The actor is not the unit¶

Every account begins with a name. Lazarus, the North Korean exchange thieves; Evil Corp, a Russian ransomware enterprise; i-Soon, a Chinese contractor; Unit 8200, Israel’s signals-intelligence unit; Tailored Access Operations, the NSA’s; Sandworm, the GRU’s. Reporting needs names because indictments, sanctions notices and vendor telemetry produce names.

But the name becomes less useful as the state is read more closely. What explains the behaviour is increasingly an apparatus, a market, a network, an infrastructure, and finally a war in which cyber is no longer a separate thing to point at. Across the eleven states, the unit of explanation moves from actor to apparatus, market, network and infrastructure.

The bureau¶

North Korea comes closest to the object that conventional reporting assumes: a bureau, subordinate groups, tasks assigned from above, revenue delivered upward. Even here, the named actor is not the unit that explains the behaviour.

Lazarus is a label attached to a treasury requirement. The requirement is foreign currency for a state that sanctions have cut off from ordinary finance. The instrument changes with the opportunity: bank fraud, exchange theft, remote workers using false identities, then arms. The groups are real, but interchangeable. What persists is the requirement that selects them.

A group name explains who carried out an operation. It does not explain why that operation existed.

Russia is where the distinction becomes harder to maintain. The organisation chart puts state units in one column and criminal syndicates in another. The people do not always stay there. A ransomware enterprise can retain its commercial business while enjoying protection from the state, become useful to an intelligence service, and move between those positions without acquiring a new identity.

Internal material from one such enterprise shows the two logics operating together: a criminal company concerned with customers and money, alongside an intelligence interest in what it collected. There is no clean handover between the two. Evil Corp is a name for an organisation. The behaviour belongs to the relationship between the organisation and the state around it.

The apparatus¶

The United States makes the apparatus visible. The named units are real, but they are not the thing that explains the posture.

A dual-hatted command, an intelligence establishment built for continuous collection, teams invited onto allied networks to hunt for an adversary already inside, private companies seeing the adversary at scale before government does, and a doctrine that treats persistent access as routine: these are not properties of one actor. They are a standing arrangement across institutions.

The useful unit is the cycle. Collection produces access. Access produces intelligence. Intelligence produces another operation. The operation changes what the adversary knows and does, which produces the next requirement for collection. American cyber power is therefore less an inventory of operations than a posture that keeps operating.

Iran sits between the actor and the apparatus. Its repertoire is produced by state operators, tasked crews, contractor fronts and hacktivist personas, while the relationships between them are deliberately obscured. The operation can be attributed to a front, inflated by a false persona, or left ambiguous.

The actor label is sometimes part of the operation itself. Naming the actor too confidently can mean accepting the answer the operation was designed to prevent.

The market¶

China moves the unit again. The contractor becomes visible, and the contractor reveals a market.

Leaked company records show intrusions priced by target, staff moving between jobs, supervisors treating an intrusion against the wrong university as a clerical error, and disputes over unpaid invoices with groups that have their own advanced persistent threat designations. The supposed persistent threat is a vendor. The state is a customer with a published requirement.

The capability therefore does not sit inside the contractor. It sits in the market connecting requirements, suppliers, prices, access and buyers. The state can shape that market without owning every firm in it, and the firms can sell capabilities that outlive the requirement that first created them.

Israel reveals another kind of market, built around labour rather than contracts. Unit 8200 is a real organisation with real operations. It is also a sorting mechanism whose output is people: veterans who found companies, companies that build products, products that leave under licence, and a reserve system that calls the same people back when war requires them.

The capability is in the circulation. Training leaves the state, becomes commercial expertise, returns through reserve service, and leaves again. A state that regulates that circulation rather than closing it has made its cyber capability partly external to itself.

The network¶

Lithuania removes the actor almost entirely. A small exposed state disperses capability across relationships it does not control alone: a rapid-response team it leads for the Union, a regional centre run with the United States and open to others, American hunt-forward activity on its networks, and technical work on Chinese-made handsets that gives a wider network an early warning.

The network is not merely where Lithuanian capability is supplemented. It is where the capability exists.

When Lithuania established a national cyber command in 2025, its stated purpose centred on interoperability. The new institution therefore extends the network rather than replacing it with a national container.

France is the counter-example. France deliberately tried to make the state the actor in the fullest sense, with every layer of the stack national and owned. Yet the floor beneath that stack remains foreign: hyperscale cloud under licence, much of the silicon imported, intelligence relationships embedded in alliances France does not control.

France can act alone, but the system that makes that action possible remains networked.

The Union reaches the same problem from the opposite direction and turns it into a design. It does not try to own the capability. It coordinates national capability, sets rules for a common market and gives twenty-seven states machinery through which they can act together.

The Union is therefore not an actor with a missing capability. It is a network deliberately built without a single owner.

The infrastructure¶

Estonia removes the remaining separation between the state and the system through which it acts. Identity, registries, public services and the data on which government operates are not supporting systems around the state. They are part of the state’s operating infrastructure.

A flaw in an identity-card chip can therefore become a state emergency. A copy of government registries held abroad can become an element of state continuity. The digital system is simultaneously capability, dependency and target.

The state does not merely possess cyber infrastructure. The state is partly constituted by it.

Ukraine takes the argument into war. A compromised camera can become a targeting feed. A government application can become a sensor. Commercial satellites and foreign cloud can keep state functions running. Cyber-derived information can enter the same targeting picture as signals intelligence, drones, electronic warfare and conventional reconnaissance.

At that point the question is no longer simply who conducted the cyber operation. It is whether the operation was usefully separable as cyber at all.

The actor has not merely dissolved into infrastructure. The domain has dissolved into the battlespace around it.

The unit keeps moving¶

The progression is therefore not from weak actors to strong ones. It is from one kind of unit to another.

North Korea can still be read through a bureau, but the bureau exists to satisfy a treasury requirement. Russia makes the boundary between state and criminal apparatus unstable. The United States operates through a standing apparatus rather than a single organisation. China turns capability into a market. Israel turns it into a labour circulation. Lithuania makes the network itself the concentration point. France tries to reassemble the whole as a national stack and discovers the network underneath it. The Union makes the network the design.

Estonia takes the next step. Infrastructure becomes part of the state itself. Ukraine takes the one after that. Cyber becomes so embedded in war that the domain no longer provides a clean unit of action.

The named actor remains useful. A court needs a defendant. A sanctions list needs an entry. A security team needs a cluster label. Those are practical units, and they are real.

They are simply not always explanatory units.

Cyber power belongs to arrangements that actors participate in, feed, move through and sometimes control. The further down the eleven cases one goes, the less useful it becomes to ask who owns the capability and the more useful it becomes to ask what relationship produces it.

The name is where the account starts.

It is not necessarily where the power is.