In this article, we consider the state estimation problem for nonlinear cyber–physical systems with non‐Gaussian process noises under actuator false data injection attacks from the perspective of defenders. The process noises and actuator false data injection attacks herein are regarded as non‐Gaussian noises. Then, the prior density of the state is considered as a sum of Gaussians with unknown covariance matrixes. The partial variational Bayesian method is applied to approximate the unknown covariance matrixes, and the unscented Gaussian sum filter is used for state estimation as well as decreasing the computing complexity. Finally, some simulation results are presented to show the effectiveness of the proposed state estimation method.