Network Telemetry Reveals Nation-State Pre-Positioning in the Defense Industrial Base
Summary
The article describes how nation-state actors prepare access to Defense Industrial Base networks, often targeting smaller contractors and edge infrastructure, and argues that network telemetry and shared intelligence can help identify activity before it escalates.
Key points
- The article frames reconnaissance and access development as long-term preparation that can precede disruptive activity.
- It says smaller Defense Industrial Base contractors may hold sensitive data and provide access while having fewer defensive resources than major contractors.
- It outlines differing approaches attributed to China, Russia, Iran, and North Korea, including living-off-the-land activity, router exploitation, tailored phishing, and insider access.
- Edge devices such as routers, firewalls, and VPN concentrators may have limited endpoint visibility and inconsistent patching, according to the article.
- Passive DNS, NetFlow, infrastructure mapping, and TLS fingerprinting can help surface suspicious network patterns, including activity on legitimate hosting services.
- The article advocates moving beyond endpoint-centric defense and sharing observations across the Defense Industrial Base to improve collective visibility.
Article Details
- Topic
- Network telemetry and infrastructure intelligence for detecting nation-state pre-positioning against the Defense Industrial Base
Threat Actors
GRU Unit 26165Described as exploiting vulnerable edge routers and using them as relay nodes.LazarusDescribed as running fake job campaigns and conducting operations involving personnel placed inside companies.Salt TyphoonDescribed as a group that compromised the US Army National Guard network and collected network diagrams and administrator credentials.UNC1549Described as targeting individuals in aerospace and defense organizations with fake job postings and malicious applications.Volt TyphoonDescribed as a China-linked group that maintains covert access and relies on living-off-the-land techniques.
Countries
ChinaChina operates with patience and persistence. Groups like Volt Typhoon and Salt Typhoon are not built for speed. They are built to remain hidden. Volt Typhoon relies heavily on living off the land techniques. That meansIranIran leans heavily into human targeting. Groups like UNC1549 go after individuals inside aerospace and defense organizations. They use fake job postings and malicious applications to lure targets in. Then they harvestNorth KoreaNorth Korea blends cyber operations with real world access. Lazarus is still running fake job campaigns, but they have gone further by placing actual personnel inside companies. In 2025, the DOJ indicted individualsRussiaRussia takes a more aggressive infrastructure-focused approach. GRU Unit 26165 has been exploiting vulnerable edge routers at scale. Instead of just gaining access to one network, they turn these devices into relayUnited KingdomUnited States
Industries
AerospaceIran leans heavily into human targeting. Groups like UNC1549 go after individuals inside aerospace and defense organizations. They use fake job postings and malicious applications to lure targets in. Then they harvestDefense industrial baseis the domain. Nation states are applying the same intelligence playbook in cyberspace, with the Defense Industrial Base as a primary target. What is being observed is not limited to intrusion activity, it is