3rd meeting - Plenary Session

Egypt argues that cyber threats do not belong exclusively to certain regions or countries, and therefore all nations have an equal right to see their security concerns reflected in plenary discussions and thematic groups. This principle of equal representation is fundamental to ensuring that the mechanism serves all member states fairly.

Egypt stated that all countries and regions have equal rights to see the challenges and threats they deem as national priorities to be reflected and discussed equally in the plenary and in the thematic groups .

Egypt contends that discussions in dedicated thematic groups must go beyond replicating plenary debates and instead be dynamic, grounded in real case scenarios, and informed by a consensus-agreed pool of relevant experts. Without such experts, discussions risk being unproductive and failing to produce tangible outcomes.

Egypt emphasised that discussions should be dynamic based on real case scenarios, analysing threats from all aspects and coordinating with national, regional, and international authorities . Egypt further stressed that having discussions on threats without a professional, experienced, and relevant pool of experts is a waste of time, and that the pool of experts must be accepted by delegations through consensus .

Kiribati highlights that every step forward in digital connectivity also increases exposure to cyber threats, and for a nation served by a small number of cables and satellite links, this is an existential concern rather than an abstract one. The arrival of the first submarine cable at Tarawa illustrates both the transformative potential and the new vulnerabilities created.

Kiribati noted that the East Micronesian Cable landed at Tarawa last year, the first submarine cable ever to reach their capital, underpinning their Digital Government Master Plan . Kiribati stated that every step forward in connectivity is also a step forward in exposure, and that for a nation served by a small number of cables, landing stations, and satellite links, critical infrastructure protection is existential .

Kiribati stresses that damage to or disruption of its submarine cable, whether by malicious cyber activity or otherwise, would not merely degrade services but sever them entirely, making critical infrastructure protection an existential priority rather than one concern among many.

Kiribati stated that damage to or disruption of their submarine cable will not degrade their services but will sever them, and that they are equally concerned by cyber-enabled fraud, phishing, ransomware against government systems, and online harm directed at children . Kiribati also cited their legislative backbone including the Cybercrime Act 2021, Digital Government Act 2023, Data Protection Act 2025, and Cybersecurity Act 2026 .

Kiribati argues that while national legislative and institutional action is important, it has inherent limits that only international cooperation can overcome, and this is the very reason the mechanism exists. The mechanism should ensure that every threat discussed connects to a concrete step that leaves every state able to prevent, detect, and respond.

Kiribati stated that national action has limits that only cooperation can overcome, and that cooperation is the very reason these mechanisms exist . Kiribati called for discussion of threats to connect to concrete steps through the plenary and dedicated thematic groups, leaving every state, including the smallest, able to prevent, detect, and respond .

Kiribati emphasises that the global mechanism was designed to be action-oriented and that this standard must be upheld from the very first session. Discussions on threats must not merely describe those threats but must translate into concrete, practical steps for all states.

Kiribati welcomed that the mechanism was designed to be action-oriented and stated their intention to hold it and themselves to that standard . Kiribati called for discussion of threats to not end as descriptions but to connect to concrete steps that leave every state able to prevent, detect, and respond .

Kiribati points out that cyber threats such as fraud, phishing, ransomware, and online harm to children do not discriminate between large and small states, but their impact falls disproportionately on those with the least redundancy and the thinnest technical workforce.

Kiribati stated that cyber-enabled fraud and scams, phishing, ransomware against government systems, and online harm directed at children do not distinguish between large and small states, but their impact falls hardest on those with the least redundancy and the thinnest technical workforce .

New Zealand highlights that ransomware continues to cause serious consequences across all sectors of the economy, with opportunistic actors affecting organisations including in the healthcare sector across the Pacific. Additionally, AI is rapidly transforming the cybersecurity landscape, creating both new risks and defensive opportunities.

New Zealand noted that ransomware continues to have serious consequences, with opportunistic actors impacting organisations in all sectors of the economy, and that others in the Pacific have also been affected by ransomware in the healthcare sector . New Zealand welcomed the opportunity to hear how others are seeing AI affect cybersecurity risks and what they are learning about how AI can support cyber defence .

New Zealand argues that while AI is rapidly transforming the cybersecurity landscape, the global mechanism should focus specifically on building shared understanding of AI's implications for cybersecurity rather than duplicating the work of other UN processes that are already addressing AI governance issues.

New Zealand noted that there are a variety of other UN processes actively grappling with questions related to artificial intelligence, including governance issues, and that it is important that the global mechanism does not duplicate those processes . New Zealand stated that the mechanism should focus only on issues where it is uniquely well placed to add value, namely building shared understanding of the implications of AI for cybersecurity .

Tonga draws on its direct experience of the 2022 Hunga Tonga-Hunga Ha'apai volcanic eruption, which severed the single submarine cable connecting the kingdom to the world, to illustrate the catastrophic consequences of connectivity loss. Tonga argues that what nature did by accident, a malicious actor could choose to do deliberately, making submarine cable sabotage one of the gravest threats before the mechanism.

Tonga described how in January 2022, the eruption of Hunga Tonga-Hunga Ha'apai severed the single submarine cable connecting the kingdom to the world, leaving Tonga silent for weeks and cut off at the very moment it most needed to call for help and coordinate relief . Tonga stated that everything a volcano did by accident, a malicious act could choose to do deliberately, and that this is why Tonga regards submarine cable sabotage as one of the gravest threats before the mechanism .

Tonga provides a concrete example of the devastating impact of ransomware on essential services, describing how an attack encrypted the national health information system, holding the medical records of the entire population to ransom and forcing hospitals to revert to manual processes.

Tonga described that in June of the previous year, a ransomware attack encrypted their national health information system, holding the medical records of their entire population to ransom and forcing hospitals back to pen and paper . Tonga also noted that their state-owned telecommunications provider was attacked in 2023, demonstrating that no country is too small or too remote to be targeted .

Tonga highlights that even the smallest states can pursue accountability for malicious cyber activities when acting with partners, as demonstrated by the joint attribution of the ransomware attack on its Ministry of Health to an affiliate of a known ransomware group together with Australia and New Zealand.

Tonga stated that together with Australia and New Zealand, it jointly attributed the attack on its Ministry of Health to an affiliate of a known ransomware group, demonstrating that even the smallest states acting with partners can pursue accountability for malicious cyber activities .

The Netherlands reports a steady increase in the scale, sophistication, and diversity of cyber incidents affecting society, ranging from ransomware to DDoS campaigns and exploitation of vulnerabilities in edge devices. These incidents impact vital sectors including public administration, healthcare, education, transport, and financial services.

The Netherlands observed a steady increase in the scale, sophistication, and diversity of cyber incidents, with attacks ranging from ransomware to disruptive DDoS campaigns and exploitation of vulnerabilities in edge devices and widely used software . These incidents impact vital sectors like public administration, healthcare, education, transport, and financial services, as well as international organisations based in the Netherlands .

The Netherlands identifies the blurring of boundaries between state and non-state actors as one of the most problematic trends in the current threat landscape, with different types of actors increasingly using similar tools and sometimes operating in concert. This creates a worrying trend of state actors hiding behind proxies to maintain plausible deniability.

The Netherlands stated that different types of actors increasingly use similar tools, target similar systems, and sometimes operate in concert, blurring traditional distinctions between motives and methods . The Netherlands described this as a worrying trend of state actors hiding behind state proxies to maintain plausible deniability .

The Netherlands highlights that critical infrastructure continues to face persistent risks, with a particularly troublesome recent shift towards targeting means of communication such as messaging services. Compromises of such infrastructure can enable large-scale espionage, manipulation of communications, or disruptions with cascading effects far beyond the specific target.

The Netherlands noted that critical infrastructure has been repeatedly targeted and continues to face persistent risks, with a recent shift towards targeting means of communication such as messaging services . The Netherlands stated that compromises can enable large-scale espionage, manipulation of communications, or disruptions with cascading effects far beyond the specific target .

