive (PRISM, UPSTREAM, TEMPORA), FISA court orders (published subset), NSL reporting (EFF analysis). [XREF] TI-2026-032 (American Mirror).
The US intelligence community has legal authority (FISA, National Security Letters) to access data on US-based servers. US hosting providers โ including the ones in our corpus with high abuse rates โ are subject to US surveillance law. The criminal and state-actor tenants on those servers are under the landlord's surveillance โ whether they know it or not.
This creates a perverse incentive: the intelligence community benefits from the existence of bulletproof hosting on US soil. If ColoCrossing in Buffalo hosts ransomware operators and GRU officers and PLA pre-positioning operations on the same servers, the NSA can monitor all of them with a single FISA order. Shutting down ColoCrossing would scatter these targets across foreign infrastructure beyond NSA's reach.
The 96% abuse report failure rate suddenly makes more sense. It's not just resource constraints. It's not just legal complexity. It is, at least partially, intelligence utility. The bulletproof hosting provider is a honey pot โ not ours, but the NSA's. They tolerate the abuse because the abuse attracts targets they want to monitor.
โ๏ธ The State Actors โ Verdict
State actors are not a category separate from cybercriminals. They are the same category, operating on the same infrastructure, using the same tools, through the same jurisdictions:
- Indistinguishable โ Chinese state-adjacent commercial cloud cannot be distinguished from criminal hosting in our honeypot data, and our honeypot finds the same for all state actors
- Invisible (Israel) โ 7 IPs, 0 hits. The world's largest offensive cyber exporter leaves no trace at the SSH layer. They work above the ceiling our honeypot monitors
- Indicted but operational (Russia) โ 18 named GRU officers, $10B+ damage, still operating. Indictments are documentation, not enforcement
- Pre-positioned (China) โ Already inside US critical infrastructure. Same entry method as our honeypot captures. Same credentials that sell for $50 on IAB markets
- Structurally protected (Five Eyes) โ Intelligence agencies benefit from bulletproof hosting on their soil because it concentrates targets. The 96% failure rate is not just neglect โ it is intelligence utility
The infrastructure question is no longer "who is attacking?" It is: "who built the infrastructure, who profits from it, and who would lose capability if it were shut down?"
The answer to all three is the same: everyone who matters. The criminals. The intelligence agencies. The hosting providers. The surveillance vendors. The VPN companies. The formation agents. Everyone except the victims.
The foxes designed the henhouse. The wolves moved in. The farmer profits from both. And the chickens have no vote at the board meeting.
Cross-Investigation Map
| State Actor Layer | Evidence Source | Cross-References |
|---|---|---|
| Commercial Infrastructure Use | Snowden, Microsoft, DOJ | 023 (M247/VPN), 030 (1337/Tor), 031 (Aceville/Tencent) |
| Israeli Zero | Honeypot statistical analysis | 034 series (Israel), 035C (Unit 8200 factory) |
| GRU Indictments | DOJ WDPA 2018, 2020 | 035A (same TTPs), 035E (same financial rails) |
| Volt Typhoon | CISA AA24-038A (joint Five Eyes) | 035A (credential harvesting), 035E (reinvestment cycle) |
| Five Eyes Landlord | Snowden (PRISM, UPSTREAM, TEMPORA) | 032 (American Mirror), 026O (96% failure as feature) |
Methodology
- [OSINT-LIB] โ State Cyber Operations (86 chunks), Intelligence & Declassified (479 chunks). Microsoft Digital Defense Report 2023, UN GGE ICT Cyber Norms 2021, CISA Joint Advisory AA24-038A
- [HONEYPOT] โ IP attribution and statistical analysis (Israel: 7 IPs / 0 hits anomaly)
- [LEGAL] โ DOJ indictments: GRU Unit 74455 (WDPA Oct 2020), Unit 26165 (WDPA Jul 2018)
- [XREF] โ TI-2026-031 (Aceville), 034 (Israel), 035A-E (prior series letters)