The UK’s National Cyber Security Centre (NCSC) has issued an alert over a new ‘zero-click’ threat campaign being waged by Russian state-backed hackers.

The advisory, published in collaboration with international partners, warned ‘beehive’ attacks by the ‘Laundry Bear’ threat group aim to steal email correspondence at organizations operating across a range of critical sectors.

This includes organizations in the defense, education, energy, and technology industries, as well as law enforcement and government agencies.

Attacks against these organizations all have a common theme, according to the NCSC, mainly the use of Zimbra Collaboration Suite (ZCS) software. Targeting focuses specifically on those using vulnerable versions of the software, the advisory noted.

Rather than requiring users to click a link or open a file, zero-click attacks mean users only have to view a malicious email to be compromised.

The NCSC urged organisations that use ZCS to follow mitigation advice, patch immediately, and “improve network monitoring capabilities”.

Crucially, analysis of the campaign found these techniques could be adapted to exploit vulnerabilities in other email software applications used by Western organizations.

“This phishing campaign demonstrates how hostile actors will ruthlessly adapt techniques and exploit vulnerable technology in pursuit of their aims to steal sensitive information from Western organizations,” said NCSC chief operating officer (COO) Beth Hopkins.

Ukrainian organizations used in testing

According to the NCSC, the techniques used by Laundry Bear were “extensively trialled” on Ukrainian victims before use against other Western nations. The security agency noted this is part of a growing trend among Russian threat groups.

Notably, technical analysis of the campaign also highlighted the use of AI in development of a “simple codebase” used during operations.

Zero-click attacks have surged in frequency over the last 12 months, research shows, with threat actors accelerating efforts to capitalize on vulnerabilities.

Analysis from Rapid7 found that vulnerability exploitation has now surpassed social engineering as the “largest initial access vector”, accounting for more than one-third (38%) of all attacks.

More than 50% of all exploited vulnerabilities involved zero-click attacks, rather than network-facing vulnerabilities, the study noted, highlighting evolving techniques by threat actors.

“These types of vulnerabilities require no authentication and no user interaction, giving attackers rapid pathways into exposed systems and edge infrastructure,” Rapid7 noted.

Dray Agha, senior manager of security operations at Huntress, said these types of exploits are a “worst-case scenario for defenders” as potential victims are only required to view malicious emails.

“Simply viewing the email in a vulnerable client triggers the compromise,” he explained. “This completely bypasses traditional employee security training and gives state-backed hackers a silent, invisible backdoor into sensitive communications without the victim ever making a mistake.”

Agha said the rise of these techniques mean organizations need to place a greater focus on regular patching to avoid falling prey.

“This is why defense-in-depth is advised, as where the human security layer is porous, the technical defensive layer can step in,” he said.

“Organizations shouldn’t just rely on their staff acting as a ‘human firewall’. Rapid software patching, coupled with layered technical defenses, is the only reliable safety net against modern state-sponsored threats.”

FOLLOW US ON SOCIAL MEDIA

The National Cyber Security Centre (NCSC) has urged UK organizations to remain vigilant for attacks waged by Russian state-backed hackers.

As part of an advisory published in collaboration with 18 other agencies, the cybersecurity center specifically highlighted techniques employed by Russian FSB’s Centre 16 threat actors.

The group has been “opportunistically” targeting vulnerable routers and critical national infrastructure globally in recent months, the advisory warns.

Centre 16 goes by a number of names, including Berserk Bear, Static Tundra, and Ghost Blizzard, according to the NCSC. The group primarily uses SNMP (Simple Network Management Protocol) scans to locate and compromise vulnerable routers.

The group has also been observed exploiting vulnerabilities in Cisco devices, web portal flaws, and vulnerabilities in Cisco’s Smart Install (SMI) feature to seize network devices.

The advisory comes as the UK government implements sanctions against 24 individuals and entities behind “destructive cyber and hybrid operations” which have employed criminal groups via proxy networks.

Jonathon Ellison, NCSC Director of National Resilience, said these activities require organizations to remain in a heightened state of vigilance moving forward.

“The NCSC, alongside our international partners, have repeatedly exposed the advanced tools and coordinated campaigns of Russian cyber actors who persistently seek to exploit any vulnerability they encounter,” he said.

“Today’s joint advisory provides decisive, actionable directions from the global security community that network defenders should implement to protect against Russian Intelligence operations and secure the UK’s critical infrastructure.”

Russian hackers targeting key sectors

Organizations across a host of sectors worldwide are at risk from the group, according to the advisory.

Those operating in the communications, energy, healthcare, defense, and financial services industries in particular are firmly in Centre 16’s crosshairs.

The security agency urged organizations in these domains to take action immediately. This includes disabling the use of legacy SNMP versions and switching to SNMPv3 to lower their risk of compromise.

Similarly, organizations are advised to implement “strong and unique passwords for network devices, and restrict access to management protocols”.

Call to action

In addition to basic defensive measures, the NCSC also encouraged at-risk organizations to obtain Cyber Essentials certification.

This is a government-backed initiative for organisations to show they meet the recognized minimum standards for cybersecurity.

Organizations can also make use of the Cyber Assessment Framework, allowing them to audit their security capabilities, operational maturity, and bolster cyber resilience techniques.

“I’d strongly encourage all organisations, especially those entrusted with UK critical networks, to adopt these recommended measures immediately, thereby reducing the risk of compromise,” Ellison commented.

Repeated warnings

This isn’t the first warning issued by the NCSC over Centre 26 activities in recent years. The security agency, alongside international counterparts, attributed the December 2025 attack on Poland’s energy grid to the unit.

Various subunits and techniques employed by Centre 16 have also been exposed over the last three years. The security agency called out a Centre 16 unit known as ‘Turla’ in 2023 over the deployment of Snake malware, for example.

The malware strain has been a key component of Russian-backed espionage campaigns for nearly two decades, the NCSC said at the time.

A similar advisory that year also shed light on a group known as Star Blizzard. The NCSC said this particular subunit of Centre 16 was actively interfering in UK politics and democratic processes.

FOLLOW US ON SOCIAL MEDIA

The UK government said more than 60 businesses have signed up for its Cyber Resilience Pledge so far, including M&S, Nationwide, ITV, Microsoft UK, and Cloudflare.

Announced in May, the voluntary scheme sees businesses committing to three concrete actions to improve cybersecurity capabilities.

They must commit to making cyber security a board-level responsibility, by implementing the Cyber Governance Code of Practice and ensuring all board members complete the NCSC’s Cyber Governance Training.

They must also register for the NCSC’s free Early Warning service, a tool that alerts organizations to potentially suspicious activity on their networks, and commit to taking a risk-based approach to requiring the government-backed Cyber Essentials certification across their supply chain.

The pledge has been designed primarily for medium and large organizations, with other signatories including Deloitte, Accenture UK, Vodafone Group, and VodafoneThree, but is open to businesses of all sizes and from all sectors.

"Today, some of Britain’s biggest businesses are taking action to strengthen their cyber defences and setting a powerful example for others to follow. By signing this pledge, they are showing that cyber resilience is no longer just an IT issue - it is a business imperative," said technology secretary Liz Kendall.

"The steps in this pledge are practical, achievable and proven to make a difference. Today’s signatories are leading the way, and I encourage organizations across the UK to follow their example."

Cyber Charter to beef up critical services

Alongside the pledge, the government has been developing a Cyber Charter for 39 companies designated as strategic suppliers for delivering critical services to the government.

These organizations have been invited to sign the pledge as an initial commitment to bolstering their cyber resilience, although so far only a little more than half have done so.

"We have long held the view that cyber resilience is a critical business and organizational enabler. It underpins our growth, our economic security, and the safety and security of our people," said Julian David, CEO of techUK.

"With the average cost of significant cyber-attacks to the UK economy recently estimated to be £14.7 billion annually – the equivalent of 0.5% of our GDP – it’s clear that cyber security and resilience must be recognised as a leadership responsibility and should no longer be viewed as an IT issue alone."

Pledge targets national resilience

Moves to bolster national resilience capabilities come amidst an increase in malicious cyber activity in the UK.

The National Cyber Security Centre (NCSC) recently confirmed it handled 204 nationally significant incidents in the year to September, up from 89 the year before.

