Countries With the Most Cybercrime Activity (2025)

Cybercrime is the world's fastest-growing criminal enterprise by measured economic impact. The annual global cost has escalated from approximately $3 trillion in 2015 to an estimated $8 trillion in 2023, with projections suggesting $10.5 trillion by 2025. To put that in context: if cybercrime were measured as a national economy, it would be the world's third-largest, behind only the United States and China. Unlike most forms of crime, cybercrime is not randomly distributed — sophisticated attribution by intelligence agencies, cybersecurity firms, and academic researchers has established which countries generate the most attack activity, what types of attacks they specialise in, and why the geography of a borderless threat still matters.

Methodology and Attribution Caveats

Attributing cyberattacks to specific countries involves inherent uncertainty. Sophisticated actors deliberately obscure their origins through proxy servers, compromised third-country infrastructure, and deliberate false-flag techniques. The rankings below reflect consensus assessments drawn from multiple sources: the FBI Internet Crime Complaint Center (IC3) annual reports, Europol's Internet Organised Crime Threat Assessment (IOCTA) 2024, ENISA Threat Landscape reports, Microsoft's Digital Defense Reports, CrowdStrike and Mandiant (Google) annual threat intelligence reports, and U.S. Department of Justice criminal indictments which provide some of the most specific public attribution available.

State-sponsored and criminal categories are treated separately because they involve different actors, motives, and legal frameworks. A country may appear on this ranking both as a source of state-directed operations and as a host of criminal ecosystems — Russia is the clearest example.

Source: Europol IOCTA 2024, July 2024; FBI IC3 Annual Report 2023.

Top 10 Countries by Cybercrime Activity (2025)

Rank	Country	Primary Attack Type	State-Sponsored?	Notable Groups
1	China	IP theft, espionage, infrastructure pre-positioning	Yes (primary)	APT40, APT41, Volt Typhoon, Salt Typhoon
2	Russia	Ransomware, destructive attacks, election interference	Yes + criminal ecosystem	Sandworm, APT29, APT28, REvil legacy
3	North Korea	Cryptocurrency theft, SWIFT targeting, espionage	State-directed	Lazarus Group, APT38, TraderTraitor
4	Iran	Disruptive attacks, espionage, ransomware	State-directed	APT33 (Charming Kitten), APT34, MuddyWater
5	USA	Criminal infrastructure, fraud, ransomware hosting	Primarily criminal	Various criminal groups; also major victim
6	Brazil	Financial fraud, banking trojans	Criminal	Grandoreiro, Guildma, Javali operators
7	Nigeria	Business email compromise (BEC), romance fraud	Criminal	BEC networks, "Yahoo Boys"
8	India	Business email compromise, tech support scams	Criminal	Tech support fraud networks
9	Romania	Credit card fraud, skimming, ATM malware	Criminal	Eastern European fraud networks
10	Ukraine	Mixed; also major target of Russian operations	Both	Pre-invasion criminal ecosystem; now primary target

Where this data comes from

Attribution of cyberattacks to specific countries involves inherent uncertainty because sophisticated actors deliberately obscure origins through proxy infrastructure and false-flag operations. The rankings here reflect consensus assessments from multiple sources: Europol's Internet Organised Crime Threat Assessment (IOCTA) 2024, FBI Internet Crime Complaint Center (IC3) annual reports, ENISA Threat Landscape reports, and threat intelligence from security firms (Mandiant/Google, CrowdStrike, Microsoft). State-sponsored attributions rely on public advisories from governments (CISA, NCSC, NSA), peer-reviewed technical analysis, and US Department of Justice indictments (which provide some of the most detailed public attribution). Criminal ecosystem rankings reflect clustering of known criminal actors, malware development, and attack origination data. Important caveat: absence from this list does not mean a country lacks cybercrime; countries with advanced counter-cyber capabilities (USA, Israel, UK) appear both as targets and as sources of offensive operations.

Analytical insight: cyber crime follows economic incentive structure

Cybercrime concentrates geographically where three enabling conditions align: (1) technical skills available but legitimate high-wage employment scarce, (2) weak law enforcement cooperation with Western jurisdictions, and (3) access to wealthy targets across borders. Romania produces financial malware developers because it has strong STEM education but limited high-skill job opportunities; malware development pays better than cybersecurity defence. Nigeria hosts business email compromise (BEC) fraud networks because English proficiency, internet access, and weak banking oversight create ideal conditions for social engineering attacks on international targets. Russia maintains the world's most sophisticated ransomware ecosystem not because Russians are uniquely criminal but because the Kremlin's tolerance for criminal activity (so long as it doesn't target domestic interests) creates operational safety that criminals elsewhere lack. Brazil and India produce tech support scam networks because they have large English-speaking populations, time zone advantages for targeting North American victims, and weak enforcement. This suggests cybercrime is fundamentally a market phenomenon responding to supply and demand incentives — countries will shift positions as enforcement increases, as job opportunities expand, or as platforms provide new attack vectors.