The Netherlands argues that generative AI amplifies existing cyber threats by lowering the barrier for conducting sophisticated operations, from writing convincing phishing messages to assisting in the discovery and exploitation of zero-day vulnerabilities. At the same time, these tools can and should be harnessed defensively to improve detection, analysis, and response.

The Netherlands stated that large language models and other AI systems can lower the barrier for conducting sophisticated operations, from writing convincing phishing messages to assisting in the discovery of zero-day vulnerabilities and their exploitation . The Netherlands noted that with the use of agentic AI on the rise, the development of such threats continues to accelerate, making the threat landscape more complex by the day .

The Netherlands argues that as the threat landscape grows ever more complex, it is through the adequate implementation of the consensus UN framework that states can inject a degree of predictability into global affairs. This implementation-focused approach is the appropriate collective response to the challenges identified.

The Netherlands stated that as the threat landscape continues to grow ever more complex, it is through the adequate implementation of the consensus UN framework that states can try to inject a degree of predictability in global affairs .

The Bahamas highlights that its economy depends on digital-enabled sectors such as tourism, financial services, and maritime logistics, making it particularly vulnerable to a range of cyber threats. These threats carry consequences for small island states that are disproportionate to their size.

The Bahamas noted that its economy depends on digital-enabled sectors including tourism, financial services, port, and maritime logistics, and that it faces ransomware, cybercrime as a service, attacks on critical infrastructure, AI-enabled fraud, mis- and disinformation, and the nexus between cyber threats and natural disasters . The Bahamas stated that all these threats carry consequences for small island states that are disproportionate to their size .

The Bahamas argues that for small island developing states, capacity building is not merely beneficial but a precondition for meaningful participation in global ICT security discussions and implementation. Such capacity building must be sustained, tailored to national circumstances, and directed towards building durable institutions and a trained workforce.

The Bahamas stated that for small island developing states, capacity building is a precondition for participation, and that it must be sustained, tailored to national circumstances, and directed towards durable institutions and a trained workforce so that developing states can be genuine contributors to global ICT security, not just recipients of it .

The Bahamas asserts that international law, including the UN Charter, is the foundation of a secure and peaceful ICT environment and is a guarantee of the process rather than a constraint on it. Voluntary norms and confidence-building measures operate in service of binding legal obligations, not in place of them.

The Bahamas stated that international law, including the UN Charter, is the foundation of a secure and peaceful ICT environment and is the guarantee of this process, not a constraint to it . The Bahamas further stated that voluntary norms and confidence-building measures operate in service of a binding legal obligation, not in place of it .

The Bahamas recommends that cyber threat discussions remain grounded in the operational experience of national CERTs and C-CERT networks, and that cyber threat information sharing be genuinely accessible to small island states. This work should remain connected to capacity building to ensure meaningful participation.

The Bahamas recommended that cyber threat discussions remain grounded in the operational experience of national CERTs and C-CERT networks, that cyber threat information sharing be genuinely accessible to small island states, and that this work stay connected to capacity building .

The Bahamas highlights that the full range of cyber threats, including ransomware, cybercrime-as-a-service, infrastructure attacks, AI-enabled fraud, and the intersection of cyber threats with natural disasters, all carry consequences for small island states that are disproportionate to their size due to limited redundancy and resources.

The Bahamas listed ransomware, cybercrime as a service, attacks on critical infrastructure, AI-enabled fraud, mis- and disinformation, and the nexus between cyber threats and natural disasters as threats that carry consequences for small island states disproportionate to their size .

Iran alleges that the United States and Israel carried out unlawful military attacks accompanied by extensive malicious cyber operations directed against Iran's critical infrastructure and civilian services. During the February 2026 aggression alone, more than 100 cyber attacks were launched every day against Iran's critical and civilian infrastructure.

Iran stated that during the February 2026 aggression alone, more than 100 cyber attacks were launched every day against Iran's critical and civilian infrastructure . Iran described coordinated cyber and kinetic attacks targeting critical ICT infrastructure including telecommunications facilities, data centres, AI infrastructure, and private sector electronics , as well as attacks against civilian institutions including schools, universities, and media , and attacks exploiting private sector technologies and ICT supply chains including Starlink satellite communication services .

Iran argues that the global mechanism should first give attention to threats already identified by member states in previous processes before expanding to new threat areas. Iran supports the preparation of a consolidated compilation of threats identified by member states as the basis for discussions in both the plenary and dedicated thematic groups.

Iran stated that from the outset of the OEWG process, a number of states including Iran identified specific ICT-related threats that were ultimately not reflected in consensus reports, and that addressing these gaps should be a priority for the global mechanism . Iran supported the preparation of a consolidated compilation of threats identified by member states and reflected in the first OEWG Chair Summary as the basis for discussions .

Iran identifies the use of ICTs for disinformation and cognitive operations as a significant threat, including the unlawful use of mobile interception technologies, cyber-enabled surveillance, and the manipulation of digital platforms to incite violence, spread hatred, and deepen social divisions.

Iran described cyber espionage and information operations including the unlawful use of mobile interception technologies, cyber-enabled surveillance, disinformation and cognitive operations, and the manipulation of digital platforms including Instagram, X, and Telegram to incite violence, spread hatred, deepen social divisions, and arbitrarily restrict or remove accounts associated with Iran .

Iran argues that states which consistently advocate respect for the UN Charter, international law, and the framework for responsible state behaviour in ICTs should apply those principles consistently and condemn malicious cyber activities directed against Iran. Selective application of these norms undermines their legitimacy.

Iran stated that states which consistently advocate respect for the Charter of the United Nations, international law, and the framework for responsible state behaviour in ICTs should apply those principles consistently and condemn kinetic and malicious cyber activities directed against Iran .

Iran highlights attacks that exploit private sector technologies and ICT supply chains, including commercial products and services, software, hardware, and digital supply chains, as well as the misuse of satellite communication services to facilitate hostile operations. Iran is also concerned by cyber operations exploiting commercial technologies from companies such as Cisco and HP.

Iran described attacks exploiting private sector technologies and ICT supply chains, including commercial ICT products and services, software, hardware, and digital supply chains, as well as the misuse of Starlink satellite communication services to facilitate hostile operations . Iran also expressed concern about cyber operations exploiting commercial technologies including products and services supplied by companies such as Cisco and HP to undermine the security and resilience of national ICT infrastructure .

Australia reports that the cyber threat environment continues to intensify, with individuals, businesses, and governments adversely affected by threats that expose sensitive information, disrupt essential services, undermine trust and economic prosperity, and contribute to risks to international peace and security.

Australia stated that the Australian Cyber Security Centre responded to over 1,200 cybersecurity incidents and received more than 84,700 cybercrime reports in the previous year, roughly one report every six minutes . Australia identified persistent threats including state-sponsored activity targeting government, critical infrastructure and businesses, ransomware and cybercrime as a service, business email compromise, identity fraud, and exploitation of edge devices .

Australia argues that critical infrastructure and critical information infrastructure protection should be an early focus for the global mechanism, including through DTG1. For many countries, including Australia and others in the region, the resilience of undersea cable infrastructure is fundamental to economic and social connectivity.

Australia stated that critical infrastructure and critical information infrastructure protection should be an early focus for the mechanism, including through DTG1 . Australia noted that for many countries, including their own in the region, the resilience of undersea cable infrastructure is fundamental to economic and social connectivity and to access to the global internet .

Australia highlights that AI is being used by malicious actors to scale social engineering, create more convincing phishing content, analyse stolen data, and lower the cost and skill barriers required to cause harm. Australia is particularly concerned that AI is making it easier for malicious actors to generate and spread propaganda and to prepare physical strikes.

Australia stated that artificial intelligence is being used to scale social engineering, create more convincing phishing content, analyse stolen data, and lower the cost and skill barriers required to cause harm . Australia expressed particular concern that AI is making it easier for malicious actors to generate and spread propaganda and to prepare to carry out physical strikes by supporting planning and target selection .

Australia underlines the importance of responding to cyber threats in line with the agreed norms of responsible state behaviour, and that state responses, including the development and use of cyber capabilities, must be consistent with international law including the UN Charter, international human rights law, and international humanitarian law.

Australia stated that state responses, including the development and use of cyber capabilities, must be consistent with international law, including the UN Charter in its entirety, international human rights law, and international humanitarian law .

Australia acknowledges that while cyber threats are shared across all states, their impacts are not experienced equally. Differences in national capacity can affect vulnerability to malicious cyber activity and the ability to recover when incidents occur, making capacity building an essential component of the mechanism's work.

Australia stated that cyber threats are shared, but their impacts are not experienced equally, and that differences in national capacity can affect vulnerability to malicious cyber activity and the ability to recover when incidents occur .

Japan argues that ransomware attacks, particularly when they impact the operations of critical infrastructure such as hospitals and power plants, can pose a direct threat to international peace and security. Japan seeks to foster this common understanding within the UN global mechanism.

Japan referenced its statement at the Security Council briefing on ransomware on 8 November 2024, where it stated that ransomware is one of the most destructive cyber threats undermining the operations of critical infrastructure including hospitals and power plants, and that given the overall impacts and ramifications, ransomware could certainly pose direct threats to international peace and security .

Japan emphasises the importance of fostering common understanding on existing and potential cyber threats within the UN global mechanism, and argues that this requires drawing on the expertise of a wide range of stakeholders including the private sector. Japan places great importance on expert briefings and interactive public-private discussions.

Japan stated that it is essential to draw on the expertise of a wide range of stakeholders, including the private sector, in conducting discussions on cyber threats . Japan also stated that it places great importance on holding expert briefings and interactive public-private discussions in the substantive plenary sessions and DTGs .

Japan argues that the fast pace of technological development necessitates that discussions within the global mechanism be informed by thorough and up-to-date technical information. The mechanism should therefore allow sufficient time and opportunities for relevant technological experts to provide professional presentations.

Japan stated that it is essential to draw on the expertise of a wide range of stakeholders, including the private sector, and that Japan places great importance on holding expert briefings and interactive public-private discussions in the substantive plenary sessions and DTGs .

Guyana argues that the ICT threat landscape is evolving rapidly due to growing developments in ICT capabilities without corresponding oversight and governance structures. Effectively addressing existing and potential threats requires the integration of security considerations across the lifecycle of ICT products.

Guyana stated that the ICT threat landscape is evolving rapidly due to growing developments in ICT capabilities without concomitant oversight and governance structures, and that effectively addressing existing and potential threats requires integration of security considerations across the lifecycle of ICT products .

Guyana expresses particular concern about the malicious use of ICTs against critical infrastructure and the use of this technology by non-state actors to exacerbate conflicts, including through attacks targeting civilian objects. A holistic approach is required to address these threats given their multifaceted and transboundary nature.

Guyana stated that it is particularly concerned about the malicious use of ICTs against critical infrastructure and critical information infrastructure, and the use of this technology by non-state actors to exacerbate conflicts, including through attacks targeting civilian and civilian objects . Guyana called for a holistic approach considering the multifaceted challenges and transboundary nature of these threats .

Guyana argues that a comprehensive multi-level approach is required to address ICT threats, encompassing awareness, capacity building, international cooperation, public-private partnerships, and continued dialogue among relevant stakeholders at national, regional, and international levels.

Guyana stated that awareness, capacity building, international cooperation, public-private partnerships, and continued dialogue among relevant stakeholders are essential for detecting, defending, and responding to threats, and that these efforts must be made at the national, regional, and international levels .

Greece highlights that while AI offers great potential for innovation and global progress, its misuse through autonomous cyber tools and the advancement of frontier models can amplify existing vulnerabilities and undermine democratic processes and human rights. These capabilities are expected to soon become widely available, significantly lowering the entry barrier for sophisticated attacks.

Greece stated that the misuse of AI, such as through autonomous cyber tools and the recent advancement of frontier models, can amplify existing vulnerabilities and undermine democratic processes and human rights . Greece noted that these capabilities are expected to soon become widely available and significantly lower the entry barrier for actors to perform sophisticated attacks .

Greece identifies the proliferation of commercial cyber tools and capabilities as an important concern, noting that their commercial distribution has the potential to undermine privacy, human rights, democratic institutions, and international security when deployed without adequate safeguards. Greece welcomes initiatives such as the Pall Mall process to build international consensus on responsible use.

Greece stated that the commercial distribution of cyber capabilities has the potential to undermine privacy, human rights, democratic institutions, and international security when deployed without adequate safeguards . Greece welcomed initiatives such as the Pall Mall process, which seeks to build international consensus on the responsible development, distribution, and use of commercial cyber intrusion capabilities .

The United States argues that the global mechanism should be grounded in practical implementation of the 11 consensus norms rather than serving as a vehicle for new legally binding agreements. The mechanism was established to do real work implementing commitments states have already made, not to search for gaps that do not exist.

The United States stated that it continues to approach the mechanism with the objective of grounded practical implementation of the 11 consensus norms, not as a vehicle for new legally binding agreements, noting that as long as some members are maliciously conducting cyber actions against other members, a legally binding agreement is impossible . The United States stated that this mechanism succeeds by building on the consensus already achieved, not by searching for gaps that do not exist .

The United States asserts that states should not conduct or knowingly support malicious cyber activity targeting critical infrastructure, yet alleges that some members in the chamber are currently planning and conducting such actions against other members' critical infrastructure. The United States commits to identifying and holding accountable those perpetrating such activities.

The United States stated that states should not conduct or knowingly support malicious cyber activity targeting critical infrastructure, but that there are members in the chamber right now who are planning and conducting malicious cyber actions against other members' critical infrastructure . The United States stated it would work to specifically identify the states and non-state actors who are perpetuating malicious cyber activities against others in the room .

Tuvalu emphasises that norms, international law, and capacity building cannot be treated as separate silos, and urges the global mechanism to focus on tangible outcomes including shared threat intelligence, clear protocols for protecting subsea infrastructure, and the development of local expertise. Tuvalu stands ready to engage constructively to ensure the mechanism serves as a driver of meaningful action.

Tuvalu urged the global mechanism to focus on tangible outcomes including shared threat intelligence, clear protocols for protecting subsea infrastructure like the Aotevaca Cable, and the development of local expertise . Tuvalu emphasised that norms, international law, and capacity building cannot be treated as separate silos, in line with the integrated approach of A-79-214 and A-80-257 .

Zimbabwe highlights that for developing countries, capacity constraints and uneven cyber resilience increase vulnerability and limit the ability to respond effectively to cyber incidents, risking progress towards digital transformation and sustainable development. Developing countries cannot afford to be left exposed or left behind.

Zimbabwe stated that for developing countries, capacity constraints and uneven cyber resilience increase vulnerability and limit the ability to effectively respond to cyber incidents, risking progress towards digital transformation and sustainable development . Zimbabwe stated that they cannot afford to be left exposed, nor can they afford to be left behind .

Zimbabwe emphasises that as a land-linked developing country relying on interconnected regional telecommunications networks for connectivity, trade, and essential services, protecting critical ICT infrastructure and strengthening cybersecurity resilience are national priorities. Vulnerabilities within shared digital infrastructure can have cross-border consequences.

Zimbabwe stated that as a land-linked developing country that relies on interconnected regional telecommunications networks for connectivity, trade, and essential services, vulnerabilities within shared digital infrastructure can have cross-border consequences . Zimbabwe noted that this reinforces the importance of enhancing regional cooperation and building the technical capacity of developing countries to prevent, detect, and respond to malicious ICT activity .

Zimbabwe expresses concern about the spread of disinformation and misinformation through digital platforms, as well as the rapid advancement and malicious use of artificial intelligence, which is reshaping the cyber threat landscape by enabling more convincing deception and introducing fresh complexities for cybersecurity resilience and response.

Zimbabwe stated that it is concerned by the spread of disinformation and misinformation through digital platforms . Zimbabwe also stated that it is equally concerned by the rapid advancement and malicious use of artificial intelligence, which is reshaping the cyber threat landscape, enabling more convincing deception, and introducing fresh complexities for cybersecurity resilience and response .

Albania reports that recent cyber incidents against public institutions were supported by state-sponsored cyber operations, and were followed by attempts to spread disinformation and manipulate public perception through social media platforms, specifically via Telegram. These activities sought to amplify the psychological impact of cyber incidents and erode trust in public institutions.

Albania stated that recent incidents, four of them only in March 2026, targeted public institutions including the Albanian parliament, Albanian post office, the office of the general prosecutor, and the director of prisons, and were supported by state-sponsored cyber operations . Albania observed attempts to spread disinformation and manipulate public perception through social media and communication platforms, specifically via Telegram, following these incidents .

Albania argues that contemporary cyber threats are no longer limited to technical intrusions but increasingly combine cyber operations with disinformation and influence activities. This combination seeks to amplify the psychological impact of cyber incidents, generate public uncertainty, and erode trust in public institutions.

Albania stated that a particularly concerning trend is the continued combination of cyber operations with information manipulation activities, and that following cyber incidents, Albania observed attempts to spread disinformation and manipulate public perception through social media and communication platforms, specifically via Telegram . Albania stated that these activities demonstrate that contemporary cyber threats are no longer limited to technical intrusions but increasingly combine cyber operations, disinformation, and influence activities .

Albania highlights the growing impact of militant online activity on young people, including the rapid spread of disinformation, manipulation of online content, and cyberbullying through social media and digital platforms. Albania argues that these phenomena represent not only a social issue but an emerging security concern that deserves greater international attention.

Albania stated that the rapid spread of disinformation, manipulation of online content, and cyberbullying through social media and digital platforms pose increasingly serious risks to the safety, well-being, and resilience of younger generations . Albania stated that the use of AI has made the ecosystem even more insecure and has increased the exposure of young people who are more easily manipulated online .

Albania argues that ensuring states act responsibly in cyberspace, refrain from supporting malicious activities, and cooperate in addressing threats is essential for preserving international peace, security, and stability in an increasingly interconnected world. Albania remains fully committed to working constructively with the global mechanism and all partners.

Albania stated that ensuring states act responsibly in cyberspace, refrain from supporting malicious activities, and cooperate in addressing threats is essential for preserving international peace, security, and stability in an increasingly interconnected world .

The Russian Federation argues that the greatest danger in the current threat landscape lies in the use of ICTs for purposes that contradict the UN Charter, specifically to undermine the sovereignty of states, violate their territorial integrity, and interfere in their internal affairs. This represents the core threat that the global mechanism should address.

The Russian Federation stated that the greatest danger lies in the use of ICTs for purposes that contradict the UN Charter to undermine the sovereignty of states, violate their territorial integrity, and interfere in their internal affairs .

The Russian Federation highlights a dangerous trend in which major ICT developers, including AI companies, are deeply embedded in the military-industrial complexes of the countries where they are registered and act as contractors for intelligence agencies and military departments. This undermines trust in their products and creates serious risks for international stability and security.

The Russian Federation stated that major ICT developers which supply their products throughout the world, including AI, now make no secret of how deeply they are embedded in the military-industrial complexes of the countries where they are registered, and often act as contractors for intelligence agencies and military departments . The Russian Federation stated that this situation predictably undermines trust in the products of these companies and creates serious risks for international stability and security .

The Russian Federation argues that accusations of organising and implementing wrongful acts brought against states should be substantiated with evidence, as required by UNGA Resolution 73/27. The Russian Federation contends that no evidence has been provided either publicly or bilaterally, nor have existing channels for identifying the true sources of malicious activity been used.

The Russian Federation stated that in accordance with UNGA Resolution 73/27, accusations of organising and implementing wrongful acts brought against states should be substantiated, and that no evidence has been provided neither in public nor bilaterally, nor have the existing channels for identifying the true sources of malicious activity been used, including the UN Points of Contact Directory .

The Russian Federation highlights the growing problem of undeclared malicious capabilities, including backdoors embedded at the software and hardware levels by developers in the interests of intelligence agencies without notifying end users. Such tools are used for intelligence, espionage, interception of personal data, and as demonstrated by the Pager incident in Lebanon in 2024, for causing physical damage.

The Russian Federation stated that the international community is increasingly confronting the problem of so-called backdoors at the software and hardware levels embedded by developers in the interests of intelligence agencies without notifying end users . The Russian Federation cited the Pager incident in Lebanon in 2024 as an example of such tools being used for causing physical damage .

The Russian Federation argues that low-orbit satellite communication systems, created under the pretext of providing reliable internet connectivity for civilian purposes, are in fact used for military-political objectives and to interfere in the internal affairs of states. The Russian Federation calls for operators of such systems to act in strict accordance with the national legislation of the countries in which they provide services.

The Russian Federation stated that low-orbit satellite communication systems are in fact used for military-political objectives in the interests of certain countries, and cited cases in which such systems have been used to interfere in the internal affairs of states by inciting protests, as well as their use in armed conflicts . The Russian Federation noted that this topic was discussed at an informal UN Security Council meeting in December 2025 .

The Philippines highlights ransomware as an area where practical implementation and international cooperation can deliver immediate benefits. Addressing ransomware requires a comprehensive approach including timely information sharing, strengthened incident response capabilities, public-private partnerships, technical assistance, and sustainable capacity building.

The Philippines stated that addressing ransomware requires timely information sharing, strengthened incident response capabilities, public-private partnerships, technical assistance, and sustainable capacity building . The Philippines noted that given the transnational nature of ransomware, continued cooperation among member states remains essential to strengthening collective resilience .

Ukraine argues that for over a decade, cyberspace has been one of the principal theatres of Russia's ongoing war of aggression against Ukraine, with Russian malicious ICT activities forming part of a broader strategy combining cyberattacks with kinetic strikes, disinformation campaigns, and other hybrid warfare tools. Since the full-scale invasion, Russia has deliberately targeted public authorities, critical infrastructure, and private businesses in Ukraine and beyond.

Ukraine stated that for over a decade, cyberspace remains one of the principal theatres of Russia's ongoing war of aggression against Ukraine, and that Russian malicious ICT activities are not isolated incidents but form part of a broader strategy combining cyberattacks with kinetic strikes, disinformation campaigns, and other hybrid warfare tools . Ukraine stated that since the beginning of the full-scale invasion, Russia has deliberately targeted public authorities, critical infrastructure, energy sector, telecommunications networks, state registries, and private businesses in Ukraine and beyond .

Ukraine highlights that it continues to witness hybrid campaigns combining cyber operations, disinformation, and economic coercion that seek to undermine international peace and security. These campaigns, combined with rapid technological developments including AI and quantum technologies, create unprecedented challenges for the international community.

Ukraine stated that it continues to witness hybrid campaigns combining cyber operations, disinformation, and economic coercion that seek to undermine international peace and security . Ukraine noted that rapid technological developments including artificial intelligence, quantum technologies, and increasingly interconnected digital ecosystems create unprecedented opportunities for innovation while simultaneously expanding the attack surface available to malicious actors .

Ukraine argues that malicious ICT activities are not isolated incidents but form part of broader strategies that combine cyberattacks with kinetic strikes, disinformation campaigns, and other hybrid warfare tools. Over time, Russia's cyber operations have evolved from destructive attacks into sophisticated campaigns involving cyber espionage, long-term network persistence, supply chain compromise, and information manipulation.

Ukraine stated that Russian malicious ICT activities are not isolated incidents but form part of a broader strategy that combines cyberattacks with kinetic strikes, disinformation campaigns, and other hybrid warfare tools . Ukraine noted that over time, Russia's cyber operations have evolved from destructive attacks into sophisticated campaigns involving attempts for cyber espionage, long-term network persistence, supply chain compromise, and information manipulation .

Chile argues that the protection of critical infrastructure represents both a national priority and an essential component of international security in the use of ICTs. The gradual digitisation and interconnection of critical sectors increases the possibility of attacks and the risk of cyber incidents having systemic effects, impacting the provision of essential services.

Chile stated that for Chile, the protection of critical infrastructure represents a national priority and an essential component of international security in the use of ICTs . Chile noted that the gradual digitisation and interconnection of critical sectors increases the possibility of attacks and the risk of cybernetic incidents having systemic effects, impacting the provision of services that are essential for the population .

Chile notes that AI is changing the reach of malicious cyber attacks and making it easier for them to adapt, contributing to the expansion of phishing attacks, malicious software, and increasing the sophistication of cyber attacks. AI must be understood as having the potential to multiply existing threats and as a source of new risk factors and vectors.

Chile stated that AI is changing the reach of malicious cybernetic attacks and making it easier for them to adapt, and that AI is contributing to the expansion of phishing attacks, malicious software, and increasing the sophistication of cybernetic attacks, as well as fostering the dissemination of manipulated content . Chile stated that AI must be understood as having the potential to multiply existing threats and also as a source of new risk factors and vectors .

Chile argues that it is necessary to keep attention on ransomware and other destructive forms of malicious software, the exploitation of the digital supply chain, cloud-connected software, and future risks related to quantum computing. These topics have already been identified by Chile as requiring continued attention.

Chile stated that it is necessary to dedicate attention to ransomware and other destructive forms of malicious software, the exploitation of the digital supply chain, cloud-connected software, and future risks related to quantum computing, amongst others, and that these topics have already been identified by Chile as requiring continued attention .

Chile argues that the dedicated thematic group focused on policies and cross-cutting issues provides a particularly valuable opportunity for driving regular, structured, evidence-based dialogue on the evolution of threats and their implications for international peace and security. This work should have a forward-looking approach and incorporate evidence and information from experts, regional organisations, the scientific community, and the private sector.

Chile stated that the dedicated thematic group number one gives a particularly valuable opportunity for driving regular, structured dialogue that is evidence-based on the evolution of threats and their implications for international peace and security . Chile stated that a substantive discussion on emerging threats requires incorporating evidence and information that very often lies outside of government, and that the participation of experts, regional organisations, the scientific community, the private sector, and other interested parties is essential .

Malawi highlights that malicious ICT activities are becoming increasingly sophisticated, persistent, and transnational, with the growing misuse of AI, ransomware, supply chain compromises, attacks on critical infrastructure, and attacks on undersea cables and cloud services demonstrating that no state is immune.

Malawi stated that malicious ICT activities are becoming increasingly sophisticated, persistent, and transnational, and that the growing misuse of artificial intelligence, ransomware, supply chain compromises, attacks on critical infrastructure, computer emergency response teams, undersea cables, and cloud services demonstrates that no state is immune .

Malawi argues that the global mechanism's work should prominently feature the strengthening of national computer emergency response teams, enhancing cyber threat intelligence, promoting early warning mechanisms, and improving trusted information sharing. Resilient response capabilities are just as important as resilient infrastructure.

Malawi stated that strengthening national computer emergency response teams, enhancing cyber threat intelligence, promoting early warning mechanisms, and improving trusted information sharing should feature prominently in the work of the dedicated thematic group . Malawi stated that resilient response capabilities are just as important as resilient infrastructure .

Malawi recognises both the opportunities and risks of AI, noting that while AI can significantly strengthen cyber defence, it is also lowering the barriers for malicious actors to conduct phishing, malware development, fraud, and disinformation at unprecedented speeds and scale. Discussions should focus on enabling responsible innovation while preventing malicious use.

Malawi stated that AI is lowering the barriers for malicious actors to conduct phishing, malware development, fraud, and disinformation at unprecedented speeds and scale . Malawi stated that discussions should focus on enabling responsible innovation while preventing malicious use .

France reports that on 13 July it announced it had been the target for more than ten years of persistent cyber attacks carried out by Russia's Federal Security Service (FSB). France emphasises that this attribution process was conducted in accordance with the norms for responsible state behaviour and following having exhausted appropriate channels.

France announced that on 13 July, France announced that it had been the target for more than 10 years of persistent cyber attacks carried out by the Russian Federal Security Service, the FSB . France stated that contrary to what the Russian Federation has stated, this attribution process was conducted in accordance with the norms for responsible state behaviour and following having exhausted appropriate channels .

France identifies AI as increasing the speed at which malicious actors can conduct offensive operations and enabling the scaling up of existing practices such as seeking vulnerabilities. More importantly, the rapid increase in cyber capabilities of AI frontier models carries the risk of creating a new digital divide between those who have access to these models and those who do not.

France stated that while AI is not yet fundamentally altering the nature of attacks, it is increasing the speed at which malicious actors can conduct offensive operations and enabling the scaling up of existing practices such as seeking vulnerabilities . France stated that the rapid increase in cyber capabilities of AI frontier models carries the risk of a new digital divide between those who have access to these models and those who are able to independently assess the risks associated with them .

France identifies the uncontrolled proliferation of cyber intrusion capabilities available on the market as a veritable ticking time bomb. Without minimal oversight and accountability measures, the number of actors, including non-state actors, capable of acquiring advanced capabilities will continue to grow, multiplying risks to the stability of cyberspace.

France stated that without minimal oversight and accountability measures, the number of actors, including non-state actors, capable of acquiring advanced capabilities will continue to grow, multiplying the risks to the stability of cyberspace . France shared progress made with the United Kingdom as part of the Pall Mall process, including the launch of negotiations on guidelines for the cyber intrusion industry .

Germany highlights that ransomware attacks have paralysed not only government and critical infrastructure providers but also not-for-profit organisations, including a leading humanitarian organisation providing food relief in conflict regions, putting people's lives abroad at risk.

Germany stated that over the past year, it has experienced a continuously high level of ransomware attacks targeted especially at critical infrastructure providers, municipal and government services, and not-for-profit organisations . Germany cited a specific example of a ransomware attack that paralysed a leading humanitarian organisation providing food relief in conflict regions, with risks of famine and putting people's lives abroad at risk .

Germany reports that together with the European Union and its member states and the North Atlantic Council, it has exposed and condemned a series of malicious cyber activities conducted by Russian state actors, in particular the FSB, and by state-supported cyber criminal and hacktivist groups. These activities targeted government entities and critical infrastructure in several EU member states and in Ukraine.

Germany stated that together with the European Union and its member states and the North Atlantic Council, Germany exposed and condemned a series of malicious cyber activities conducted by Russian state actors, in particular the FSB, and by state-supported cyber criminal and hacktivist groups . Germany noted that these activities targeted government entities and critical infrastructure in several EU member states and in Ukraine, some of which had the potential for catastrophic damage of civilian energy infrastructure such as electricity networks or hydroelectric dams .

Germany observes that the advent of advanced AI facilitates large-scale attacks including language-agnostic credible phishing, voice phishing, and social engineering attacks, continuously lowering the barrier to entry for opportunistic malicious cyber actors. This creates an increasing strain on defenders' resources and puts particular strain on less resourced and small countries.

Germany stated that the advent of advanced cyber capabilities facilitates large-scale attacks including language-agnostic credible phishing, voice phishing, and social engineering attacks, and that the barrier to entry for opportunistic malicious cyber actors is continuously lowered . Germany noted an increasing strain on defenders' resources and on maintainers of open source repositories, which puts particular strain on less resourced and small countries .

Latvia reports that cyber threats have become persistent challenges affecting national security, economic stability, and social cohesion, with a recent ransomware attack on state information systems serving as a reminder of this reality. Ransomware remains one of the most pervasive threats, with criminal groups having developed industrial-scale operations.

Latvia stated that in Latvia, a recent ransomware attack on state information systems once again reminded them of the reality of cyber threats . Latvia stated that ransomware remains one of the most pervasive threats, with criminal groups having developed industrial-scale operations leveraging encryption, infostealer malware, data theft, and extortion to generate enormous profits .

Latvia highlights that criminal groups have developed industrial-scale ransomware operations, leveraging encryption, infostealer malware, data theft, and extortion to generate enormous profits. State-linked cyber operations also pose significant risks, with incidents targeting electoral systems, public administration, and critical infrastructure.

Latvia stated that criminal groups have developed industrial-scale operations, leveraging encryption, infostealer malware, data theft, and extortion to generate enormous profits . Latvia also noted that state-linked cyber operations pose significant risks, with incidents targeting electoral systems, public administration, and critical infrastructure raising concerns about the potential for destabilisation .

Latvia highlights that AI is transforming the cyber threat landscape as a whole, with AI-enabled tools capable of automating reconnaissance, accelerating and scaling vulnerability discovery, and generating highly convincing phishing campaigns. The access to and ease of use of AI-enabled tools supercharges the potential vectors and scale of malicious cyber activities, which can overwhelm cyber defenders' capacity to respond.

Latvia stated that AI-enabled tools can automate reconnaissance, accelerate and scale vulnerability discovery, and generate highly convincing phishing campaigns . Latvia stated that the access to and ease of use of AI-enabled tools supercharges the potential vectors and scale of malicious cyber activities, which can overwhelm cyber defenders' capacity to respond .

Latvia argues that the dedicated thematic groups should be central to achieving an action-oriented approach, focusing on specific ICT security challenges and enabling states to examine threats, share experience, and develop practical approaches. The DTGs should also help turbocharge capacity-building efforts, recognising that global cyber resilience depends on ensuring all states can protect their digital infrastructure.

Latvia stated that the DTGs should focus on specific ICT security challenges, enabling states to examine threats, share experience, and develop practical approaches . Latvia stated that the DTGs should also be focused on the development of new technologies and help turbocharge capacity-building efforts, recognising that global cyber resilience depends on ensuring that all states can protect their digital infrastructure .

Israel asserts that its actions during operations Rising Lion and Roaring Lion were conducted in accordance with international law, including the UN Charter and the laws of armed conflict, in the context of an ongoing armed conflict with Iran. Israel argues that Iran has been waging hostility against Israel across all domains of warfare, including the cyber domain.

Israel stated that its actions during operations Rising Lion and Roaring Lion were conducted in accordance with international law, including the UN Charter and the laws of armed conflict, and were carried out in the context of an ongoing armed conflict with Iran . Israel stated that Iran has been waging against Israel, together with its non-state terrorist armed groups and proxies, while bluntly violating international law .

Israel identifies as a substantial threat the absolute impunity granted by certain states to criminal syndicates and terrorist proxies offering hacking as a service, which operate from state-sanctioned safe havens. Israel also highlights the illicit financing of these operations via digital assets as a global trend that should preoccupy the global mechanism's discussions.

Israel stated that another substantial threat is the absolute impunity granted by certain states to criminal syndicates and terrorist proxies offering hacking as a service, which operate from state-sanctioned safe havens . Israel noted that the illicit financing of these operations via digital assets is a global trend which should preoccupy the global mechanism discussions, including on international cooperation relating to tracking, freezing, and seizing of cryptocurrencies used for illicit activities .

Canada highlights that frontier AI models have displayed unprecedented capabilities in autonomous vulnerability discovery, zero-day vulnerability exploit generation, and multi-stage orchestration of malicious cyber activity. Canada notes a joint statement issued by cybersecurity agencies of Canada, the United States, the United Kingdom, New Zealand, and Australia on the risks posed by rapidly accelerating offensive and defensive capabilities of frontier AI models.

Canada noted the joint statement issued by the cybersecurity agencies of Canada, the United States, the United Kingdom, New Zealand, and Australia on the risks posed by rapidly accelerating offensive and defensive capabilities of frontier AI models to the security of information technology and critical infrastructure worldwide . Canada stated that these models have displayed unprecedented capabilities in autonomous vulnerability discovery, zero-day vulnerability exploit generation, and multi-stage orchestration of malicious cyber activity .

Canada observes that cyber threats to its critical infrastructure are almost certainly increasing, with primary threats coming from cyber criminals, state-sponsored actors, and increasingly non-state actors. Canada also notes the growing threat from large-scale covert networks of internet-connected devices used to disguise the origins and attributions of cyber attacks.

Canada stated that in Canada, cyber threats to critical infrastructure are almost certainly increasing, and that primary threats to these systems come from cyber criminals, state-sponsored actors, and increasingly non-state actors . Canada noted that it has joined the United Kingdom Joint Cyber Advisory on defending against state-linked covert networks, which warns of large-scale covert networks of internet-connected devices being used to disguise the origins and attributions of cyber attacks .

Indonesia reports that the landscape of existing and potential ICT threats continues to evolve rapidly, with growing sophistication of malicious activities including advanced persistent threats, ransomware, and phishing posing serious risks. Threats targeting critical infrastructure and critical information infrastructure have intensified, reflecting constant and relentless pressures on national and regional stability.

Indonesia stated that the growing sophistication of malicious activities, including advanced persistent threats, ransomware, and phishing activities, poses serious risks . Indonesia noted that threats targeting critical infrastructure and critical information infrastructure, including cross-border systems, have intensified, not only periodically but every single day, reflecting constant and relentless pressures on national and regional stability .

Indonesia highlights that emerging technologies such as artificial intelligence and quantum computing further complicate the threat landscape by lowering barriers to malicious activity while simultaneously creating new dependencies and vulnerabilities. A threat environment of this scale and complexity requires the global mechanism to prioritise practical, needs-based support.

Indonesia stated that emerging technologies such as artificial intelligence and quantum computing further complicate the threat landscape, lowering barriers to malicious activity while simultaneously creating new dependencies and vulnerabilities .

Indonesia argues that cooperation among states, including through ASEAN, OIC, and Asia-Pacific mechanisms, is indispensable for building resilience through threat analysis, shared early warning arrangements, and structured exchange on incident trends. Strengthening cooperation among CERTs and improving information sharing mechanisms are essential to building resilience.

Indonesia stated that the global mechanism, including its DTGs, should focus on fostering cooperation in threat analysis, shared early warning arrangements, and structured exchange on incident trends to ensure that developing countries are not left behind . Indonesia noted that it is actively participating in regional and international mechanisms including ASEAN, OIC, and Asia-Pacific mechanisms for technical information sharing, coordinated incident response, and joint capacity building .

Thailand is deeply concerned by the increasing number and sophistication of cyber threats, particularly those targeting critical infrastructure and critical information infrastructure. Malicious actors, including advanced persistent threat groups, are employing increasingly sophisticated techniques that pose serious risks to national security, economic stability, and the delivery of essential public services.

Thailand stated that its national assessment for 2025 indicates a continued rise in cyber incidents, especially those involving information content security, cyber fraud, and intrusion attempts . Thailand noted that malicious actors, including advanced persistent threat groups, are employing increasingly sophisticated techniques that pose serious risks to national security, economic stability, and the delivery of essential public services .

Thailand highlights that ICT supply chain disruptions, including the deliberate insertion of vulnerabilities, backdoors, or other forms of interference, undermine economic and digital development, particularly in developing countries. Addressing these challenges requires strengthened international cooperation to ensure that emerging technologies are developed and used in a safe, secure, and responsible manner.

Thailand stated that ICT supply chain disruptions, including deliberate insertion of ICT-related threats, vulnerabilities, backdoors, or other forms of interference, undermine economic and digital development, particularly in developing countries . Thailand stated that addressing these challenges requires strengthened international cooperation to ensure that emerging technologies are developed and used in a safe, secure, and responsible manner .

Morocco describes the current threat landscape as characterised by the intensification of cyber attacks led by state and non-state actors, systematic targeting of critical infrastructure and essential services, proliferation of cybercrime service models facilitating large-scale attacks, misinformation campaigns, and the impact of emerging technologies including AI.

Morocco described the threat landscape as characterised by intensification of cyber attacks led by state and non-state actors with a transfer of capacity to criminal groups, systematic targeting of critical infrastructure, proliferation of cybercrime service models including ransomware and DDoS attacks, misinformation campaigns, and the impact of emerging technologies including AI .