The average cost of an attack on an individual UK business now stands at almost £195,000, with the annual cost to organizations estimated at £14.7 billion - and that’s in addition to the costs of wider economic disruption.

Last year, experts estimated that the attack on Jaguar Land Rover (JLR) cost the UK economy roughly £1.9 billion, making it the most costly cyber incident in British history.

FOLLOW US ON SOCIAL MEDIA

The overwhelming majority of cyber attacks on critical infrastructure are coming from hostile states, the UK's cyber chief has warned.

Speaking at the Royal United Services Institute's (RUSI) Annual Security Lecture, Richard Horne, CEO of the National Cyber Security Centre (NCSC), said the organization had handled more than 200 cyber incidents affecting the UK's critical national infrastructure and its supporting ecosystem over the last year. Around 75% were believed to be linked to state actors, particularly Russia, China, and Iran.

"We know that adversaries are prepositioning today, establishing footholds within technology that underpins critical national infrastructure that could enable rapid exploitation, to cause mass disruption in a time of conflict," he said.

"The highest profile example of this was a campaign often referred to as Volt Typhoon against largely US critical national infrastructure, which was attributed in 2024. And we are seeing our critical infrastructure being targeted, regularly finding and stopping breaches, before their intent becomes clear."

Horne broke the threat down into 'near', 'mid,' and 'far' spaces, with the far space representing the adversary's home turf, systems, tooling, and networks. Here, he said, the UK and its allies bring pressure to bear through intelligence collection, sanctions, law enforcement action , and offensive cyber operations to disrupt and degrade their capability at source.

In the mid space, efforts are concentrated on hardening cloud, technology, and telecommunications infrastructure, and by disrupting adversary positions within those environments.

"The reality is much of this space is in private hands," he said. "Which means success here demands genuine collaboration between government and private sector, which is at the heart of our approach in the NCSC."

But, he said, it's the near space – the defense and resilience of the organizations and systems being targeted – where most action is probably required. The rise of AI is an important factor here, he said.

"Recent developments of frontier AI models have demonstrated their effectiveness at finding inherent vulnerabilities in the technology we rely on," he said.

"Our latest assessment shows that by 2028, it is highly likely that AI-Cyber capabilities will be used by attackers against known vulnerabilities in legacy technology in our critical national infrastructure."

British organizations should take note, said James Neilson, SVP of global at OPSWAT.

"The daily scale of hostile activity against the UK is vast, and until the NCSC revealed those figures, the threat and danger facing critical infrastructure was far greater than most businesses realized," he said.

"Many organizations neglect to secure data that moves in and out of their OT networks. By controlling data flows and scanning files in transit, organizations can detect and neutralise hidden malicious payloads before they infiltrate critical systems."

Horne called on organizations to strengthen cyber resilience by focusing on three core capabilities: understanding their exposure to threats, building stronger defences based on proven security fundamentals, and ensuring they can continue operating and recover quickly after an attack.

"By making our environment harder for adversaries to operate in, and engaging in the contest better, we can play an important part in altering potential adversaries' options and deterring conflict," he said.

The National Cyber Security Centre (NCSC) has urged organizations to review their dependencies in light of an increasing number of supply chain attacks.

Recent attacks, the agency noted, have included maintainer account compromise, where attackers steal credentials or tokens that allow a malicious actor to update a trusted package.

Attackers are also taking over ownership of expired domains connected to package maintainers, or otherwise transferring ownership of a previously legitimate package.

Meanwhile, typosquatting is on the rise, with packages published using similar names to the genuine article, or with the misspelling of popular legitimate packages in the hope they are installed by mistake.

Threat actors are also using credentials or tokens stolen from a previous attack to access or modify additional packages.

These risks arise because one single application may rely on a large number of third-party packages – including libraries, frameworks, snippets, software development kits - some of which may not be entirely trustworthy.

Node.js, Rust and Python, for example, are unusually exposed as they have minimal standard libraries, boosting the use of third-party dependencies and delegation of basic functionalities, and leading to a heavy reliance on external registries.

Many of these components are retrieved automatically through continuous integration and continuous delivery (CI/CD) pipelines, often without human intervention.

"It is this combination of automation, trust and scale which means that malicious code introduced into a single package can spread rapidly across many organisations and services before detection," the NCSC warned.

The NCSC warned that threat groups are actively targeting developer environments, which are usually less tightly controlled than managed corporate devices, making it easier to compromise and steal the credentials of shared code or package registries.

A single malicious package can spread quickly across downstream software products and services. Indeed, the impact of compromising a lesser known, but critical, software component can have a significant and far-reaching impact for many organizations and systems.

The NCSC highlighted Node.js in particular, as its highly modular packages depend on many smaller components.

CI/CD threats are rising

Meanwhile, recent attacks have exploited the implicit trust in CI/CD and automation pipelines, where the automation of updates, installation, and execution of scripts and packages allows attackers to execute malicious code.

"For example, Node.js and Python support scripts that execute on installation, and allow a malicious package to be run immediately. Without human intervention or approval, the code can simply propagate," the NCSC warned.

Open publishing models increase exposure, with security controls for maintainer registry accounts not currently enforced by all registry providers.

Check your dependencies

The NCSC outlined a series of actions organizations are advised to take, including:

• Pause automatic dependency updates where compromise may be present
• Review and approve new updates, dependencies, or versions manually
• Rotate exposed or potentially exposed credentials
• Enforce MFA for developer and package registry accounts
• Use private or trusted registries where appropriate

"These attacks highlight the need to revisit how dependencies are introduced and managed, as part of a secure development lifecycle (SDLC)," the NCSC said.

"Whilst Node.js, Python and Rust are considered higher risk for these attacks, it’s important to be aware that other languages, tools, and package repositories are also at risk."

Developers should also make use of the Software Security Code of Practice, reviewing how dependencies are introduced and updated, avoiding automatically adopting new dependency versions without review, and striking a balance between deploying patches quickly and updating dependencies slowly.

This will help minimize the potential impact of compromise, according to the NCSC.

Elsewhere, they should also ensure deployments occur through controlled CI/CD pipelines rather than developer devices and store sensitive credentials securely, avoiding exposure on developer workstations.

"Modern software development has transformed how software is created, shared and reused – but recent attacks on these tools highlight the rapidly growing risks of using modern software ecosystems," the NCSC said.

"Whilst Node.js, Python and Rust are considered higher risk for these attacks, it’s important to be aware that other languages, tools, and package repositories are also at risk."

FOLLOW US ON SOCIAL MEDIA

Iran, Russia, China and other nation states represent the most serious cybersecurity threats to the UK today, according to Richard Horne, the CEO of the National Cyber Security Centre (NCSC).

Speaking at the CyberUK conference in Glasgow, Horne said that technological change and geopolitical tensions make for 'tumultuous uncertainty', with the agency already handling an average of four nationally significant incidents a week.

"Criminal activity such as ransomware remains the most prevalent threat to the vast majority of organizations, but the majority of the nationally significant incidents that my teams are handling now originate directly or indirectly from nation states," he said.

Horne warned that China’s intelligence and military agencies in particular now display an 'eye-watering' level of sophistication in their cyber operations, while Iran is almost certainly using cyber activity to support the repression of British individuals.

Russia, meanwhile, is using the tactics and techniques that it's honed in conflict against states it considers hostile, making cyber security the new 'home front'.

"We know that, were we to be in, or near, a conflict situation, the UK would likely face hacktivist attacks at scale. With similar effects and sophistication to the ransomware attacks we see today but no option to pay a ransom to help recover," he said.

These threats are combining with others to create a 'perfect storm', with frontier AI capabilities now rapidly enabling discovery and exploitation of existing vulnerabilities at scale.

Attackers are exposing gaps in the fundamentals of cybersecurity, such as code shipped by tech producers with significant vulnerabilities, organizations' failure to patch with the completeness or urgency they should, and a failure to replace legacy systems.

NCSC sounds alarm on quantum threats

Meanwhile, quantum is a looming threat, Horne told attendees. The warning comes amid rising concerns about ‘Q-Day’, the point at which quantum computers can crack traditional encryption methods.

Google, for example, recently revised its timeline for this tipping point to within just three years. Predictions on this front vary wildly, however, ranging from within a few years to decades.

"We don’t know when a quantum computer will be able to break the widely used cryptography that we rely on in everything we do. But we do know it is in our gift to be ready for that point," he said.

He advised organizations to refer to NCSC guidance setting out what they need to do over the coming years to ensure successful migration to post-quantum cryptography.

More broadly, as the technology landscape develops the definition of cybersecurity expands with it. Efforts to shore up protections across a wider array of areas are being made globally, such as in operational technology (OT), typically used to control energy systems and production lines – both key targets for state-backed threat groups and hacktivists.

Ric Derbyshire, principal security researcher at Orange Cyberdefense, echoed Horne's concerns about politically-motivated hacktivist groups.

"Escalatory hacktivism is a phenomenon we are seeing in which groups align with state-backed narratives and contribute to their host state’s hybrid warfare efforts. This trend is set to become more pervasive and more impactful," he said.

"This is about societal resilience as much as cyber resilience. It will require stronger global collaboration, closer public-private coordination, and sustained legislative action, such as the Cyber Security and Resilience Bill, with a focus on protecting critical services and maintaining continuity in the face of disruption.”

FOLLOW US ON SOCIAL MEDIA

It's time to finally kill off passwords in favour of passkeys – and companies need to start offering them to login.

That's according to the UK's National Cyber Security Centre (NCSC), which is now advising consumers to use passkeys where available because they offer "stronger resilience" to cyber attacks and are easier to use.

Passkeys tie credentials to a specific device, including a smartphone or laptop, removing the need for text messages or email verification codes.

The NCSC sees this as more secure as hackers would need to intercept the code or steal the device itself for access. In a blog post, the security agency said this makes passkeys "phishing-resistant" by design.

While the NCSC has long persisted with passwords as its official preference, last year it began recommending users switch to passkeys or a password manager.

In a statement, the NCSC said it had stopped short of fully endorsing passkeys due to "some key implementation challenges", but pointed to progress within the industry.

Indeed, the shift to passkeys is well underway. As the agency noted, passkeys are widely supported and half of Google users in the UK have one set up.

"Adopting passkeys wherever you can is a strong step towards a safer, simpler login experience and I am pleased that we can now support uptake," said Jonathon Ellison, Director for National Resilience at the NCSC.

"The headaches that remembering passwords have caused us for decades no longer need to be a part of logging in where users migrate to passkeys – they are a user-friendly alternative which provide stronger overall resilience."

The NCSC said beyond better security and lower costs for companies, passkeys save a minute per login versus a username, password, and text verification code.

Industry push needed for passkeys

Of course, for that shift to happen, organizations need to step up and ditch passwords and SMS verification with passkeys.

“We strongly advise all organizations to implement passkeys wherever possible to enhance security, provide users with faster, frictionless logins and to save significant costs on SMS authentication," NCSC Chief Technical Officer Ollie Whitehouse said.

The government is hoping to achieve this later in the year across its own digital services. The NHS was one of the first government organizations in the world to offer passkeys for logins.

“The rollout of passkeys across GOV.UK services marks another major step forward in strengthening the UK’s digital defences while improving the user experience for millions," said AI and Digital Government Minister Feryal Clark.

Why passkeys?

Passkeys are framed as a key weapon in the fight against phishing attacks. Beyond being more resistant to these attempts, it will also help reduce the number of texts users have to wade through.

This has become a major problem, and one exacerbated by the rise of phishing as a service (PhaaS) platforms like Tycoon 2FA, as well as the rise of AI-generated phishing campaigns.

To help with passkey rollout, the NCSC has joined forces with the FIDO Alliance, which is working towards password-free authentication.

“We’re also very pleased that the NCSC has joined the FIDO Alliance, which allows agencies across the UK government to collaborate with other thought leaders in the Alliance to advance the development and deployment of foundational technologies that will strengthen our collective cyber resilience," said Executive Director and CEO of the FIDO Alliance Andrew Shikiar.

FOLLOW US ON SOCIAL MEDIA

The National Cyber Security Centre (NCSC) has uncovered two new Russian-linked campaigns aimed at harvesting login credentials from personal web and email services.

The APT28 group, also known as Fancy Bear or Forest Blizzard, has exploited vulnerable internet routers to enable Domain Name System (DNS) hijacking - allowing it to intercept traffic and steal sensitive data including passwords and access tokens.

In an advisory on 7 April, the security agency said the activity appears to be opportunistic in nature, starting with a scattergun approach to reach large numbers of potential victims. Thereafter, threat actors then narrow in on targets of interest as the attack develops.

Attackers redirect traffic through DNS servers under their control, with the resulting malicious DNS resolutions enabling adversary in the middle (AitM) attacks that harvest passwords, OAuth tokens, and other credentials for web and email related services.

The NCSC said it believes APT28 is almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Centre Military Intelligence Unit 26165.

This group is believed to have been behind an attack against the German parliament in 2015, which led to data theft and disrupted the email accounts of German members of parliament and the vice chancellor, as well as an attempted attack against the Organisation for the Prohibition of Chemical Weapons (OPCW) in 2018.

That particular attack was aimed at disrupting the independent analysis of chemicals weaponized by the GRU in the UK.

Microsoft issues separate alert

In a separate alert, Microsoft has issued a similar warning, saying that the group has been carrying out this activity since at least August 2025.

"By compromising edge devices that are upstream of larger targets, threat actors can take advantage of less closely monitored or managed assets to pivot into enterprise environments," it said.

"Microsoft Threat Intelligence has identified over 200 organizations and 5,000 consumer devices impacted by Forest Blizzard’s malicious DNS infrastructure."

SOHO routers targeted in campaign

The first cluster of activity identified by the NCSC saw the DHCP DNS server settings of compromised small office/home office (SOHO) routers modified to include IP addresses owned by the attackers.

These settings were subsequently inherited by downstream devices such as laptops and phones.

Lookups for domain names containing key terms associated with particular services - frequently email applications or login pages - would be resolved by the malicious DNS servers to further IP addresses controlled by the group.

DNS requests that don't match the actor’s targeting criteria would instead be resolved to the legitimate IP addresses for the services being requested.

The group would then attempt to conduct AitM attacks against both user browser sessions and desktop applications, aiming to harvest user account credentials.

In the second cluster of activity, some servers received DNS requests via compromised devices including models of MikroTik and TP-Link routers. The DNS requests were forwarded from these servers to other servers under the group's control, the NCSC noted.

This cluster of infrastructure was also involved in interactive operations against a small number of MikroTik routers, mostly located in Ukraine, and probably of intelligence value to the actor.

"This activity demonstrates how exploited vulnerabilities in widely used network devices can be leveraged by sophisticated hostile actors," said Paul Chichester, NCSC director of operations.

"We strongly encourage organizations and network defenders to familiarise themselves with the techniques described in the advisory and to follow the mitigation advice."

The NCSC advises organizations to protect the management interfaces of their systems, keep devices, networks, and software up to date, set up a security monitoring capability, and add applications to an allowlist.

They should also deploy a host-based intrusion detection system and use multi-factor authentication (MFA).

FOLLOW US ON SOCIAL MEDIA

Pro-Russia hacktivists are targeting local government and critical infrastructure in the UK, the National Cyber Security Centre (NCSC) has warned.

In an advisory this week, the security agency issued an alert over increased DDoS attacks by state-aligned groups. These attacks are driven by ideology over Western support for Ukraine, rather than financial gain, and aren't directly controlled by the state.

"We continue to see Russian-aligned hacktivist groups targeting UK organizations, and although denial-of-service attacks may be technically simple, their impact can be significant," said NCSC director of national resilience Jonathon Ellison.

“By overwhelming important websites and online systems, these attacks can prevent people from accessing the essential services they depend on every day."

In particular, the NCSC cites the NoName057(16) group, active since March 2022, and operating mainly through Telegram channels. It uses GitHub, along with other websites and repositories, to host the proprietary DDoS tool, DDoSia, and to share tactics, techniques, and procedures (TTPs) with its followers.