A Brief History of State-Sponsored Cyber Operations

State involvement in cyber operations dates to the early 1990s, when intelligence agencies began recognising that computer networks could be exploited for espionage at a fraction of the cost and risk of human intelligence. The U.S. National Security Agency and UK GCHQ were pioneers — their capabilities became public through Edward Snowden's 2013 disclosures. China's cyber espionage programme became apparent to Western governments through a series of high-profile intrusions: the 2006–2009 GhostNet operation (targeting Tibetan exile organisations and foreign embassies), the Aurora attacks on Google and dozens of other U.S. companies in 2009–2010, and the sustained targeting of U.S. defence contractors documented in the 2013 Mandiant APT1 report.

Russia's offensive cyber programme became publicly prominent through the 2016 U.S. election interference operation and the 2017 NotPetya attack. North Korea's Lazarus Group became known through the 2014 Sony Pictures hack and the 2016 Bangladesh Bank heist. Iran developed its cyber capabilities partly in response to the Stuxnet attack — widely attributed to the United States and Israel — that damaged Iranian uranium enrichment centrifuges around 2009–2010.

The shift from espionage-only operations to disruptive and destructive attacks represents the most significant evolution in state cyber doctrine over the past decade. When a state actor deploys malware that destroys data or disables industrial control systems, the line between cyberwar and armed conflict becomes genuinely unclear under international law.

Why Cybercrime Concentrates in Specific Countries

Cybercrime is not randomly distributed because it requires specific enabling conditions. State-sponsored operations require government investment in technical training, tools, and operational security infrastructure. Criminal operations require three things: technical skill, low enforcement risk, and access to victims.

Think of cybercrime as a manufacturing business: it concentrates where the inputs are cheap and the regulatory constraints are low. Countries with strong technical university systems but limited legitimate high-skill employment opportunities create populations with the skills to conduct sophisticated attacks. Countries with enforcement gaps — either through corruption, lack of international cooperation, or deliberate state tolerance — allow criminal operations to continue without prosecution risk. Countries with internet connectivity but limited law enforcement cooperation with Western jurisdictions provide operational bases from which to attack wealthy targets.

This structural analysis explains why Nigeria hosts BEC fraud networks, why Romania hosts financial malware developers, and why Russia hosts the world's most sophisticated ransomware criminal ecosystem. The enabling conditions differ, but the logic is the same.

Source: ENISA Threat Landscape 2024.

China: The World's Largest State Cyber Apparatus

China operates the world's most extensive state-sponsored cyber espionage programme by volume and breadth of targeting. The People's Liberation Army's Strategic Support Force, the Ministry of State Security (MSS), and associated contractor networks conduct systematic, long-term intrusion campaigns against targets in virtually every country simultaneously.

China's operations differ from Russia's in a critical way: they prioritise intelligence collection and intellectual property theft over disruption. The objective is not to break systems but to silently extract data — R&D results, negotiating positions, military capabilities, source code, and personal data on officials and dissidents. Think of it as the difference between a burglar who steals valuables quietly and one who smashes the place up on the way out; China generally prefers the former.

The FBI estimated in 2020 that Chinese intellectual property theft costs the U.S. economy $225–600 billion annually through cyber operations. Targets include aerospace (Boeing, Lockheed Martin), pharmaceuticals (COVID-19 vaccine research was specifically targeted in 2020), semiconductors, artificial intelligence research, and defence contractors. The 2014–2015 breach of the U.S. Office of Personnel Management (OPM) — attributed to Chinese state actors — exposed security clearance records of 21.5 million U.S. government employees, providing a comprehensive database of intelligence targets.

Volt Typhoon, disclosed in 2023, revealed a particularly concerning Chinese tactic: pre-positioning malware in U.S. critical infrastructure — power grids, water systems, telecommunications networks — not for immediate use but for potential activation in a future conflict. This "living off the land" approach uses legitimate system tools and credentials to move through networks while avoiding detection, and represents a strategic deterrent capability rather than an intelligence-collection operation.

