Why Nation-State Hackers Keep Going After American Universities

If you pay close enough attention to the news, you may recognize a pattern. Every few months there is an indictment, advisory, or threat report that describes a nation-state or nation-backed actor gaining access to American research universities. Each of these incidents is treated as ‘one-and-done,’ isolated occurrences. They aren’t. There’s a shared logic. It’s important not only to recognize these threats, but actually understand the methods to their madness.

Why universities specifically

It’s easy to dismiss the severity of these threats. After all, universities aren’t Industrial Control Systems, water treatment plants, nuclear control sites, or pipelines. So who cares if a professor’s email is hacked?

What if we were to flip this to reflect a different industry: defense contractors? Well, then we might view it as more of an issue. After all, defense contractors hold proprietary research on some of the most sensitive topics in national security. But don’t universities follow that same logic? More than 600 U.S. colleges and universities have active federal government contracts or research grants.^[1] One key difference between universities and their defense contractor counterparts is that their IT networks are built around openness rather than control. That shows up as decentralized departments, constant turnover, international collaboration, and security budgets that look like rounding errors compared to that of Lockheed’s. As one CISO put it after a recent Chinese intrusion into North American research facilities: institutions like this “often hold the same strategic information as defense contractors but typically operate with fewer security controls.”

High-value target, soft perimeter: it’s not difficult to see why this deserves more scrutiny. That gap isn’t just a talking point either. It plays out day to day. As Zachary Beese, InfoSec Manager at Iowa State University, put it: “Universities foster an environment of open collaboration, and IT policies must support this environment. Researchers collaborate outside the university as well, and different areas of research utilize a variety of tools, many bespoke and vulnerable. The budget concern is real, especially at many state universities where state funds are allocated to the security team and the more substantial research grant money goes to the PI and team.”

With that established, let’s dive into how each actor’s motives differ.

Iran: credential theft as a business model

The example of the Mabna Institute, a Tehran-based group, is one of the longest-running and most cited incidents. The Justice Department started indicting members back in 2018 and expanded their list again in August of 2026. Their model wasn’t sophisticated by any means. They operated by stealing credentials of professors and researchers, and using them to pull journal articles, dissertations, and research databases the universities paid to license. The operation hit 144 American universities and 178 foreign universities. They exfiltrated 31 terabytes of data. Some of this stolen information was then sold to customers directly in Iran.^[2][3]

Obviously, the scope of this operation was substantial, but that isn’t the point. The point of this example is the model used. It wasn’t a smash-and-grab, there wasn’t a ransom note, no outage, no publicity. It was just quiet, continuous access that ran for over a decade before its full scope became public.

China: patience over speed

In 2026, Google’s Threat Intelligence Group disclosed that a Chinese-linked group known as UNC6508 had spent over a year inside American research facilities. These institutions worked across cyber, AI, medicine, and defense. They ran undetected the entire time. The entry point was that of an externally-facing web application at a university. From there, they were able to move laterally, employing admin tools already present on the network as opposed to deploying their own malware. This technique contributed to them flying under the radar for so long.^[4]

This example fits China’s historic posture towards infiltration: quiet collection and long-term goals aligned with their strategic priorities instead of a dramatic one-time breach. In their eyes, a year of patient access beats a fast, noisy attack every time.

Russia: targeted, timed to events

In 2020, the United States, Canada, and United Kingdom jointly attributed an attempt to steal COVID-19 vaccine research to APT29, also known as Cozy Bear. This is the same Russian-backed hacker group linked to the 2016 DNC intrusion. Their target wasn’t universities in general, it was tailored to those that were contributing to health-research doing vaccine work, and timed specifically to when that research had strategic value. This pattern is uniformly followed by Russia: more surgical and specific timing linked to global events.^[5]

North Korea: research theft to fund a starved program

APT43, also referred to as Kimsuky and other names, has continually run phishing campaigns against the United States and allies for over a decade, specifically targeting think tanks, academic institutions, and researchers. Their methods lean heavily on social engineering, posing as journalists and academics sending invitations to conferences and other fictitious functions. In a 2026 FBI flash alert, it was also announced that they have embedded malicious QR codes in spear-phishing emails targeting foreign-policy researchers.^[6]

Their motive is quite simple. North Korea is an isolated nation with little access to the international research community. As such, they must steal research to feed their own state-backed programs, such as nuclear and pharmaceutical research.

The pattern underneath the pattern

Four different states, four different methods, one similarity. Universities are a cheap, low-cost target that provides the same value as a defense contractor or federal lab. None of the above campaigns relied on a zero-day. They depend on universities operating as intended: open, collaborative, decentralized. It also doesn’t hurt that a compromised account at a university rarely trips the same alarms a defense-industrial account would.

The tactical entry point is consistent too, regardless of which state is behind it. As Beese explained: “The largest threat I’ve seen across higher-ed is phishing attacks. Attackers try daily to achieve AitM session theft. It typically isn’t this first wave that causes the disruption, however. The next wave where this single account takeover is used to pivot to internal phishing generally bears the most fruit for the attacker. When targets see an internal email from someone with a well worded lure, the inherent trust of a colleague’s phishing email is a real force multiplier. Therefore it seems better detection and response is needed for these internally generated phishing emails.”

This analysis isn’t meant to be a call for universities to operate in the same environments and within the same constraints as defense contractors. That simply isn’t feasible. However, it is a reason for open discussion on the security practices within academia on this topic and treatment of this as an ongoing condition of doing research.