Blurring Lines Between State-Sponsored and Cybercriminal Threat Actors in 2025

In 2025, the distinction between state-sponsored and cybercriminal threat actors continued to blur, complicating the attribution of cyber incidents. The exploitation of legitimate applications and services for malicious purposes remained a prevalent tactic, though no specific technical details, CVE IDs, or numerical data were provided. The report, published on May 13, 2026, originates from France’s national cybersecurity agency (CERT-FR) as part of its 2025 cyber threat overview. No explicit impacts or targeted sectors were detailed beyond the broader trend of evolving threat actor collaboration.