Attackers are Bypassing “the network” by Targeting People - Defense Sector Employees

A notable cybersecurity development in early February 2026 is a Google Threat Intelligence Group (GTIG) report warning that state-sponsored threat actors are increasingly targeting defense and aerospace employees—and even the hiring process itself—to gain access and steal sensitive data. The key shift is tactical: instead of only attacking corporate networks, adversaries are aiming at individuals, personal accounts/devices, and HR workflows where enterprise visibility and controls are weaker.

What is the Defense Industrial Base (DIB)?

What is the Defense Industrial Base (DIB)? The Defense Industrial Base is the ecosystem of companies, suppliers, and service providers that research, design, manufacture, and sustain military and national-security capabilities. That includes prime contractors, niche subcontractors, software vendors, and logistics partners—creating a large “attack surface” where compromises can cascade through the supply chain.

Why is targeting employees and hiring processes important?

Why is targeting employees and hiring processes important? Because HR and recruiting are trust-heavy pathways into high-value organizations. Job offers, interview invitations, résumé reviews, and recruiter messages create legitimate reasons to open documents, click links, or share details—often from personal devices and personal email accounts that sit outside corporate monitoring.

GTIG describes a “personnel-centric” threat landscape: spoofed recruitment portals, recruiter impersonation, and job-themed social engineering designed to bypass perimeter defenses and EDR coverage by moving the initial compromise to places defenders see less.

How does employment-themed social engineering work?

How does employment-themed social engineering work? Attackers craft hiring-related lures—job postings, “take-home” assignments, résumé builders, interview scheduling links, or offer letters—to trick targets into entering credentials, approving MFA prompts, or running malicious content. The method works because it mimics normal hiring friction and urgency, and it often starts on unmanaged endpoints.

A practical takeaway: if your security program treats recruiting as “low risk,” adversaries will treat it as your soft underbelly.

Threat actors and techniques highlighted in the 2026 reporting

GTIG’s report groups activity into several big themes relevant to defense and aerospace:

• North Korean “IT worker” infiltration and job-lure operations aimed at access and revenue generation, including activity intersecting with defense-related hiring.

• Iranian recruitment-themed campaigns (spoofed portals, malicious hiring apps) that target aerospace/defense personnel and third-party relationships.

• China-nexus cyber espionage at scale, frequently emphasizing exploitation of edge devices to get initial access where endpoint controls are limited.

• A continued trend toward evasion of detection, including activity that avoids EDR by living “off-endpoint” (edge infrastructure, personal devices, and accounts).

How does edge-device exploitation work?

How does edge-device exploitation work? “Edge devices” (VPN appliances, firewalls, routers, secure gateways) often sit at the boundary of networks and may not support the same endpoint sensors as laptops and servers. Attackers exploit vulnerabilities to gain footholds that are harder to detect, then pivot to internal systems, identities, and data.

GTIG assesses that since 2020, China-linked espionage groups have exploited more than two dozen zero-days in edge devices across multiple vendors—precisely because it can reduce detection opportunities and improve compromise success rates.

What are the risks of this “human-layer + edge-layer” approach?

What are the risks of this approach? The biggest risk is that it dissolves the neat boundary between “inside” and “outside” the enterprise. Credential theft from a personal mailbox, a recruiter spoof, or an edge compromise can yield access that looks legitimate—enabling long dwell times, stealthy IP theft, and supply-chain pivoting into partners.

For defense-adjacent organizations, the impact can include:

• Intellectual property theft (designs, engineering data, R&D roadmaps)

• Operational disruption (especially if compromise reaches production or mission support)

• Counterintelligence risk (target lists, personnel details, program metadata)

• Supply-chain contagion (vendors and MSPs as stepping stones)

A defensive lens: treating recruiting and personal endpoints as “production”

The most important reframing from this story is organizational: recruiting workflows and individual accounts must be protected like critical business systems, not like marketing inboxes.

Here’s a simple way to map the new reality:

What are the best practices for protecting hiring workflows?