Salt Typhoon, disclosed in late 2024, compromised multiple major U.S. telecommunications carriers — including AT&T and Verizon — providing access to call metadata and, in some cases, call content for senior government officials. The breach was described by U.S. officials as one of the most significant telecommunications security compromises in American history.

Source: U.S. Cybersecurity and Infrastructure Security Agency (CISA), Volt Typhoon Advisory, May 2023; FBI Director testimony to U.S. Senate, January 2024.

Russia: Disruption as Strategic Tool

Where China steals, Russia breaks. Russian state cyber operations, conducted by units within the FSB (APT29, known as Cozy Bear), GRU (Sandworm, APT28 known as Fancy Bear), and SVR, specialise in high-impact, politically motivated attacks designed to disrupt, demoralise, or degrade adversaries.

NotPetya (2017) remains the most destructive cyberattack in history. Designed as a wiper weapon targeting Ukraine's financial and government infrastructure, the malware escaped containment and propagated globally, causing an estimated $10 billion in damages across companies including Maersk (whose global shipping operations were paralysed for days), FedEx's TNT subsidiary, pharmaceutical manufacturer Merck, and food company Mondelez. The White House attributed NotPetya to Russian military intelligence in 2018.

Election interference has become a signature Russian capability. The 2016 U.S. election operation combined GRU hacking of Democratic Party systems (DNC, DCCC, John Podesta's email) with the Internet Research Agency's social media influence operations — an extension of Soviet-era "active measures" into the digital domain. Similar operations targeted France's 2017 election (the "Macron Leaks"), German federal institutions, and Ukrainian electoral infrastructure.

Russia's criminal ecosystem is the other dimension of Russian cyber activity. Groups including REvil, DarkSide, Conti, and LockBit operated from Russian territory with apparent state tolerance, producing billions in ransom payments from Western victims. The Conti group's ransom payments exceeded $180 million in 2021 alone, according to Chainalysis. Conti was eventually disrupted — partly because its members' pro-Russia public statements following the Ukraine invasion exposed their identities to Ukrainian researchers who then leaked their internal communications.

Source: Europol IOCTA 2024; U.S. Department of Justice indictments, GRU officers, 2018.

North Korea: Cryptocurrency Theft as State Financing

North Korea's cyber programme occupies a unique position: it is the only state in the world conducting large-scale cybercrime primarily to fund its own government budget. With the country cut off from the international financial system by sanctions, cryptocurrency theft provides an alternative revenue stream for the Kim regime's weapons development programmes — including ballistic missiles and nuclear warheads.

The Lazarus Group and associated units (APT38, TraderTraitor) have stolen an estimated cumulative total of $3+ billion in cryptocurrency since 2017, according to the UN Panel of Experts on North Korea. In 2022 alone, Chainalysis attributed approximately $1.7 billion in crypto theft to North Korean-linked actors — more than the country's estimated total legitimate export revenue. The Ronin Network hack (March 2022, $625 million), the Harmony Horizon Bridge hack (June 2022, $100 million), and the Atomic Wallet hack (June 2023, $100 million) all carry North Korean technical signatures.

Beyond crypto, North Korea conducts targeted attacks on SWIFT banking infrastructure. The 2016 Bangladesh Bank heist — where North Korean hackers used fraudulent SWIFT messages to request transfers from the Bangladesh Bank's account at the New York Federal Reserve — netted $81 million before the scheme was partially detected. The FBI has indicted multiple North Korean nationals for these operations.

Source: Chainalysis Crypto Crime Report 2024; UN Panel of Experts on North Korea, February 2024 report.

Iran: Retaliation and Sabotage

Iran's cyber programme is shaped by its experience as a target: Stuxnet destroyed approximately one thousand uranium enrichment centrifuges at Natanz around 2009–2010, demonstrating to Iranian military planners that cyberweapons could produce real-world physical damage. Iran's response was to build its own offensive cyber capability, now assessed as the world's fourth most capable.

Iran's operations tend to be retaliatory and politically motivated. The 2012 Shamoon wiper attack on Saudi Aramco destroyed data on approximately 35,000 computers, one of the most damaging attacks on a single organisation in cybercrime history. The 2021–2022 campaign against Albanian government systems — which caused Albania to cut diplomatic relations with Iran — reflected Tehran's response to an Albanian government decision to host MEK dissidents. Iran's APT33 (also called Charming Kitten) conducts extensive espionage against nuclear scientists, dissidents, and foreign government officials, with particular focus on the United States, Israel, Saudi Arabia, and the UK.

Iran also uses ransomware as a revenue and disruption mechanism. The FBI and CISA have attributed multiple ransomware operations targeting critical U.S. infrastructure to Iranian state-affiliated actors.

