At recent Geneva summit press-conference, Biden noted:

I talked about the proposition that certain critical infrastructure should be off-limits to attack, period, by cyber or any other means," the president stated. "I gave them a list, and I don't have it in front of me, if I am not mistaken, of 16 entities — 16 defined as critical infrastructure, from the energy sector to our water systems."

Looks pretty clear and reasonable.

But is Russia the main source of cyberattacks in the world? Comparing to the US, for example, which cyber-forces looks very formiddable?

Is there any list/rating/score table?

  • 9
    Such a ranking would be difficult to make. First, a lot of cyberattacks will never be known to the public (especially the good ones). Of those which are known, there are often conflicting stories regarding who is responsible. And of those where it is clear who is responsible, just counting them might give you a misleading picture, as it doesn't tell you anything about the impact of those attacks. And if you would try to estimate the impact, on what criteria would you do that? – Philipp Jun 17 at 15:30
  • 1
    It's also quite difficult to define exactly where a cyberattack (that isn't actually a government operation) is coming from. Groups could easily be multi-national organizations, and move their "base of operations" from country to country in milliseconds. – jamesqf Jun 17 at 16:19
  • 1
    It's not unreasonable to ask such a question. Cyberattacks are a significant component of international news nowadays. Whether or not this is answerable is something else. And, keep in mind that the claimed sources of most cyber attacks might differ by targeted country. I.e. one can assume that attacks on Russian assets may be attributed to a different country than attacks on American assets. – Italian Philosophers 4 Monica Jun 18 at 1:42

As the comment suggests, different cyberattacks may have different impact, and the role of government may be different. The only thing we can do is make rough estimates based on publicly known information.

Is there any list/rating/score table?

Wikipedia has several pages on this matter:

But is Russia the main source of cyberattacks in the world?

Very few cyberattacks has been investigated to the point so it could be brought to the court.
Therefore, no country is yet confirmed to be "the main source of cyberattacks".

Only 5 of 14 major cyber attacks listed on Hacking in the 2020s, are associated with Russia. Note the different levels of the alleged role of the Russian government institutions.

  • 2020 European Medicines Agency cyberattack

    In March 2021 the Dutch newspaper De Volkskrant published an article saying "sources close to the investigation" has disclosed that a Russian intelligence agency and Chinese spies were behind the attacks.

  • 2020 United States federal government data breach

    In 2020, a major cyberattack suspected to have been committed by a group backed by the Russian government penetrated thousands of organizations globally including multiple parts of the United States federal government, leading to a series of data breaches.
    The cyberattack and data breach were reported to be among the worst cyber-espionage incidents ever suffered by the U.S., due to the sensitivity and high profile of the targets and the long duration (eight to nine months) in which the hackers had access.

  • Colonial Pipeline cyber attack

    Biden said on May 10 that though there was no evidence that the Russian government was responsible for the attack, there was evidence that the DarkSide group is in Russia, and that thus, Russian authorities "have some responsibility to deal with this". Independent cybersecurity researchers have also stated the hacking group is Russian as their malware avoids encrypting files in a system where the language is set to Russian.

  • Health Service Executive cyberattack

    The group responsible was identified as a criminal gang known as Wizard Spider, believed to be operating from Russia.

  • JBS S.A. cyberattack

    The White House announced that the cyberattack was likely conducted by a Russian organization, and news outlets reported that REvil was culpable.


There are different ways to unpack this question.

First, are we talking about state-intent cyberattacks, criminal-intent (stealing) cyberattack or a mixture of the 2?

Second, the very nature of cyberattacks gives them plausible deniability. Which also leads, by reverse, to plausible accreditation: "Russia did it, because we say so". So any list published by any government or government-affiliated organization is possibly tainted by intent to smear.

Third, a state may suffer cyberattacks and emit cyberattacks. Especially in the criminal intent sphere, there is huge value in leveraging cyberattacks' capabilities to work across the globe to attack somewhere outside of your own judicial sphere and rely on haphazard extradition procedures between unfriendly countries to limit your risks. Lauri Love, for example, shat in the wrong nest when he, as a UK citizen, hacked into US computers and barely avoided extradition.

So, yes, all, other things being equal, I would expect USA cyberattack incidents to emanate out of Russia/China. While Russian victims of cybercrimes might correctly suspect US or Ukrainian hackers. So the story changes depending on the viewpoint of the victim.

Fourth, while it is difficult to pinpoint attribution of one specific attack to a given country, let's look at specific cases:

Stuxnet. Iran's centrifuges being the target, both the US and Israel have long been suspected. It would be naive to therefore claim that the US never does any such things. Remains to be seen how often it does this kind of stuff, which is what this question is about. There is a rumor about a Siberian pipeline hack, I think.

Ukraine has, by pure coincidence, been the repeat target of pretty drastic cyberattacks, ever since its relations with Russia soured in 2014. NotPetya and power plants.

Most damningly, you have to look at the Estonian cyberwar of 2007 where, shortly after Russia felt "disrespected" massive denial of service attacks disabled much of government IT and services. Just like Stuxnet, you have to ask yourself: "if not Russia, who?".

So, it would seem that, at least in some instances, Russia was involved in some pretty high volume, high impact cyberattacks that happened to target nations it had very unfriendly relations with at the time. It is also suspected that Russia employs some of its many cybercriminals as free-lancers of sorts, easy to disown if something goes wrong, but useful the rest of the time. As both China and Russia deploy increasingly heavy tracing and censorship on their networks, it will become more difficult to be credible when claiming no knowledge of these activities however.

Russia has a long tradition in my industry (IT) of being associated with both criminal and governmental malware. Just like Nigeria has with phishing scams. Rather than trusting overmuch in one government's claim and some breathless news reporting, I tend to believe that the ongoing sentiments of so many professionals isn't likely to be fully wrong. For example, you can listen to Risky Business, a long-running security podcast for example. 2 guys out of New Zealand and Australia, who generally held a dim view of Trump and tend towards cynicism rather than nationalism.

On the other hand, sometimes Russia means "automatically guilty, without evidence needed", as when Kaspersky, a respected anti-virus firm, got banned from US government systems. Given the level of access anti-virus software has on everything, by necessity, that might still have the right call.

In a list of recent hacks, see how often Russia is attributed. If someone wants to point to an equivalent list credibly listing US intrusions, I'd be glad to hear of it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .