Identity Is the Weapon 

Kasey Cromer, Netlok | November 3, 2026 

Executive Summary 

The dominant pattern in nation-state cyberattacks documented in 2025 and 2026 is not the exploitation of unpatched software or the deployment of destructive malware. It is the exploitation of identity. Russian, Iranian, Chinese, and North Korean threat actors have repeatedly demonstrated a preference for the same objective: authenticated access using credentials, tokens, application permissions, or stolen human identities that belong to someone else. 

The implications for enterprise security leaders extend well beyond government and defense. The authentication techniques being refined against defense contractors, logistics networks, and critical infrastructure operators are the same techniques deployed against enterprise targets. What nation-state actors perfect in geopolitical conflict, criminal actors adopt at scale in commercial applications. 

Across the documented cases below, a single question recurs: if an attacker can authenticate as a legitimate user, what does your organization have in place to ensure that the person completing authentication is actually who they claim to be? 

The Credential Has Become the Primary Target 

In May 2025, the NSA, FBI, CISA, and intelligence partners from multiple allied nations published a joint advisory documenting a sustained campaign by a Russian military intelligence unit designated Glavnoye Razvedyvatelnoye Upravleniye (GRU) Unit 26165, commonly tracked in the security industry as APT28 or Fancy Bear, targeting Western logistics and technology organizations supporting assistance to Ukraine. [1] 

The campaign’s objectives were explicitly tied to the conflict. Attackers pursued accounts containing shipment manifests, cargo contents, transportation routes, and delivery schedules for aid moving into Ukraine. The access method was identity compromise at nearly every stage. 

Documented techniques included password spraying, a method that tests commonly used passwords across large numbers of accounts simultaneously, along with credential guessing and fake cloud-login pages designed to harvest valid credentials. Attackers used phishing infrastructure capable of relaying multi-factor authentication challenges, meaning that completing an MFA prompt did not stop the intrusion. They modified mailbox permissions to sustain ongoing email collection after initial access. They attempted to extract Active Directory databases, the systems organizations use to store and manage employee account credentials, giving attackers potential access to credentials for entire organizations. In at least one documented case, attackers conducted voice phishing while impersonating IT staff, attempting to obtain privileged account access through social engineering rather than technical exploitation. [1] 

The purpose is what makes this campaign significant for enterprise security leaders. The attackers were not after the network itself. They were after the information those accounts could access, and they obtained it by authenticating as the people who were authorized to see it. A password change or an MFA enrollment, without addressing session persistence and permission scope, would not have removed the access mechanism already in place. 

Agentic AI Has Entered the Authentication Attack Chain 

In October 2026, Microsoft Threat Intelligence published findings on Storm-0940, a China-state-aligned actor, documenting the use of an agentic AI framework called ARTEX to accelerate and scale credential-based intrusions. [2] 

The campaign began with a supply-chain compromise of ConnectWise, a cloud-based platform used by IT service providers to remotely manage client environments, meaning attackers gained access by targeting a trusted third-party vendor rather than the organizations directly. By obtaining control of ConnectWise application identities, attackers were able to authenticate into downstream Microsoft 365 environments without requiring an interactive user sign-in. The trusted application’s existing permissions became the entry point. Because those permissions were already authorized, no user was prompted to approve access. 

Microsoft observed ARTEX-driven attacks progressing from initial targeting to privileged cloud access in under three hours. Following access, attackers conducted reconnaissance of connected users, groups, and permissions within Microsoft 365, modified application credentials to preserve future access, and made changes to identity groups and privileged roles. Microsoft documented attempted sign-ins to more than 2,250 customer tenants following the supply-chain compromise. [2] 

The significance of this case is the combination of factors. An AI framework automated the credential abuse and reconnaissance at a speed and scale that manual operations cannot match. The entry point was not a human account but a non-human credential, meaning an automated application account rather than an individual employee’s login. Examples include a service account used by a monitoring tool or an API integration connecting two business systems. These accounts carry inherited permissions that most identity governance programs do not monitor as closely as employee accounts. 

This is the architecture of a modern identity attack: AI-accelerated, application-identity-enabled, and designed to persist. 

When Trusted Suppliers Become the Entry Point 

Google Threat Intelligence Group documented Iranian actor UNC1549 gaining initial access to defense and aerospace organizations through compromised third-party accounts and trusted supplier connections. [3] Rather than breaking through a perimeter, the actor entered through relationships that already had authorized access. Post-compromise activity included credential theft and remote-desktop session hijacking, moving from the initial entry point into other connected systems and environments. 

In a separate case, Russian-linked actor UNC5792 compromised Signal accounts used by Ukrainian military and government personnel by sending altered group invitation links that caused victims to link an attacker-controlled device to their accounts. The result was real-time visibility into communications without breaking the application’s encryption. The attack targeted the authentication layer, not the cryptographic layer. [3] 

Both cases illustrate a principle that applies equally to commercial enterprises: the perimeter defined by your own security controls ends at your own organization. Access granted to suppliers, contractors, and connected applications extends your identity perimeter into environments you do not govern. When those third-party identities are compromised, the resulting access carries the permissions you already authorized. 