What are the best practices for protecting hiring workflows? Start by hardening identity and reducing trust in inbound hiring content: use phishing-resistant MFA (FIDO2/WebAuthn), isolate document viewing, strictly validate domains for recruiting portals, and ensure HR systems produce high-quality audit logs. Then add playbooks for recruiter impersonation and candidate-lure reporting.

Concrete controls that work well in practice:

• Phishing-resistant MFA for HR, recruiting, and executive assistants (where impersonation is common).

• Domain and brand protection: DMARC enforcement, lookalike-domain monitoring, and clear “official channels” guidance for candidates and staff.

• Isolated content handling: open résumés/portfolios in sandboxed viewers or remote browser isolation for high-risk roles.

• Recruiting portal governance: inventory all candidate-facing systems, eliminate “shadow” instances, and validate vendor security posture.

• Detection engineering: alerts on unusual OAuth grants, new mail-forwarding rules, suspicious inbox delegation, and anomalous login geos.

Using Zero Trust to shrink the blast radius

What is Zero Trust Architecture (ZTA)? Zero Trust Architecture is a security approach that shifts trust away from network location and toward continuous verification of users, devices, and access requests—using strong identity, device posture checks, and granular policy enforcement. It’s especially relevant when attacks begin on personal devices or via edge infrastructure.

Applied to this 2026 story, “Zero Trust” becomes practical when it:

• Requires device compliance (or at least risk scoring) before granting access to sensitive apps

• Uses conditional access to block risky authentications and suspicious sessions

• Enforces least privilege and just-in-time admin for tools that touch sensitive programs

• Segments critical environments so a single compromised identity can’t roam freely

Patch prioritization that matches real attacker behavior

Why is patch prioritization important? Because attackers don’t exploit every vulnerability— they exploit the ones that are reliable and widespread. Prioritizing patches based on evidence of exploitation reduces exposure faster than patching by CVSS alone, particularly for edge devices and internet-facing systems.

A widely used operational approach is to treat CISA’s Known Exploited Vulnerabilities (KEV) catalog as a “must-fix” feed for vulnerability management, especially for perimeter/edge systems.

Incident readiness for identity- and HR-centric intrusions

How does incident response work for identity-centric attacks? It focuses on speed: rapidly scoping account takeover, revoking tokens/sessions, resetting credentials, analyzing mailbox rules and OAuth grants, and ensuring compromised endpoints are isolated. Because these incidents can look “legitimate,” responders need strong identity telemetry and clear containment authority.

Key readiness moves:

• Centralize identity logs (IdP, email, endpoints, CASB/SASE) and retain them long enough to investigate slow-burn espionage.

• Pre-stage response actions: emergency access revocation, conditional access lockdown modes, and privileged account recovery steps.

• Run tabletop exercises that specifically simulate recruiter impersonation → personal email compromise → corporate SSO abuse.

What this story signals about the next 12–24 months

GTIG’s reporting underscores a durable trend: adversaries will keep shifting initial access toward places where modern enterprise controls are thinnest—personal devices, outsourced workflows, edge infrastructure, and “business glue” processes like hiring.

Expect defenders to respond by:

• Treating HR and recruiting as security-critical functions

• Expanding identity threat detection (ITDR) and phishing-resistant authentication

• Tightening third-party access and segmentation

• Accelerating KEV-driven exposure reduction for edge devices

A practical checklist you can apply this week

• Inventory all recruiting and candidate-facing systems; remove unknown instances.

• Enforce phishing-resistant MFA for HR/recruiting and executives.

• Add detections for mailbox rules, OAuth grants, and anomalous IdP sessions.

• Review internet-facing edge devices against KEV and patch/mitigate immediately.

• Publish a one-page “official hiring channels” policy to staff and recruiters; train on lookalike domains and impersonation patterns.

• Add a sandboxed workflow for opening candidate-submitted files and links for sensitive roles.

If you want, I can write a follow-up focused specifically on defending the hiring pipeline (controls, playbooks, logging requirements, and a sample detection rule map) for a typical enterprise stack (Microsoft 365/Entra, Google Workspace, Okta, or hybrid).