NoName057(16) has carried out numerous attacks against government bodies and the private sector in countries perceived as hostile to Russian geopolitical interests, including frequent DDoS attempts against UK local authorities.

“NoName057(16) consistently targets organisations where availability is closely tied to public trust, particularly local government websites, civic services, and other public-facing infrastructure," said Christiaan Beek, senior director of threat intelligence and analytics at Rapid7.

"While the group presents itself as a grassroots hacktivist collective, the timing of its campaigns and the close alignment of its targeting with Russian geopolitical objectives mean we cannot rule out some level of state encouragement, coordination, or tacit approval."

Russian hacktivists are an ever-present threat

Russian hacktivism isn't a new problem. In 2023, the NCSC published an alert on the risk posed by state-aligned adversaries following the Russian invasion of Ukraine.

In December, alongside international partners, it co-sealed an advisory which called out pro-Russian hacktivist groups for targeting government and private sector entities.

The NCSC advises organizations to take preventative action – with the first steps being to discover weak points and look for help from upstream service providers.

To deal with attacks which can’t be handled upstream – or only once detected and blocked – they should make sure their service can rapidly scale.

Similarly, the agency said organizations should define a response plan, covering graceful degradation of services, dealing with changing tactics, retaining administrative access during an attack and having a scalable fallback plan for essential services.

Gary Barlet, public sector CTO at Illumio, welcomed the focus on mitigation as well as prevention.

"We need a new way of dealing with DoS attacks. For too long, we have focused solely on prevention, and this approach has not worked," he said.

"The NCSC’s advice signals a change by recommending that plans include retaining administrative access and implementing full-scale backup plans. However, there needs to be an entire mindset shift within critical infrastructure organizations to focus on prioritizing impact mitigation and maintaining service and operational uptime.”

FOLLOW US ON SOCIAL MEDIA

The UK government has launched a new scheme to boost adoption of the Software Security Code of Practice by appointing a series of industry champions.

Under the plans, a cohort of ‘Software Security Ambassadors’ will promote the code of practice across various different sectors, showcasing examples of practical implementation and giving feedback to inform future policy improvements.

The first batch of participating organizations includes the Department for Science, Innovation, and Technology (DSIT) itself, along with the National Cyber Security Centre (NCSC).

Accenture, Cisco, ISACA, Lloyds Banking Group, Sage, Palo Alto Networks, and others have also backed the scheme.

"By acting as ambassadors, signatories are committing to a process of transparency, development and continuous improvement. The implementation of this code of practice will take time and, in doing so, may bring to light issues that need to be addressed," DSIT said in a statement confirming the announcement.

"Signatories and policymakers will learn from these issues as well as the successes and challenges for each organization and, where appropriate, will share information to help develop and strengthen this government policy."

What is the Software Security Code of Practice?

The Software Security Code of Practice was unveiled by the NCSC in May last year, setting out a series of voluntary principles defining what good software security looks like across the entire software lifecycle.

Aimed at technology providers and organizations that develop, sell, or procure software, the code offers best practices for secure design and development, build-environment security, and secure deployment and maintenance.

The code also emphasizes the importance of transparent communication with customers on potential security risks and vulnerabilities.

Developed with the NCSC, the code is designed to reflect internationally recognized best practices, such as the US Secure Software Development Framework (SSDF) and the EU’s Cyber Resilience Act (CRA).

Software security in the spotlight

The launch of the code came in direct response to growing concerns surrounding software security on both sides of the Atlantic. In the US, for example, the Secure by Design Pledge was launched by CISA in 2023.

This voluntary scheme asks software developers and providers to place a stronger emphasis on product security.

According to figures from the DSIT, more than half (59%) of organizations experienced software supply chain attacks in the past year, underlining the growing risks faced by UK enterprises and consumers alike.

In a separate survey from ISC2, more than half of respondents identified software vulnerabilities in supplier products as the most disruptive cybersecurity threat to their organisation’s supply chain.

ISC2 said it plans to help drive adoption of the code by promoting awareness through educational and thought leadership content, and referencing it in relation to certifications, training, and guidance that support secure software development.

It will also work with organizations across the software supply chain to encourage practical implementation and require its own partners to incorporate it.

“Promoting secure software practices that strengthen the resilience of systems underpinning the economy, public services and national infrastructure is central to ISC2’s mission,” said Tara Wisniewski. ISC2 EVP for advocacy and strategic engagement.

“The code moves software security beyond narrow compliance and elevates it to a board-level resilience priority. As supply chain attacks continue to grow in scale and impact, a shared baseline is essential and through our global community and expertise, ISC2 is committed to helping professionals build the skills needed to put secure-by-design principles into practice.”

FOLLOW US ON SOCIAL MEDIA

Honeypots and cyber detection tools can be highly effective at disrupting cyber attacks, according to the UK’s National Cyber Security Centre (NCSC), but enterprises should prepare for serious risks.

Over the last year, the NCSC has run a series of cyber deception trials, speaking to users, and analyzing the results to try and work out whether such tactics can increase observability, improve threat hunting, and even influence how attackers behave.

The trials involved 121 organizations from across the UK, 14 commercial providers of cyber deception solutions, and 10 product trials across different environments, from cloud deployments to operational technology.

So far, the NCSC said it's clear that cyber deception can work - but it’s not always easy. While most organizations reckoned that cyber deception could offer real value, particularly in detecting novel threats and enriching threat intelligence, there was a lack of outcome-based metrics.

"As with any observability and threat hunting methods, the effectiveness of cyber deception depends on having the right data and context," said the NCSC.

"We found that cyber deception can be used for visibility in many systems, including legacy or niche systems, but without a clear strategy, organizations risk deploying tools that generate noise rather than insight."

Terminology is also a bit of a problem, with vocabulary across the industry often inconsistent, making it harder for organizations to understand what’s on offer or even what they’re trying to achieve. The NCSC said it now plans to standardize its cyber deception vocabulary.

Similarly, organizations may be missing a trick by failing to publicly announce that they use cyber deception - only 10% do. Some research suggests that when attackers believe cyber deception is in use, they are less confident in their attacks.

"This can impose a cost on attackers by disrupting their methods and wasting their time, to the benefit of the defenders," said the NCSC.

Notably, the NCSC’s research indicated that many organizations don't know where to start, and could really benefit from impartial advice, real-world case studies, and reassurance that the tools they’re using are effective and safe – something the agency said it will aim to provide.

Cyber deception is risky business

The NCSC warned that the trial scheme also highlighted significant risks, particularly the danger of misconfiguration.

If cyber deception tools aren’t properly configured, they may “fail to detect threats or lead to a false sense of security”.

Worse still, these tools could create openings for attackers, the agency noted.

"As networks evolve and new tools are introduced, keeping cyber deception tools aligned requires ongoing effort. It is important to consider regular updates and fine-tuning cyber deception solutions."

Regardless, the NCSC said there's still a strong case for the use of cyber deception – particularly its potential to impose cost on adversaries.

By forcing attackers to spend time and resources navigating false environments, chasing fake credentials, or second-guessing their access, it can slow down attacks and increase the chances of detection.

"Cyber deception isn’t new, but neither is it widely used, and that’s a missed opportunity," the NCSC concludes. "When done well, it can provide early warning of attacks, generate high-quality intelligence, and shape how our adversaries operate. But it’s not a magic fix; it requires planning, strategy, and support."

MORE FROM ITPRO

• NCSC issues urgent warning over growing AI prompt injection risks – here’s what you need to know
• Ransomware victims are refusing to play ball with hackers
• Government urges large enterprises to shore up defenses as NCSC warns UK faces four 'nationally significant' cyber attacks every week

UK government ministers have written to some of the country’s largest companies, urging them to shore up cybersecurity capabilities amidst a surge in high-profile attacks.

The letter, sent to the CEOs of all companies in the FTSE100 and FTSE250, as well as a number of other leading UK firms, calls on them to make cybersecurity a board responsibility.

Signed by technology secretary Liz Kendall, chancellor Rachel Reeves, business secretary Peter Kyle, security minister Dan Jarvis, and the heads of the NCSC and National Crime Agency, it points out that hostile cyber activity in the UK is becoming more intense, frequent, and sophisticated.