The Identity Substitution Problem 

Among the cases documented in 2025 and 2026, the North Korean IT worker scheme represents the most difficult authentication problem for enterprise organizations to address through conventional controls. 

Google Threat Intelligence Group, summarizing 2025 government cases, describes a North Korean worker who used the credentials of a U.S.-based individual named Minh Phuong Ngoc Vong to perform remote development work under his identity for a company supporting a U.S. government defense program. The legitimate credential holder was convicted in 2025 for facilitating the scheme. In a separate case, North Korean IT workers stole sensitive data from a California defense contractor developing AI technology. [3] 

Google separately reported North Korean actors experimenting with AI-generated profile photographs and deepfakes to support identity fabrication during hiring processes. [3] 

These are not cases of credential theft in the traditional sense. A real person authenticated. The problem was that the person completing authentication was not the person the organization believed it had hired. No password policy, no MFA enrollment, and no session monitoring addresses the question of whether the individual presenting credentials is the individual to whom those credentials were issued. 

Photolok by Netlok: Authentication That Addresses the Identity Layer 

The cases documented above converge on a single control point: the moment of authentication. Whether the attack involves stolen credentials, compromised application tokens, session hijacking, or identity substitution, the attacker’s goal is to complete or bypass the authentication event in a way that grants access the target organization would not knowingly approve. 

Photolok by Netlok operates at that control point. 

Photo-based authentication. Photolok replaces password-based credentials with photo-based authentication in which each photo carries an encrypted code that changes with every login, is tied to the user’s registered device, and requires a server-side access code to validate. Even if an attacker obtains the photos, the encryption and device binding make them unusable for replay. The GRU campaign documented credential harvesting through fake cloud-login pages and MFA relay infrastructure designed to capture valid credentials in transit. The Storm-0940 campaign documented token replay used to authenticate into Microsoft 365 environments without triggering a new sign-in. Photo-based authentication addresses both attack paths: there is no static credential to harvest from a fake login page, and the encrypted code expires after each use, leaving a captured exchange with nothing reusable. [4] 

1 Time Photo. Users can configure up to five single-use photos for authentication. When at least one 1 Time Photo is set up, it always appears on the second login panel by itself, with no other login photo in the panel. The exception is a Duress scenario: if a Duress Photo has been configured, the photo panel will present two photos capable of completing login, not just one. If the user selects the Duress Photo to complete login, the 1 Time Photo is not used. It carries over and will appear again at the next login. Once used, that photo is no longer available and the encrypted codes tied to it have already expired, making it inherently resistant to the replay and session-persistence techniques documented in the GRU and Storm-0940 campaigns. [4] 

Duress Photo. The GRU advisory documented at least one case of voice phishing in which an attacker impersonated IT staff to pressure an employee into providing privileged access. Photolok’s Duress Photo addresses exactly this scenario. Users can configure up to two Duress Photos, which are randomly selected for display during login and signal that authentication is occurring under coercion. Selecting a Duress Photo completes the login while simultaneously triggering a real-time alert to security teams. The attacker sees a successful login. The security operations center sees a distress signal. [4] 

Photolok does not govern application permissions, audit supplier access, or monitor non-human identities. Those controls address different layers of the identity architecture. What Photolok addresses is the human login: the authentication event that precedes every enterprise session, and the event that nation-state actors have repeatedly demonstrated they can manipulate, relay, steal, or substitute when that event relies on credentials that can be harvested, replayed, or impersonated. 

The Bottom Line 

The documented nation-state campaigns of 2025 and 2026 make a single argument clearly: authentication is an active target. Russian military intelligence actors manipulated MFA flows and impersonated IT staff to obtain credentials tied to wartime logistics operations. A China-aligned actor used agentic AI to accelerate credential abuse at a scale and speed that manual operations can’t match. Iranian actors targeted U.S. defense and aerospace organizations through compromised supplier connections in a campaign assessed to support real-world military operations. North Korean actors substituted human identities to infiltrate a defense program from the inside. 

Each of these campaigns succeeded or nearly succeeded because the organizations targeted could not guarantee that the person or system completing authentication was authorized to do so. 

For enterprise security leaders, the question is the same one those organizations faced: when authentication completes, how confident are you that the identity behind it is legitimate? 

Request Your Personalized Demo 

Request a personalized Photolok demonstration from Netlok. Request Your Personalized Demo 

About the Author 

Kasey Cromer is Director of Customer Experience at Netlok. 

Sources 

[1] CISA, NSA, FBI, et al. Joint Cybersecurity Advisory AA25-141A: Russian GRU Targeting Western Logistics and Technology Organizations Supporting Ukraine. May 21, 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a 

[2] Microsoft Threat Intelligence. Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise Supply Chain Compromise. October 21, 2026. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ 

[3] Google Threat Intelligence Group. Beyond the Battlefield: Threats to the Defense Industrial Base. February 10, 2026. https://cloud.google.com/blog/topics/threat-intelligence/threats-to-defense-industrial-base 

[4] Netlok. How Photolok Works. https://netlok.com/