Micronesia affirms that international law applies in cyberspace, and that respect for sovereignty, the prohibition on the threat or use of force, and human rights obligations must guide state conduct online as they do offline. Micronesia supports the voluntary consensus-based framework of norms for responsible state behaviour as fundamental to addressing both existing and potential ICT-related threats.

Micronesia affirmed that international law applies in cyberspace, and that respect for sovereignty, the provision on the threat or use of force, and human rights obligations must guide state conduct online as they do offline . Micronesia supported the voluntary consensus-based frameworks of norms for responsible state behaviour as fundamental to addressing both existing and potential ICT-related threats to international security .

Micronesia advocates for clear and rights-respecting definitions of disinformation, warning that vague approaches can suppress dissent and independent media, erode human rights, politicise enforcement, weaken trust in institutions, and disproportionately harm marginalised and remote communities. Micronesia urges states to adopt precise, time-bound, and rights-based definitions of disinformation.

Micronesia stated that vague approaches to disinformation can suppress dissent and independent media, erode human rights, politicise enforcement, weaken trust in institutions, and disproportionately harm marginalised and remote communities, while also impairing crisis response . Micronesia urged states to adopt precise, time-bound, and rights-based definitions of disinformation .

Malaysia reports that malicious cyber activities continue to impact governments, businesses, and critical information infrastructure across a wide range of sectors, with advanced persistent threats and ransomware remaining among the most serious concerns. Malaysia's national monitoring shows that a large share of reported incidents involve critical information infrastructure.

Malaysia stated that its national monitoring shows that a large share of reported incidents involve critical information infrastructure, most notably across trade and industry, government, agriculture and plantations, defence and security, healthcare, as well as banking and finance . Malaysia stated that APTs, followed closely by ransomware, remain among its most serious concerns .

Malaysia highlights that it is preparing for the security implications of quantum computing, especially regarding current encryption systems, and is developing a national post-quantum cryptography migration plan focused on safeguarding critical information infrastructure. This work forms a core part of Malaysia's broader strategy to build long-term cyber resilience.

Malaysia stated that it is preparing for the security implications of quantum computing, especially regarding current encryption systems, and is currently developing a national post-quantum cryptography migration plan focused on safeguarding critical information infrastructure . Malaysia stated that this work forms a core part of its broader strategy to build long-term cyber resilience .

Malaysia argues that the mechanism's work under the threats pillar should focus on practical, grounded discussions that help states collectively better understand the threat landscape. This may include sharing national experiences on how states protect critical assets, handle APTs and ransomware, and manage the risks of emerging technologies.

Malaysia stated that its work under this pillar should focus on practical, grounded discussions that can help states collectively better understand the threat landscape, including sharing national experience on how states protect critical assets, handle the threats of APTs and ransomware, and manage the risk of emerging technologies .

Cameroon recognises that malicious ICT activities have become increasingly sophisticated, frequent, and consequential, posing a growing threat to international peace and security. These threats have tangible repercussions on the security and integrity of critical infrastructure, the stability of economies, and the delivery of essential public services.

Cameroon stated that as recognised in the consensus final report of the OEWG, malicious ICT activities have become increasingly sophisticated, frequent, and consequential, posing a growing threat to international peace and security . Cameroon noted that these threats have tangible repercussions on the security and integrity of critical infrastructure, the stability of economies, the delivery of essential public services, and the daily lives and well-being of populations .

Cameroon affirms support for the establishment of a Dedicated Voluntary Fund under the Global Mechanism as an essential instrument to support national cybersecurity institution building, provide resources for training and skills development, and facilitate participation in DTG meetings and capacity building programmes.

Cameroon affirmed support for the establishment of the Dedicated Voluntary Fund under the Global Mechanism as an essential instrument to support national cybersecurity institution building, provide resources for training and skills development, facilitate participation in DTG meetings, and capacity building programmes .

China argues that states should oppose acts of aggression through cyber means, respect each other's digital sovereignty, and uphold multilateralism to address risks effectively. China calls for the formulation of new international rules to address the impact of emerging technologies and prevent new domains from turning into lawless zones of zero-sum games.

China stated that states should oppose acts of aggression through cyber means, respect digital sovereignty, and promote development for all . China called for countries to respect each other's digital sovereignty, uphold multilateralism, and consider establishing global standards and systems for testing and assessing the risk of large AI models .

China highlights that a new generation of large AI models has demonstrated powerful cyber capabilities, both offensive and defensive, leading to global concern. China argues that the risk posed by AI is no longer merely theoretical but is now a real and immediate threat, making the work of the mechanism and its DTGs not optional but a responsibility.

China stated that not long ago, a new generation of large models issued by certain AI companies demonstrated powerful cyber capabilities, both offensive and defensive, which led to global concern . China stated that in the past, the risk posed by AI was merely theoretical, but now the real threats AI poses can be seen firsthand, making the mechanism including the DTG not an option but a responsibility .

Oman reports that cyber threats are growing in scale and sophistication, with AI being leveraged by terrorist groups which use malware including backdoors. Oman's Electronic Defence Centre has addressed many cyber threats and risks targeting national and governmental institutions, including 19 cyber incidents targeting private and public institutions.

Oman stated that cyber threats are growing in scale and sophistication and are used with the help of AI by terrorist groups which use malware including backdoors . Oman noted that its Electronic Defence Centre has addressed many cyber threats and risks targeting national and governmental institutions, and had to address 19 cyber incidents targeting private and public institutions, leading to data breaches and disruption of information systems .

Mauritius reports that the cyber threat landscape continues to evolve at an unprecedented pace, with cyber criminals increasingly leveraging emerging technologies including AI to conduct more sophisticated and targeted malicious cyber activities. Mauritius is particularly concerned by cyber incidents affecting critical information infrastructure and essential services.

Mauritius stated that cyber criminals are increasingly leveraging emerging technologies, including artificial intelligence, to conduct more sophisticated and targeted malicious cyber activities . Mauritius stated that it is particularly concerned by cyber incidents affecting critical information infrastructure and essential services, malicious activities conducted through social media platforms, phishing and online fraud targeting individuals and businesses, identity theft, online financial scams, data breaches, and DDoS attacks .

Mauritius is concerned about the growing risks posed by the malicious use of AI to generate convincing deepfakes, clone voices, spread disinformation, and enable sophisticated forms of fraud including cryptocurrency-related scams. Such misuse has the potential to facilitate cybercrime, undermine public trust, compromise the integrity of information, and disproportionately impact vulnerable groups.

Mauritius stated that it is mindful of the growing risks posed by the malicious use of artificial intelligence to generate convincing deepfakes, clone voices, spread disinformation, and enable sophisticated forms of fraud, including cryptocurrency-related scams . Mauritius stated that such misuse has the potential to facilitate cybercrime, undermine public trust, compromise the integrity of information, and disproportionately impact vulnerable groups, including children and older persons .

Mauritius highlights that the malicious use of AI to generate deepfakes, clone voices, spread disinformation, and enable sophisticated fraud disproportionately impacts vulnerable groups including children and older persons. This misuse has the potential to facilitate cybercrime and undermine public trust.

Mauritius stated that the malicious use of artificial intelligence to generate convincing deepfakes, clone voices, spread disinformation, and enable sophisticated forms of fraud, including cryptocurrency-related scams, has the potential to facilitate cybercrime, undermine public trust, compromise the integrity of information, and disproportionately impact vulnerable groups, including children and older persons .

The Republic of Korea reports that malicious cyber activities are becoming increasingly sophisticated, complex, and difficult to detect and respond to. The rapid advancement of frontier AI models has further transformed the cyber threat landscape, enabling increasingly sophisticated cyber operations while raising concerns that existing cyber defence mechanisms may become less effective.

The Republic of Korea stated that malicious cyber activities are becoming increasingly sophisticated, complex, and difficult to detect and respond to . The Republic of Korea noted that since the adoption of the OEWG final report, the rapid advancement of frontier AI models has further transformed the cyber threat landscape, enabling increasingly sophisticated cyber operations while raising concerns that existing cyber defence mechanisms may become less effective .