"The government is taking significant action to counter the cyber threat and has developed tools to help businesses to defend themselves, but we cannot do this alone," it reads.

"We ask you and the CEOs and chairs of other leading UK companies to take the necessary steps to protect your business and our wider economy from cyber attacks."

According to the letter, organizations should make cyber risk a board-level priority using the Cyber Governance Code of Practice and sign up to the NCSC’s Early Warning Service.

They should also implement Cyber Essentials and require it in their supply chain.

Notably, this certification scheme comes with an incentive: it includes automatic cyber liability insurance for any UK organization that certifies the whole organization and has less than £20 million annual turnover.

The advice comes as the National Cyber Security Centre (NCSC) revealed it dealt with a record 204 nationally significant cyber attacks in the year to September – more than twice as many as the 89 it handled in the previous 12 months.

n its latest Annual Review, the cyber agency said it dealt with 429 incidents in all, and that many were linked to Advanced Persistent Threat (APT) actors – either nation-state actors or highly-capable cyber criminal groups.

"The best way to defend against these attacks is for organisations to make themselves as hard a target as possible," said Dr Richard Horne, chief executive of the NCSC.

"That demands urgency from every business leader: hesitation is a vulnerability, and the future of their business depends on the action they take today. The time to act is now."

UK facing an onslaught of cyber threats

Over the last year, high-profile attacks have caused huge problems for firms including Marks and Spencer (M&S), the Co-op Group, Harrods, and Jaguar Land Rover (JLR).

As part of the NCSC report, Shirine Khoury-Haq, CEO of the Co-op Group, warned businesses to do all they can to avoid falling victim to the same fate.

"The attack has had a significant impact on me, my colleagues and on our members. I will never forget the strain it put on those people making it right, or the concern it has given our members, to whom I answer," she wrote.

"While the security of your systems will no doubt remain on your radar, please continue to account for the fact that the timing and nature of a cyber attack like this is unpredictable. New challenges will always emerge and threats to corporate infrastructures will never stop."

Backing up the government's advice, the NCSC is urging smaller firms to take action too. Its new Cyber Action Toolkit is designed to help sole traders and small organizations put in place some of the basic cybersecurity measures that help guard against the most common cyber threats.

MORE FROM ITPRO

• How to choose the best cyber vendor for your business
• The best online cybersecurity courses
• The ultimate guide to starting a career in cybersecurity

The UK’s National Cyber Security Centre (NCSC) is extending its vulnerability research capabilities by partnering with external partners rather than relying entirely on its own analysts.

Dubbed the Vulnerability Research Initiative (VRI), the new initiative builds on existing external relationships and has been largely welcomed by the industry.

The agency explained it already works closely with the UK government, technology companies, and wider public to discover flaws, provide advice on staying safe online, and respond to cyber incidents.

The Vulnerability Research Initiative (VRI), however, is a more collaborative affair that brings in specialist cybersecurity expertise.

“The VRI’s mission is to strengthen the UK’s ability to carry out VR,” the NCSC said in a statement announcing the scheme.

“We work with the best external vulnerability researchers to deliver deep understanding of security on a wide range of the technologies we care about. The external VRI community also supports us in having tools and tradecraft for vulnerability discovery,” it added.

The agency also outlined who is in the core VRI team, including technical experts, relationship managers, and project managers. Additional details, including what external partners are involved, remain vague.

Kevin Robertson, CTO of Acumen Cyber, said the project “sounds promising in theory” but claimed the NCSC has a “track record of largely ineffective and self-serving programs [and] it could end up as another flop that delivers little real value”.

Others in the industry were more positive about the announcement, however.

Kev Breen, senior director of cyber threat research at Immersive, welcomed the decision as a proactive step to identifying and tackling security threats.

“There is a great deal of capability in the public domain, especially in more niche areas of research,” he said.

“It is not practical for the NCSC to maintain the necessary skills, time, and resources to effectively hunt for bugs across all of these domains.

“Extending the VRI to include the wider community, via invitation or application, is an excellent way to broaden that knowledge base.”

Will the NCSC scheme go far enough?

Notably, Breen warned that the lack of financial reward, as seen in a bug bounty program, may reduce the number of researchers willing to get involved.

Google, for example, offers between $100 and $31,337 for a qualifying bug, according to Geeks for Geeks.

Microsoft, meanwhile, has several bug bounty programs, offering up to $300,000 for vulnerabilities found in Azure or up to $30,000 for issues in Windows Insider Preview as just two examples.

On the hardware side, Intel offers between $500 and $100,000 for valid reports, depending on the risk level and nature of the bug.

MORE FROM ITPRO

• The NCSC just urged enterprises to ditch Windows 10 – here’s what you need to know
• The NCSC wants developers to get serious on software security
• NCSC expert urges businesses to follow geopolitics as defensive strategy

The UK's National Cyber Security Center (NCSC) has urged organizations to upgrade to Windows 11 before the end of support deadline for Windows 10 hits in October.

In a blog post, the cybersecurity body pointed out there are significant security risks for those who do not choose to upgrade.

Beyond the difficulties linked to being out of a dedicated support period, out-of-date operating systems are prime targets for cyber criminals – and the NCSC said the risks simply aren’t worth it.

Take the IE 6-11 vulnerability from the end of support for Windows XP as an example.

Organizations have until October 2025 to update their devices and hardware before Windows 10 reaches end-of-life status. Despite Windows 11 being almost four years old, many have still not made the switch.

“While Windows 10 was released more than a decade ago, it is still used widely by enterprises and not upgrading is akin to incurring a debt at a high interest rate – with the threat of forced repayment at a future date,” NCSC chief technical officer, Ollie Whitehouse, warned.

“The NCSC implores any organisation that has not already migrated to a more modern system to do so to help address security vulnerabilities in your devices and ensure overall cyber resilience. This is essential as demonstrated by the requirement to maintain supported software in Cyber Essentials.”

What’s holding up the shift to Windows 11?

One reason for companies holding on to Windows 11 could be the necessary hardware requirements.

Requirements such as TPM 2.0, UEFI, and support for Secure Boot may mean upgrading to more modern laptops, which might be a cost headache in the short term.

However, the cost of a cyber incident might be far worse in the long run.

As part of its guidance, the NCSC also released updated configuration packs for Microsoft Windows, with selected group settings to make it easier to deploy.

The requirements have led to suggestions that it could lead to a global torrent of e-waste, with millions of devices scrapped.

Research from Canalys suggested that up to 240 million PCs around the world could be terminated as a result of the shift to Windows 11.

MORE FROM ITPRO

• NCSC expert urges businesses to follow geopolitics as defensive strategy
• The NCSC wants developers to get serious on software security
• What you need to know about the new NCSC ransomware guidance

Business leaders need to stay up to date with geopolitics to keep their cybersecurity strategies up to date and mitigate the risks posed by state-backed hacker groups.

This is the message that Paul Chichester, director of operations at the UK’s National Cyber Security Centre (NCSC), delivered to attendees at a keynote session of Infosecurity Europe 2025.

The call to action from Chichester came as states known to support threat actors and engage in cyber attacks of their own step up efforts to disrupt critical infrastructure

Chichester said Russia’s cyber capabilities in particular have improved in recent years, with its invasion of Ukraine used as an opportunity to hone offensive cyber techniques. Along with Russia, Chichester focused on the threat China-backed groups pose to both public and private organizations.

“I'll come back to this a few times, but states don't do hacking for fun,” Chichester said.

“They do not do things for the sake of it. There is always a reason. We might not know the reason sometimes and that's quite a challenge for us, but we shouldn't assume that they're just doing it because they can.”

Chichester urged businesses who are being targeted by a state APT to carefully consider why and to assess how geopolitics feeds into their defensive strategies.

“At the end of the day, cyber isn't really just, or even, a technical thing. It's a tool that somebody uses, be it a criminal, be it a state. How does that risk manifest itself for you?”

The past few years have seen a number of high-profile attacks by state-sponsored groups on organizations to achieve ideological and military aims. Chichester said Russia is increasingly targeting supply chains which feed into Ukraine, with defense, energy, and logistics companies firmly in its crosshairs.

In 2022, for example, Microsoft warned the Russia-backed group Seashell Blizzard was using the Prestige ransomware strain to target organizations involved in the supply or transport of humanitarian aid and military shipments to Ukraine.

