Microsoft’s 2026 Digital Defense Report warns China, Iran, Russia and North Korea are conducting cyber operations that threaten American businesses, research institutions, government agencies and critical infrastructure. Alongside these state-backed campaigns, criminal networks and increasingly capable artificial intelligence are making attacks faster and harder to contain.
Generally covering July 2025 through June 2026, the report describes adversaries exploiting the trusted connections between accounts, software, suppliers and cloud services. A compromised contractor or stolen employee account can open access to institutions far beyond the original victim.
For Americans, the stakes include stolen research, exposed government information, disrupted businesses and threats to the services communities depend on.
America’s Adversaries Seek Lasting Access
Microsoft identifies a shared objective across the four principal state actors: securing access they can maintain and use repeatedly. Such access can support intelligence collection, revenue generation or preparations for disruption.
Chinese state-backed operators focus on long-term espionage. They increasingly exploit cloud systems and legitimate account permissions to conceal their presence. Microsoft links these operations to Beijing’s integration of political oversight, military capabilities and commercial industries into a party-led intelligence apparatus. The United States accounted for 27 percent of observed Chinese nation-state targeting in Microsoft’s notification data.
Iranian actors significantly increased targeting of the United States and American interests, including through operators that had not previously targeted America. Their campaigns increasingly integrate cyber, military and information activities. Microsoft also describes preparations inside targeted systems for long-term espionage and potential disruption, including destructive operations and attacks on industrial technology.
Russian state-backed operators are refining stealthier methods while maintaining their focus on government, research, defense and civil-society organizations. A December 2025 destructive attack against Poland’s energy sector demonstrated a willingness to strike critical infrastructure beyond Ukraine.
North Korean operatives pursue both intelligence and money. Remote IT workers exploit hiring practices to gain trusted access inside organizations, using AI to develop deceptive personas and support their operations. An employer can become a source of revenue and a foothold for a hostile regime.
AI Gives Attackers Greater Reach
Microsoft describes AI helping attackers find vulnerabilities, generate malicious software and coordinate parts of an intrusion. Early evidence of AI-orchestrated attacks shows the direction of travel, although observed volumes remain low.
AI assistants also introduce vulnerabilities of their own. Attackers can embed malicious instructions in content an assistant reads or poison its stored memory to influence later actions. Giving these systems access to sensitive information and authority to act raises the consequences of manipulation.
Defenders can use AI to detect suspicious behavior and respond faster. Organizations still need clear controls over what their automated systems can access and execute.
Criminal Networks Exploit Legitimate Systems
Cybercrime operates through a specialized marketplace of access brokers, credential thieves, malware suppliers and ransomware operators. These services let criminals assemble attacks without developing every capability themselves.
Stolen accounts and session credentials allow intruders to appear legitimate. Social engineering and ordinary administrative tools help them evade detection before stealing information, deploying ransomware or demanding payment.
Compromised downloads and software packages spread the danger through trusted suppliers. An organization’s security therefore depends partly on companies and developers outside its direct control.
Essential Services Need Stronger Defenses
Microsoft warns that attacks increasingly threaten the physical services supporting communities. Schools, local governments, utilities and research institutions cannot carry that burden alone.
Universities connect federally funded research, open collaboration and sprawling supplier networks, making them valuable targets and potential entry points into wider systems. Their exposure has consequences for taxpayers and national security.
Microsoft recommends stronger identity protection, faster security fixes, scrutiny of software dependencies, coordinated intelligence sharing and controlled use of AI defenses. It also urges preparation for post-quantum cryptography.
America’s adversaries are investing in persistent access to institutions that sustain its strength. Protecting those institutions requires sustained cooperation between government and industry, with leaders accountable for keeping essential systems secure and operational.