Nation-State Hackers, Code Reuse, and Why It Matters

Security headlines often name a country behind an attack. For a business with a few hundred employees, that can feel remote. It isn’t. The tools and tricks that state-sponsored groups use tend to filter down to criminals who go after companies of every size.

What “state-sponsored” means

State-sponsored groups work for, or on behalf of, a government. Their goals vary: stealing intelligence or intellectual property, earning money for the state, or preparing to disrupt systems in a future crisis. Some groups pursue more than one of these at once.

A July 2024 joint advisory from CISA, the FBI and partner agencies describes a North Korean group that stole sensitive military and nuclear data and funded that work through ransomware attacks on U.S. healthcare organizations. In some cases, the group ran both kinds of operations against the same victim.

The FBI has also attributed the theft of about $1.5 billion in virtual assets in February 2025 to North Korea. Money is a motive for some state groups, not only secrets.

Why code reuse matters

Attackers are busy, and writing new malware is expensive. So they reuse code, tools and infrastructure from one campaign to the next. That habit leaves fingerprints. Researchers compare new malware against old samples, and shared code, build habits or servers can connect attacks that looked unrelated.

This is the basis of attribution, and it helps defenders in three practical ways:

• Faster detection. When defenders know a tool, they can write detections for it and for its close relatives.
• Better warnings. Linking an attack to a known group tells you how that group usually gets in, what it wants and what to look for next.
• Shared defense. Government advisories turn what one victim learned into steps every organization can take.

Attribution is not always certain, and groups can copy each other’s tools on purpose. Treat it as evidence that guides your defenses, not as a verdict.

What it means for a mid-sized business

You may never be the target of a government. But you can be on the path to one. CISA’s advisory on a China-linked group known as Volt Typhoon notes that some victims were smaller organizations with limited cybersecurity capabilities that provide services to larger ones. If you are a supplier, a contractor or a service provider, attackers may see you as a way in.

The methods in these advisories are rarely exotic. They include exploiting known vulnerabilities in internet-facing systems, phishing, stolen credentials and weak remote access.

What to do about it

The mitigations in CISA’s advisories are consistent, and they are within reach for most businesses:

• Patch internet-facing systems and appliances quickly.
• Require multi-factor authentication, especially for remote access and admin accounts.
• Separate admin accounts from everyday accounts and limit what each can reach.
• Segment your network so one compromised system cannot reach everything.
• Turn on logging and keep logs in one place where someone actually reviews them.
• Keep tested backups that an attacker cannot reach or delete.

CHR’s cybersecurity services and 24/7 monitoring put these basics in place and watch for the behavior these groups rely on. Want to know where you stand? Request a free external vulnerability scan.