Criminal Cybercrime Ecosystems

Nigeria and Business Email Compromise

Nigeria is primarily associated with Business Email Compromise (BEC) — sophisticated fraud schemes that compromise or impersonate corporate email accounts to redirect financial transfers. The FBI IC3 estimates that BEC caused approximately $2.9 billion in reported U.S. losses in 2023 — the single largest cybercrime category by financial loss in IC3 reporting. Nigerian criminal networks are prominent among BEC perpetrators. The "Yahoo Boys" cultural phenomenon — young men pursuing cybercrime as a primary income source — reflects the combination of high youth unemployment, technical skills access, and historically limited enforcement risk. Operation WireWire (2018) and Operation reWired (2019) resulted in 280+ arrests across multiple countries, but BEC networks have proven highly resilient.

Brazil and Banking Trojans

Brazil faces an enormous domestic cybercrime problem driven by its combination of high digital banking adoption, a large population, economic inequality, and concentrated technical skill. Brazilian financial institutions suffer estimated losses of $15+ billion annually to cyber fraud. Specialised banking trojans — Grandoreiro, Guildma, Javali, and Melcoz, collectively known as the "Tetrade" group — were developed specifically for the Brazilian banking environment and have now expanded to target European and Latin American banks as well. The Brazilian cybercrime ecosystem is notable for its domestically-oriented focus: unlike Russian or Chinese groups that primarily target foreign victims, Brazilian criminal networks predominantly target domestic Brazilian banks and their customers.

Romania and Financial Fraud Infrastructure

Romania and Eastern Europe broadly host sophisticated credit card fraud, ATM skimming, and online banking malware operations. The Carbanak group — responsible for stealing an estimated $1 billion from financial institutions globally between 2013 and 2015 through malware targeting banking software — emerged from this ecosystem. Romania's relatively strong computer science education system, combined with the economic disruptions of the post-communist transition, created a generation of technically skilled individuals with limited legitimate employment options who turned to cybercrime in the 1990s and 2000s.

Ransomware: The Defining Criminal Model of the 2020s

Ransomware — malware that encrypts victims' files and demands cryptocurrency payment for decryption keys — has become the dominant criminal cybercrime model, combining high revenue, global reach, and significant operational security advantages over traditional fraud.

Year	Total Ransom Payments	Largest Single Ransom	Notable Attack
2020	$400M	$40M (CNA Financial)	Universal Health Services
2021	$765M	$40M (CNA Financial)	Colonial Pipeline, JBS Foods
2022	$457M	$80M (Medibank)	Various healthcare
2023	$1.1B	$75M (Dark Angels)	MGM Resorts, Caesars Palace
2024	~$1.5B est	$22M (Change Healthcare)	UnitedHealth Group

The Change Healthcare attack in February 2024 — attributed to the ALPHV/BlackCat group, which had significant Russian membership — disrupted prescription processing for approximately one-third of U.S. Americans for weeks, forcing hospitals and pharmacies to revert to manual processing. UnitedHealth Group paid $22 million in ransom and ultimately estimated total costs exceeding $1 billion.

Source: Chainalysis Crypto Crime Report 2024.

How AI Is Reshaping the Cybercrime Landscape

The Europol IOCTA 2024 report identifies artificial intelligence as the most significant new enabler of cybercrime in 2023–2024. Three specific AI applications are escalating threat levels.

First, large language models (LLMs) are dramatically improving phishing and social engineering. Previously, phishing emails from non-native English speakers were often detectable by grammatical errors; LLM-assisted phishing produces grammatically perfect, contextually tailored messages at scale. The FBI reported a surge in LLM-assisted BEC attempts in 2024.

Second, AI-generated deepfakes are being used in voice fraud — cloning executives' voices to authorise fraudulent wire transfers, known as "vishing" (voice phishing). A finance employee at a multinational company transferred $25 million after a deepfake video call appeared to show the CFO authorising the payment, according to Hong Kong police in February 2024.

Third, AI is accelerating vulnerability discovery, allowing less technically skilled attackers to identify and exploit software weaknesses that previously required expert manual analysis.

Source: Europol IOCTA 2024.

Key Trends Shaping Cybercrime in 2025 and Beyond

Ransomware-as-a-Service (RaaS) has industrialised criminal cybercrime. The RaaS model separates developers (who build and maintain the ransomware code) from affiliates (who conduct attacks and share revenues). This creates a franchise-like structure where technical development expertise is concentrated, while attack execution is distributed across a much larger criminal ecosystem. LockBit's disruption in February 2024 through international law enforcement temporarily reduced activity, but the RaaS model has proven highly resilient.

