APWG eCrime researchers examine state-backed cybercrime

Researchers at APWG eCrime 2026 in Lisbon are presenting new frameworks for understanding why governments use cybercrime to fund national goals and how democracies can deter it. The discussion lands as new U.S. sanctions on North Korean employment fraud networks highlight the rise of state-enabled cybercrime as a financing tool.

Why it matters: - State-backed cybercrime is shifting from a law enforcement problem to a national security and sanctions-evasion challenge. - The issue affects how governments respond to hostile activity, especially when criminal operations also support military, diplomatic or economic objectives. - The discussion at APWG eCrime 2026 comes as governments look for tools that go beyond standard cybersecurity defenses.

What happened: - APWG’s Symposium on Electronic Crime Research, or eCrime 2026, opened in Lisbon on Nov. 5, 2026. - The session, “The Rise of the Cybercriminal State,” focused on the convergence of organized cybercrime and state power. - Dr. Brian Scavotto of North Carolina Agricultural and Technical State University and Dr. Louise Marie Hurel of the Royal United Services Institute in London presented complementary frameworks. - Dr. Alexander Seger, a longtime leader on the Council of Europe’s work on the Budapest Convention on Cybercrime, moderated the session. - The panel followed new U.S. sanctions against North Korean government-run employment fraud networks.

The details: - Scavotto’s paper, “Filling the War Coffers: A Decision-Making Model for State-Sponsored Cybercrime,” argues that cybercrime can function as a sustainable national financing strategy. - The model examines revenue generation, sanctions circumvention, intellectual property theft and support for military or other government priorities. - Scavotto’s six-stage framework assesses feasibility, capabilities, attribution risks, retaliation risks, benefits and repeatability. - Hurel’s paper, “Beyond ‘Cyber’ in Deterrence: A Multilevel Framework,” was co-authored with Dr. Gareth Mott and published by RUSI in September 2026. - Hurel’s framework calls for a whole-of-government response that combines cyber and non-cyber tools. - Those tools include economic pressure, sanctions, diplomatic coordination, collective action, capacity building and calibrated responses to adversarial behavior. - The framework is aimed at NATO, European Union members and their partners. - APWG eCrime was founded in 2006. - The symposium has expanded from a technology focus to include behavioral, social, economic and legal or policy dimensions of cybercrime and cyber-physical crime. - APWG says hundreds of papers from the symposium have been published by IEEE, Taylor & Francis and the Association of Computing Machinery.

Between the lines: - The core shift is from treating cybercrime as opportunistic hacking to viewing it as a state finance mechanism. - Scavotto’s model suggests policymakers need to understand the cost-benefit calculus of rogue governments, not just the technical mechanics of attacks. - Hurel’s framework reflects a broader view that deterrence may require coordinated economic, diplomatic and security measures, not isolated cyber defenses. - Seger’s framing points to a policy lesson from past transnational crime fights: disrupting payment flows and imposing layered consequences can matter as much as technical takedowns.

What's next: - Researchers and policymakers are expected to use the Lisbon discussions to refine responses to state-linked cybercrime. - The frameworks presented at eCrime 2026 are likely to inform future work on sanctions, deterrence and international coordination. - APWG eCrime will continue positioning itself as a multidisciplinary venue for cybercrime research and practitioner collaboration.

The bottom line: - State-backed cybercrime is no longer a fringe threat; it is emerging as a tool of national policy, and defenders may need broader economic and diplomatic responses to counter it.