The Republic of Korea argues that the global mechanism should deepen discussions on AI-enabled cyber threats and ensure that international dialogue remains timely and responsive to the rapidly changing technological environment. The rapid advancement of frontier AI models has further transformed the cyber threat landscape beyond what was recognised in the OEWG final report.

The Republic of Korea stated that the global mechanism should deepen discussions on AI-enabled cyber threats and ensure that international dialogue remains timely and responsive to the rapidly changing technological environment .

The Republic of Korea highlights that ransomware and cryptocurrency theft have become major sources of financing for illicit activities, including illicit arms trafficking and the development of weapons of mass destruction. The global mechanism should continue and deepen discussions on this issue, reaffirming that such activities threaten international peace and security.

The Republic of Korea recalled that the final reports of the OEWG recognised cryptocurrency theft as a threat with implications for international peace and security . The Republic of Korea stated that ransomware and cryptocurrency theft have become major sources of financing for illicit activities, and that states should reaffirm that such activities threaten international peace and security, especially when linked to illicit arms trafficking or the development of weapons of mass destruction .

The Republic of Korea argues that the global mechanism should deepen discussions on AI-enabled cyber threats and ensure that international dialogue remains timely and responsive to the rapidly changing technological environment. The mechanism should serve as a platform for sustained and in-depth discussion on the evolving threat landscape.

The Republic of Korea stated that the global mechanism should deepen discussions on AI-enabled cyber threats and ensure that international dialogue remains timely and responsive to the rapidly changing technological environment . The Republic of Korea stated that the global mechanism should be a platform for sustained and in-depth discussion on the evolving threat landscape, enabling member states to strengthen collective understanding and enhance collective capacity to prevent, respond to, and recover from cyber threats .

Ghana highlights that the damage to Submarine Cable 7 Ghana in 2024 and the resulting disruption to digital services reinforced the importance of protecting such infrastructure as a strategic national asset. Ghana has identified 13 critical information infrastructure sectors under its Cybersecurity Act 2020 and is strengthening its national incident response architecture.

Ghana stated that the damage to Submarine Cable 7 Ghana in 2024 and the resulting disruption to digital services reinforce the importance of protecting such infrastructure as a strategic national asset . Ghana noted that it has identified 13 critical information infrastructure sectors under the Cyber Security Act 2020, which provides for the registration of critical information infrastructure, establishes obligations for operators, and requires regular compliance audits .

Iraq expresses concern at the increasing cyber activities targeting civilian critical infrastructure, including the energy, telecommunications, and financial sectors, and the serious humanitarian and economic effects that may result, particularly for developing countries that continue to face challenges in strengthening their national cybersecurity capacities.

Iraq stated that it wishes to express concern at the increasing cyber activities targeting civilian critical infrastructure, including the energy, telecommunications, and financial sectors, and the serious humanitarian and economic effects that may result therefrom, particularly for developing countries that continue to face challenges in strengthening their national capacities in the field of cybersecurity .

Iraq highlights the growing risks arising from the exploitation of ICTs by terrorist groups, including the use of cyberspace for recruitment, dissemination of extremist ideology, financing, planning, and coordination of terrorist operations, as well as the targeting of critical infrastructure. Drawing on Iraq's national experience in combating terrorism, Iraq affirms the importance of confronting these unlawful uses.

Iraq stated that it wishes to affirm the growing risks arising from the exploitation of ICTs by terrorist groups, including the use of cyberspace for recruitment, the dissemination of extremist ideology, financing, planning, and coordination of terrorist operations, as well as the targeting of critical infrastructure . Iraq stated that drawing on its national experience in combating terrorism, it affirms the importance of confronting these unlawful uses .

Iraq argues that strengthening the security of ICT supply chains and exchanging relevant international best practices and standards constitute an important element in reducing cross-border cyber risks. Addressing these threats requires strengthening international cooperation, exchanging information and expertise, and supporting the development of new technologies.

Iraq stated that strengthening the security of information and communications technology supply chains and exchanging relevant international best practices and standards constitute an important element in reducing cross-border cyber risks . Iraq affirmed that addressing these threats requires strengthening international cooperation, exchanging information and expertise, and supporting the development of new technologies .

Poland reports that a sustained pattern of malicious cyber activity by Russian actors has been observed in Poland since at least 2010, with Russia's security services undertaking actions to gain unauthorised access to sensitive networks and exfiltrate protected information from government, armed forces, and private entities. These activities include strategic reconnaissance, prepositioning, and disruptive sabotage operations targeting Polish critical infrastructure.

Poland stated that since at least 2010, Russia's security services have undertaken actions to gain unauthorised access to sensitive networks and to exfiltrate protected information from government, Polish armed forces, and private entities . Poland noted that malicious cyber actors have engaged in deliberately establishing persistent footholds within critical systems with apparent intent to enable future disruptive or destructive effects against basic and essential civilian services .

Mozambique argues that sustainable cybersecurity requires strong institutions, skilled professionals, trusted partnerships, and effective international cooperation. Capacity building should be predictable, sustainable, demand-driven, and accompanied by technology transfer, institutional strengthening, and equitable access to knowledge and expertise.

Mozambique stated that sustainable cybersecurity requires strong institutions, skilled professionals, trusted partnerships, and effective international cooperation to address increasingly sophisticated and transnational cyber threats . Mozambique stated that capacity building should be predictable, sustainable, demand-driven, and accompanied by technology transfer, institutional strengthening, and equitable access to knowledge and expertise .

Mozambique expects the global mechanism to become an implementation-oriented platform that translates agreed commitments into tangible outcomes, particularly for developing countries. The mechanism should strengthen collective preparedness to address existing and emerging ICT threats, including ransomware attacks against critical infrastructure and the malicious use of AI.

Mozambique stated that it expects the mechanism to become an implementation-oriented platform that translates agreed commitments into tangible outcomes, particularly for developing countries . Mozambique stated that the mechanism should strengthen collective preparedness to address existing and emerging ICT threats, including ransomware attacks against critical infrastructure, the malicious use of artificial intelligence, and other rapidly evolving cyber risks that increasingly affect developing countries .

The Chair requests that delegations keep their statements concise and submit full versions electronically, in order to ensure that all 30 remaining speakers on the list can be heard. This procedural guidance is aimed at balancing inclusivity with the practical constraints of conference time.

The Chair indicated that while there is no established limit for delivering statements, it would be appreciated if delegations could deliver an abridged version and submit the full statement to eStatements and to the chair's team, as this would help ensure all delegations are heard . The Chair also noted that a timer would be projected on the screen .

The Chair clarifies that delegations wishing to exercise a right of reply should make their request to the Secretariat so that speaking time can be allocated at the end of the list of speakers, as was done in prior meetings. This ensures that the substantive discussion is not interrupted by political exchanges.

The Chair noted that the right of reply should be done at the end of the meeting, and that any delegation wishing to speak under the right of reply should make the request to the Secretariat so that speaking time can be requested at the end of the list of speakers, as was done in prior meetings of this group .

The Chair announces the closure of the speakers' list for new inscriptions, noting that the list has grown longer than predicted and risks preventing the meeting from addressing other agenda items. This decision is taken to protect the integrity of the overall programme of work.

The Chair asked the Secretariat to close the list of speakers for inscriptions, noting that since the previous day the list had continued to grow much longer than predicted, which could impact the ability to address other items on the agenda . The Chair noted that there were 21 speakers still on the list with only one hour and forty minutes remaining .

The Chair announces that as soon as the current agenda item on existing and potential threats is completed, the meeting will immediately move to the next agenda item on voluntary norms for responsible state behaviour in cyberspace. This signals the Chair's intention to maintain momentum and cover all substantive items.

The Chair stated that as soon as the threats agenda item is completed, the meeting will immediately begin the next agenda item, which is the voluntary norms for responsible state behaviour in cyberspace and forms of implementation, recognising that over time additional norms may be elaborated . The Chair asked delegations to be ready .