Critical infrastructure targeting has increased significantly. The Volt Typhoon pre-positioning campaign, energy grid attacks in Ukraine, and attacks on hospitals and water treatment facilities reflect a strategic shift toward targets whose disruption creates maximum societal impact.

Cryptocurrency remains the payment rails for criminal cybercrime despite improved Bitcoin.">blockchain tracing. The Chainalysis 2024 report notes that while law enforcement seizures have increased substantially, total illicit cryptocurrency volumes also increased in 2023, driven primarily by sanctions evasion and ransomware.

International law enforcement cooperation has achieved major successes — LockBit takedown, AlphV/BlackCat disruption, Genesis Market seizure — but the underlying ecosystems regenerate. The criminal networks are resilient because the human capital (skilled technical operators) persists even when specific groups are dismantled.

Frequently Asked Questions

Q: Which country has the most cybercrime? For state-sponsored operations, China is assessed as the most prolific actor globally by volume and breadth of targeting, followed by Russia, North Korea, and Iran. For criminal (non-state) cybercrime, the United States, Brazil, and Nigeria host the largest ecosystems by volume of activity, though the U.S. figure largely reflects its massive internet footprint making it both a source and the primary global target.

Q: How much does cybercrime cost the global economy? Cybercrime costs an estimated $8 trillion globally in 2023, projected to reach $10.5 trillion by 2025, according to Cybersecurity Ventures. This includes direct financial losses, ransomware payments, incident response costs, data recovery, regulatory fines, and productivity impacts. The figure includes both criminal activity and state-sponsored operations.

Q: What is state-sponsored cybercrime? State-sponsored cybercrime involves attacks conducted by, or with the direction and support of, national governments. The four countries most frequently attributed with state-sponsored operations by Western intelligence agencies are China, Russia, North Korea, and Iran. State-sponsored operations range from espionage (collecting intelligence) to sabotage (disrupting systems) to pre-positioning (placing malware for potential future activation).

Q: What is ransomware and how does it work? Ransomware is malicious software that encrypts a victim's files or locks their systems, with attackers demanding payment — typically in cryptocurrency — in exchange for decryption keys. Most modern ransomware is deployed through phishing emails, compromised remote access protocols (RDP), or exploitation of unpatched software vulnerabilities. Ransomware payments totaled approximately $1.1 billion in 2023 and an estimated $1.5 billion in 2024.

Q: What is business email compromise (BEC)? BEC fraud involves compromising or impersonating corporate email accounts to deceive employees into transferring funds to attacker-controlled accounts. It differs from ransomware in that no malware is required — the fraud is social engineering. BEC caused approximately $2.9 billion in reported U.S. losses in 2023, making it the highest-financial-impact cybercrime category in FBI IC3 reporting.

Q: How can organisations protect against the most common cybercrime attacks? The highest-impact defensive measures are: multi-factor authentication on all email and remote access accounts (prevents the majority of credential-based attacks), regular offline backups that ransomware cannot reach, prompt patching of known vulnerabilities, employee training on phishing recognition, and network segmentation to limit the blast radius of successful intrusions. No single measure is sufficient; effective defence requires layers.

Sources

• Europol Internet Organised Crime Threat Assessment (IOCTA) 2024
• FBI Internet Crime Complaint Center (IC3) Annual Report 2023
• Chainalysis Crypto Crime Report 2024
• ENISA Threat Landscape 2024
• CISA Volt Typhoon Advisory, May 2023

The Takeaway

Cybercrime is now a foundational national security threat, not merely an economic nuisance. The $8 trillion annual cost exceeds the combined GDP of Germany and Japan. The convergence of state-sponsored espionage, pre-positioned critical infrastructure malware, industrial-scale ransomware criminal ecosystems, and AI-accelerated social engineering has created a threat environment without historical precedent. The countries at the top of this ranking — China, Russia, North Korea, Iran — are not going to stop their operations because of diplomatic pressure or economic sanctions; the operations are too strategically valuable. What changes is the cost imposed on them through defensive hardening, offensive counter-operations, and the gradual erosion of the anonymity and impunity that enable cybercrime at scale.

Related Reading

• Countries With the Best Cybersecurity Capabilities (2025)
• Countries With the Biggest Defence Budgets (2025)
• Countries With the Most Tanks in the World (2025)
• Countries Spending the Most on Healthcare (2025)
• Most Urbanised Countries in the World (2025)