This is also coming from within the GRU military intelligence service, and Chichester cited the example of Unit 29155. This Russian military sabotage unit is known for its role in the 2018 Skripal poisonings, but it is now using cyber attacks to carry out its aims.

“Ultimately, if you want to target something in the real world, you need to understand them in the cyber world. You need to understand how they operate, you need to understand their movements, you need to understand what's going where,” Chichester explained.

“And we're seeing that merger of that real world sabotage being joined with that cyber espionage piece as well – and also cyber sabotage.”

Russia launched a major cyber attack on Viasat, a US communications company, on 24 February 2022, the same day it invaded Ukraine. This triggered a widespread outage, impacting Ukrainian military command and control and causing knock-on outages for several thousand internet-connected German wind turbines.

Chichester said the attack was carefully-timed to hit hardest in the first 24-48 hours of the invasion and “might have been a deciding factor” in the war had events on the ground gone differently.

Despite the apparently unintentional effects on EU-based companies, Chichester used the attack as an example of how states are increasingly targeting private businesses to achieve military or ideological aims.

China is also heavily implicated in attacks on critical national infrastructure, with cyber experts Kevin Mandia and Nicole Perlroth having recently warned the nation state has ramped up its cyber aggression.

Chichester said attacks by Volt Typhoon, an advanced persistent threat (APT) that successfully breached the US electric grid for almost a year, as well as Salt Typhoon which carried out major attacks on US telcos in 2024, show groups ‘pre-positioning’ themselves inside critical infrastructure.

As warned by CISA, this could enable undetected groups to carry out devastating attacks in the event of conventional war in the long-term.

For-profit attacks remain king

Despite the growing threat posed by state-backed groups pursuing ideological and military aims, evidence suggests that businesses will still largely contend with traditional threat actors.

In a separate keynote talk at the event, James Lyne, office of the CEO at the SANS Institute and Ciaran Martin, director of CISO network at the SANS Institute and former head of the NCSC, balanced the real threat of state-backed groups with those of profit-motivated groups.

“Most people are interested in fraud,” said Lyne. “Most of this stuff is about making money, the average obsession of the average criminal gang is far more mundane.”

“I think that's probably largely going to continue to be the case,” he added.

Lyne noted that, like the German wind farm operators inadvertently impacted by Russia’s attack on Viasat, some serious cyber attacks are mere “collateral damage” from campaigns aimed at other targets.

Martin said this was seen in the worst period of his time at the NCSC: the six-week period in 2017 in which North Korea launched the WannaCry ransomware attack, while suspected Russian groups hit Ukrainian banks and other organizations with the NotPetya malware.

“Between them, they [did] north of $10 billion of destruction and in my, sadly, favorite example from NotPetya, they’re attacking Ukrainian tax software and they end up stopping production at Cadbury’s chocolate factory in Tasmania, off the south coast of Australia.”

MORE FROM ITPRO

• The Iran cyber threat: Breaking down attack tactics
• Why government email servers are top targets for state-backed hackers
• State-sponsored cyber crime is officially out of control

The National Cyber Security Centre (NCSC) has warned organizations to tighten up their security practices following the recent cyber attacks on M&S, Co-op, and Harrods.

The security agency is calling on firms to review their password reset policies, and in particular how IT help desks authenticate workers when they make a reset request.

Organizations should be particularly cautious in the case of senior employees with escalated privileges, such as Domain Admin, Enterprise Admin and Cloud Admin accounts.

Similarly, the advisory noted that businesses should make sure that they're using multi-factor authentication (MFA) across the board.

Notably, the agency warned organizations should be constantly on the lookout for ‘risky logins’ within Microsoft Entra ID Protection, where sign-in attempts are flagged as potentially compromised due to suspicious activity or unusual behaviour.

"Preparation and resilience does not mean just having good defences to keep out attackers. No matter how good your defences are, sometimes the attacker will be successful," wrote NCSC national resilience director Jonathon Ellison and chief technology officer Ollie Whitehouse.

"It also means detecting threat actors when they are using your employees’ legitimate access (or are on your network, or in your cloud services) whilst being able to contain attackers to prevent damage, and to respond and recover when an attack has got through your defences."

The Information Commissioner's Office (ICO) has similar advice warning organizations to make sure that accounts are protected by a strong password, and that passwords aren't being reused across multiple accounts.

What happened with the retail attacks?

Attacks against UK retailers have rocked the industry in recent weeks. M&S was the first to be hit, followed by the Co-op and Harrods at the end of April.

The attacks have caused lasting disruption for M&S in particular, which has been unable to provide contactless payment, click-and-collect services, or online sales.

While the Co-op attack was initially thought to have been limited in its impact, the retailer told BBC News last week that hackers had “accessed data relating to a significant number” of current and past members.

The threat actors behind the Co-op attack, who are going by the name ‘DragonForce’, told the broadcaster they are also responsible for the incidents at M&S and Harrods.

Attacks are a ‘wake-up call’ for UK businesses

In a speech at CyberUK this week, chancellor of the Duchy of Lancaster Pat McFadden is expected to describe the attacks as 'a wake-up call for every business in the UK', and to call on firms to treat cybersecurity as an 'absolute priority'.

"We are ready to support you," he will say. "The National Cyber Security Centre is standing ready to support businesses and provide advice, and guidance, on how to raise the cyber security bar."

Small businesses are being encouraged to engage with the NCSC’s Small Business Guide to help bolster their defences and support through the Cyber Local scheme, which provides tailored funding to boost regional cyber skills.

MORE FROM ITPRO

• 2024 was a record year for commercial cyber attacks
• Cyber attacks against UK firms dropped by 10% last year, but experts say don't get complacent
• Global cyber attacks jumped 44% last year

A host of cybersecurity agencies have teamed up to offer guidance on how to secure edge devices from ever-increasing threats.

The advice covers network edge devices and appliances, such as firewalls, routers, virtual private networks (VPN) gateways, Internet of Things (IoT) devices, internet-facing servers and internet-facing operational technology (OT) systems.

Issued by the UK's National Cyber Security Centre (NCSC), CISA, and agencies in Australia, Canada, New Zealand, and the US, the guidelines encourage device manufacturers to include and enable standard logging and forensic features that are robust and secure by default.

This, the NCSC points out, should make it easier for network defenders to detect malicious activity and investigate following an intrusion.

The guidelines also set out a set of minimum standards for forensic visibility to help network defenders secure organizational networks, both proactively and when responding to a compromise.

"In the face of a relentless wave of intrusions involving network devices globally our new guidance sets what we collectively see as the standard required to meet the contemporary threat," said NCSC technical director Ollie Whitehouse.

"In doing so, we are giving manufacturers and their customers the tools to ensure products not only defend against cyber attacks but also provide investigative capabilities post-intrusion."

The NCSC said malicious actors are increasingly exploiting vulnerabilities and insecure design features to gain and maintain valuable accesses. Devices often aren't secure by design or by default, aren't given regular firmware updates, or have weak authentication measures with limited logging, making it hard to detect suspicious activity.

Similarly, many may not be configured securely, lack proper network segmentation, and use unsupported or end-of-life (EOL) hardware, thereby increasing their vulnerability to exploitation.

Last summer, a report from WithSecure identified the mass exploitation of edge services as the year's prevailing trend for attackers.

The year saw a sharp rise in security incidents caused by the mass exploitation of edge devices, including such as MOVEit, CitrixBleed, Cisco XE, Fortinet’s FortiOS, Ivanti ConnectSecure, Palo Alto’s PAN-OS, Juniper’s Junos, and ConnectWise ScreenConnect.

The number of edge service and infrastructure Common Vulnerabilities and Exposures (CVEs) added to the Known Exploited Vulnerability Catalogue (KEV) was 22% higher than in 2023.

Juliette Hudson, CTO of CybaVerse, said the new guidance is much needed given the scale of threats facing edge devices currently.

"These are guidelines that shouldn't be ignored, because when edge devices are insecure, the entire networks they run within are at heightened exposure to attack. Today, all businesses are digital businesses, where they rely on smart devices and the internet to deliver services, but this expands the enterprise attack surface," she said.

