Melding of State and Criminal Threat Actor Motivation: The Nebulous Normal Whitepaper

Health-ISAC and CI-ISAC Australia joint white paper
As the fusion of espionage, hacktivism, and financially motivated crimes continues to meld together, there are a number of reasons for this trajectory, and many are dependent on the society in which the cybercrime originates.
Key Judgements
- Nation-state threat actors have been observed empowering local cybercriminal outfits to
further geopolitical objectives. - A shadow industry of offensive cyber tooling research and development companies has
emerged, widening the R&D capabilities for state-sponsored cyber espionage groups. - Relationships between intelligence agencies and ransomware actors may be present,
increasing the sophistication of financially driven cybercrime gangs. - Criminal elements offer plausible deniability to state-sponsored groups and may be used as
proxies to launch nation-state attacks. - Forward-facing intelligence consumption is essential to the success of organizations trying to
navigate the opaque threat landscape.
- Related Resources & News
- Health Care and Social Assistance Threat Landscape Report
- Agentic AI in Healthcare Is a Risky Proposition
- Live@eXchange Day 2 – Health-ISAC Medical Device Security Analyst
- Health-ISAC Hacking Healthcare 6-3-2026
- New Vulnerabilities Aimed at Healthcare Industry
- Monthly Newsletter – June 2026
- What it really takes to Secure Healthcare
- Device Inventory and PHI Mapping Will Be the Heaviest Lifts When New HIPAA Drops
- Verizon DBIR: Healthcare Fends Off Increased Social Engineering Attacks
- State of Human Cyber Risk Report