💼 Economic Espionage theater

Covers state-sponsored economic and industrial espionage — IP theft, R&D exfiltration, and supply-chain intrusions targeting strategic sectors. CVE-driven initial access and long-dwell implants make exploit intelligence and attribution to state programs central to defense.

🏹 Threat Actors

🦠 Malware & Tools

🧭 Intelligence disciplines

📚 Priority sources & datasets

📜 Economic Espionage Playbook

1. Collect intrusion telemetry, malware samples, and CVE-exploitation data from CISA KEV, Mandiant, and sensor networks.
2. Reverse-engineer implants (PlugX, ShadowPad, Winnti) and map C2 and exploited edge-device CVEs.
3. Analyze targeting of IP-rich sectors and reconstruct data-exfiltration and supply-chain intrusion chains.
4. Attribute campaigns to state programs (APT41, APT10, APT31, PLA/MSS units) via code, infrastructure, and DOJ indictments.
5. Brief targeted industries, ISACs, and government partners with TTPs and ATT&CK mappings.
6. Deploy detections, patch exploited CVEs, and support counterintelligence and indictment action.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

🔗 Cross-domain pivots