"Having good visibility across network assets and running proactive monitoring for threats are essential, but device manufacturers also have a key role to play, and it is essential they practice good security hygiene in the development process."

MORE FROM ITPRO

• Five Eyes raises alarm over 'living off the land' attacks
• How edge computing can benefit businesses
• Check out the best VPNs for enterprises

The UK government plans to spend £1.9 million on cyber resilience projects across the country, the Department for Science, Innovation and Technology (DSIT) has revealed.

With planned investment in more than 30 projects, the money will help improve the UK’s cyber resilience for both businesses and consumers, and boost national cyber skills.

Some projects set to receive funding include ‘CyberSecurityAId: Empowering Small Businesses with Cyber Security Skills,’ ‘Cybersecurity Angel Investor Network,’ and ‘First Steps to a Cyber Security Career - North West.’

The funding boost comes amid growing concerns over cybersecurity skills shortages across the country. Almost half of UK firms report a deficit in this regard, according to the DSIT, and these projects will help fill current gaps and meet growing demand.

Under the scheme, people across the country will be able to pursue new, high-level career opportunities as a result, DSIT added.

“By upskilling small businesses and individuals, investing in workforce development, and encouraging neurodiverse talent, government and industry partners are fostering robust and diverse cyber communities for the future,” said Jonathan Ellison, director for national resilience and future technology at the National Cyber Security Centre (NCSC).

“This is vital for protecting our digital economy, creating new opportunities for secure innovation, and helping make the UK the safest place to live and work online,” Ellison added.

The UK’s minister for cybersecurity, Feryal Clark, also commented, saying strong defenses are needed for the country’s growing digital economy, which is worth billions of pounds.

“Attempts to disrupt the technologies and services we rely on daily continue to grow, so we’re leaving no stone un-turned to make sure our communities have the skills to rise to the challenge,” Feryal said.

Cyber investment is a good start, but does it go far enough?

While the move has been welcomed by industry stakeholders, some experts have questioned the scope of the initiative.

Socura CEO Andy Kays said a key concern is the “size of investment relative to the scale of its ambition”, suggesting that the volume of projects set to be awarded funding could dilute the overall investment.

“30 new projects slated for 2025 and beyond across multiple regions means that this money will be thinly spread across the UK,” Kays said.

“The concern is that this money won’t go far enough to have the level of impact needed. It is, however, a good start,” he added.

Kays said it was “only right” that the UK invest more money to develop its regional cyber skills in places like Wales, the North East of England, and Northern Ireland.

Jake Moore, global cybersecurity advisor at ESET, welcomed the investment scheme, adding that the initiative will help strengthen the country’s overall cyber resilience and futureproof communities.

“Upskilling workforces is crucial for safeguarding our digital economy, unlocking opportunities to secure innovation, and ensuring the UK remains protected from constant attacks,” Moore said.

“However, this isn’t the first time we have seen a shake-up in the UK’s skills shortage so it is vital that the initiative will continue to be funded and pushed to the next level where more roles are filled,” he added.

Two-thirds of attributable cyber attacks now come from state-backed attackers, lending weight to warnings from national security agencies about the scale of the threats faced by enterprises and public services alike.

Analysis from Netskope shows a marked escalation in state-sponsored attacks in recent years, with the company warning this trend shows no sign of slowing down.

Sanjay Beri, CEO and co-founder of Netskope, said cyber attacks waged by nation state actors now represent a form of ‘quiet war’.

"Under the surface of this worldwide escalation is a varied picture of different states pursuing widely divergent cyber attack strategies,” he said.

While attention has largely focused on the risks from Russia, China and Iran, data from Netskope indicates that North Korea is currently the world's biggest offender in terms of the number of victims.

It's been targeting victims en-masse through cyber crime and cryptocurrency theft, with the goal of stealing money to fund its military.

China and Russia, meanwhile, account for the second and third greatest number of attacks. Unlike North Korea, however, their goal is to disrupt and damage highly targeted pieces of critical national infrastructure, leading to a smaller number of higher impact, more targeted attacks.

Examples include the targeting of NHS England and the Electoral Commission, both of which were highly disruptive.

"The difference between North Korea’s cyber ‘carpet bombing’ and Russia’s ‘precision strikes’ means that if you’ve fallen victim to an online phishing attack, it’s unlikely that Russian government-backed actors were the cause," said Beri.

"If, however, a critical piece of national infrastructure is down, then it’s more likely that they are. Understanding these nuances is critical for businesses and individuals operating in today’s connected world - because the first and most important step in putting in place the best cyber defense strategy is understanding who is targeting you, what their goals are, and how they’re trying to achieve them."

State sponsored cyber attacks are wreaking havoc

Earlier this summer, the UK’s National Cyber Security Centre (NCSC), along with US and South Korean authorities, warned that a North Korea-linked threat group known as Andariel was compromising organizations around the world to steal sensitive and classified technical information and intellectual property data.

While it mainly targeted defense, aerospace, nuclear, and engineering entities, it also hit organizations in the medical and energy sectors to a lesser extent, stealing information such as contract specification, design drawings, and project details.

In March this year, the UK government warned that the Chinese state-sponsored attacks on parliamentarians and on the Electoral Commission would not be tolerated.

This particular incident prompted the government to summon the Chinese Ambassador and sanction a front company and two individuals identified as members of the APT31 hacking group.

Similarly, late last year, Russian-backed threat actors were thrust into the spotlight after the NCSC exposed a campaign by Russian Intelligence Services to interfere in UK politics and democratic processes.

More from ITPro

• The Iran cyber threat: Breaking down attack tactics
• State-sponsored cyber attacks: The new frontier
• What threat do nation state hackers pose to businesses?

The National Cyber Security Centre (NCSC) has warned that Iran-linked hackers are using social engineering to target government officials, lobbyists, and others.

In a joint advisory with the FBI, the NCSC said hackers working for Iran's Revolutionary Guard Corps (IRGC) are carrying out spear phishing attacks against people with links to Iranian and Middle Eastern affairs.

They've been impersonating victims' contacts via email and messaging platforms, thereafter asking them to share user credentials via a false email account login page. This allows the attacker to gain access to victims’ accounts, exfiltrate and delete messages, and set up email forwarding rules.

They tailor their approach on an individual basis, according to the NCSC, impersonating business associates or family members, journalists purportedly looking for interviews, conference organizers, embassy staff, and others.

"The spear-phishing attacks undertaken by actors working on behalf of the Iranian government pose a persistent threat to individuals with a connection to Iranian and Middle Eastern affairs," said NCSC director of operations Paul Chichester.

"With our allies, we will continue to call out this malicious activity, which puts individuals’ personal and business accounts at risk, so they can take action to reduce their chances of falling victim."

FBI, NCSC offer advice for potential targets

The FBI said signs to look out for include suspicious logins from foreign or domestic IP addresses; the creation of message handling rules to forward emails and prevent victims from receiving notifications of the compromise; the connection of unknown devices, applications, or accounts to a victim account; exfiltration and deletion of messages; and attempts to access other victim accounts.

Meanwhile, the NCSC is advising potential victims to follow its guidance for high-risk individuals, adding that anyone facing a higher risk of targeting due to their work or public status can sign up for two opt-in cyber defense services managed by the center.

These are an Account Registration service that alerts individuals if the NCSC becomes aware of a cyber incident impacting a personal account, and a Personal Internet Protection service that helps prevent spear-phishing by blocking access to known malicious domains.

"I strongly encourage those at higher risk to stay vigilant to suspicious contact and to take advantage of the NCSC’s free cyber defense tools to help protect themselves from compromise," Chichester said.

Back in 2019, the US Department of State designated the IRGC as a foreign terrorist organization that aimed to steal US policy information and weaken confidence in the country's electoral processes.

And alongside this alert, the FBI also said that it had indicted three IRGC cyber actors for a 'hack-and-leak' operation which stole material from the Trump presidential campaign and leaked it to the Democratic campaign in an attempt to influence the upcoming presidential election.

"The conduct laid out in the indictment is just the latest example of Iran’s brazen behavior," said FBI director Christopher Wray. "So today the FBI would like to send a message to the government of Iran – you and your hackers can’t hide behind your keyboards."

