Ink Dragon: a prime example of a geopolitical power instrument

Lotem Finkelstein (Check Point) at Cybersec Netherlands 2026

When a spy is exposed, the story often seems to be over. The operation has failed, those involved have been identified and the damage is assessed. In the digital world, things are different. There, a failed intelligence operation can actually become the starting point for new attacks, new infiltrations and new ways of gathering information. Cyber operations are no longer isolated incidents, but part of a broader strategic toolkit used by states to exert influence, gather knowledge and achieve geopolitical objectives.

One of the most intriguing examples of this is Ink Dragon, a highly selective Chinese cyber unit operating within the country’s broader offensive cyber ecosystem. The group is known for its targeted operations against governments, diplomatic organisations and other strategic targets. During Cybersec Netherlands 2026 on 9 and 10 September, Lotem Finkelstein, Head of Threat Intelligence at Check Point Software, will present an in-depth public analysis of this group for the first time on day one. His research offers a unique insight into how modern state actors use cyber capabilities as an extension of traditional intelligence and influence operations.

Geopolitical motives

In recent years, the threat landscape has changed fundamentally. While cybercriminals have traditionally been driven by financial gain, organisations today are increasingly facing attacks carried out for geopolitical reasons. States are investing billions in offensive cyber capabilities and now consider digital operations an integral part of their national security strategy.

This development is being reinforced by rising geopolitical tensions between major powers such as China, the United States and Russia. Intelligence gathering, economic competition, technological dominance and strategic autonomy are increasingly areas in which cyber operations play an important role. After all, digital attacks offer states a relatively inexpensive, scalable and often difficult-to-trace way to advance their interests.

Strategic information gathering

Although ransomware and destructive attacks receive a great deal of media attention, the greatest threat to many organisations often lies elsewhere. Advanced attackers are increasingly focused on long-term access to networks. Not necessarily to cause immediate damage, but to collect information, monitor communications and gain strategic insights.

This requires a different view of cybersecurity. The traditional approach, in which prevention is central, is increasingly making way for detection, threat intelligence and resilience. Organisations must assume that attackers will eventually find a way in and focus on quickly identifying anomalous behaviour, suspicious infrastructure and signs of advanced attackers.

An extension of intelligence work

A striking trend is the growing convergence between traditional espionage and digital operations. Where human sources once played a dominant role, they are now supported by cyber capabilities that can collect and analyse information at scale.

As a result, the boundaries between cybersecurity, national security and geopolitics are becoming increasingly blurred. Organisations that hold sensitive information, from government institutions and research organisations to technology companies and critical infrastructure providers, are increasingly finding themselves in the crosshairs of actors who are not seeking financial gain, but strategic advantage.

For executives and security professionals, this means that cyber threats are no longer solely a technical issue. They directly affect risk management, geopolitical developments, supply chains and organisational continuity.

Supporting intelligence missions

That is precisely why analyses of groups such as Ink Dragon are so relevant. They show how modern state cyber operations are set up, which infrastructures are used and how digital attacks form part of a broader strategic agenda.

During Cybersec Netherlands 2026, Lotem Finkelstein will take visitors into the world behind Ink Dragon and show how cyber operations are used to support intelligence missions, how attackers deal with operational setbacks and how hidden digital infrastructures are used to exert influence worldwide. For anyone who wants to understand how cyber threats are evolving from technical incidents into geopolitical power instruments, this keynote is undoubtedly one of the most compelling sessions of the event.