More from ITPro

• NCSC identifies China-linked botnets targeting thousands of devices worldwide
• CISA breached a federal agency as part of its red team program — and nobody noticed for five months
• The NCSC wants to know how your business is using honeypots to combat hackers

The UK's Information Commissioner’s Office (ICO) and National Crime Agency (NCA) are planning to improve the support they give to organizations experiencing cyber attacks.

In a Memorandum of Understanding (MoU), the two agencies set out plans to make sure that victims are signposted to relevant bodies, such as the National Cyber Security Centre (NCSC), and are empowered to report cyber crime at the earliest opportunity.

“Unfortunately, we’ve seen cyber crime costing UK firms billions over the past years. That’s why it’s crucial that relevant bodies work together to boost the UK’s cyber resilience," said Stephen Bonner, ICO deputy commissioner - regulatory supervision.

"This new memorandum of understanding builds on our existing relationship with the NCA and will help improve cybersecurity standards across the board, while respecting each other’s remits."

The MoU commits the ICO and NCA to encourage organizations to engage with the NCA on cybersecurity matters, including the response to cyber crime, promising that the NCA will never pass on information shared in confidence without having first received the organization's consent. 

The ICO will also share information about cyber incidents with the NCA on an anonymized, systemic, and aggregated basis - and on an organization-specific basis where appropriate - to help protect the public from serious and organized crime.

Where the ICO and NCA are both engaged in a cyber incident, they'll work together to minimize disruption to the organization’s efforts to contain and mitigate harm.

Similarly, the two agencies will also work together to promote learning, provide consistent guidance, and improve standards on cyber-related matters while continuing to work closely with the National Cyber Security Centre (NCSC).

The NCA noted that organizations have a legal responsibility – under both data protection law and the Network and Information Systems Regulations – to report incidents that meet a certain threshold.

There’s a huge amount of assistance on offer, the crime agency added, including tailored technical advice, the creation of secure communication channels, insight into an attacker’s possible motivations, and strategic advice on how to engage with the rest of government, regulators, and the media.

"The NCA leads a whole-system response to cyber crime, disrupting cyber criminals and putting them before the courts wherever possible," said NCA deputy director Paul Foster, head of the National Cyber Crime Unit.

"Organizations who are vulnerable to imminent attack or find themselves a victim also need support and guidance, and we work closely with our partners to provide this."

"We are pleased to be making this commitment with the Information Commissioner’s Office; this agreement signifies our common goal of establishing and maintaining a secure and resilient cyber ecosystem for all."

The UK's National Cyber Security Centre (NCSC) is calling for industry comment on the use of cyber deception in cyber defense.

The center said it recognizes the potential value of using cyber deception technologies and techniques to support cyber defense in certain situations. And as a result, it's aiming to establish an evidence base for use cases on a national scale, in support of its Active Cyber Defence 2.0 initiative.

As a starting point, the NCSC sees two main use cases. The first is low-interaction solutions such as digital tripwires and honeytokens to alert organizations of all types to unauthorized access.

The second is both low-interaction and high-interaction honeypots to collect threat intelligence both at a large scale and as one-off instances, which it sees being deployed by organizations with mature security capabilities, as well as managed cyber security service providers.

"During discussions, it became clear that ‘deception’ has connotations which can be uncomfortable for some," the NCSC explained.

"It is important to acknowledge this, and although there are wider definitions of cyber deception in military and other contexts, they differ to the technology we are referring to here."

By tripwires, it means components and systems designed to detect a threat actor by interacting with them to disclose their unauthorized presence in an environment which include honeytokens.

Honeypots, meanwhile, it defines as "components and systems designed to allow a threat actor to interact with them, allowing observation of their techniques, tactics, and procedures (TTPs), as well as the capability and infrastructure they use – with the aim of collecting cyber threat intelligence".

Finally, breadcrumbs are described as digital artifacts distributed in a system that entice a threat actor to interact with a tripwire and/or honeypot.

The NCSC wants to see more honeypots and deception techniques 

The NCSC said it plans to collect existing evidence, but also to encourage the use of these techniques across the UK, including in government security operations and critical national infrastructure.

It's aiming for 5,000 instances on the UK internet of low and high interaction solutions across IPv4 and IPv6, 20,000 instances within internal networks of low interaction solutions, 200,000 assets within cloud environments of low interaction solutions and 2,000,000 tokens deployed.

There are three core research questions it aims to examine:

• How effective are deployments at supporting the discovery of latent compromises within organization estates
• How effective are deployments at supporting the enduring discovery of new compromises by threat actors
• Does knowledge of the presence of such technologies at a national level actually affect the behavior of threat actors?

Honeypots are already being deployed across the UK, allowing organizations to detect where cybercriminals are coming from, the level of threat, their preferred tactics, and the data or applications they're interested in - as well as how well existing cybersecurity measures are working.

Last year, for example, the National Grid said it was looking to award a £1 million contract for honeypot technology, and it's widely used by law enforcement.

The National Cyber Security Centre (NCSC) has announced it will refresh its Active Cyber Defence (ACD) program, with a second iteration of the initiative to help organizations stay secure in a new era of cyber threats.

The first generation of the Active Cyber Defence program was launched in 2016, seeking to reduce the harm caused by cyber criminals leveraging prepackaged malicious tools and services available on underground hacking forums, known as commodity attacks.

The ACD comprises a collection of technical services and capabilities aimed at tackling a large swath of the cyber threats UK organizations face everyday, providing self-service checks, threat detection tools, and more.

The program was initially targeted specifically at developing services for the protection of government organizations.

But in its annual review for 2023, the NCSC said the ‘whole of society’ approach that defines the UK’s national cyber strategy meant it broadened the utility of ACD products and services to a wider range of users, from small business to the education sector.

The initiative also wanted to make it easier for users to find, sign up to, and manage the services provided in ACD, using its My NSCS platform to help bring various ACD products and services together into a single experience. 

ACD 2.0 will encompass the next generation of products and services the cyber agency will provide to UK entities to help neutralize new dangers posed by a fast developing threat landscape.

NCSC ACD 2.0 will strategically divest where is sees the market stepping up

The second generation of the ACD will also reflect how the NCSC is divesting in certain areas as it sees the private sector catching up. 

The increased availability and maturity of analogous services from private service providers means the agency can step back and focus on areas where it is uniquely positioned to provide protection at scale.

Ollie Whitehouse, CTO at the NCSC said the services included in the second generation of the ACD will be delivered where the market is not able to, be that because of the NCSC’s unique position in government, ability to scale, cyber capabilities, or authority.

“It’s important that the UK’s National Cyber Security Centre focuses its efforts where we can make a uniquely valuable contribution – where we see a gap in the commercial market, or where being part of GCHQ presents a unique opportunity to drive up resilience at scale,” he wrote in his blog introducing the program.

“The NCSC will look to divest most of our new successful services within 3 years – to another part of government or the private sector to run on an enduring basis”.

The agency will continue to work with industry partners to deliver a number of the core services offered in the ACD package, such as its attack surface management suite, comprising its Web Check, Mail Check, and Early Warning products.

Helping organizations understand and reduce their attack surface and associated vulnerabilities is one of the most efficient ways of driving up external resilience nationwide, Whitehouse stated in his blog, urging security vendors with ideas for future products to get in touch with the agency.

Whenever you’ve heard about a cyber attack on a UK institution, be it public, private, or third sector, you’ve likely also heard that the National Cyber Security Centre (NCSC) is involved in providing support. 

That’s because the center is the UK’s dedicated organization charged with protecting the country from cyber security threats. Acting as a bridge between industry and government, the NCSC provides vital security advice, support, and information on best practice for the public and private sector. 

Formed to act as a ‘technical authority’ for issues related to cyber security,  the NCSC is part of GCHQ, the UK’s intelligence and security agency. The NCSC was formally established in 2016, absorbing existing organizations such as the Computer Emergency Response Team (CERT-UK) and Communications-Electronic Security Group (CESG).

Since then, the NCSC’s responsibilities and scope have expanded significantly, largely due to the continually escalating cyber threat landscape that UK businesses and organizations are forced to contend with. 

Here’s everything you need to know about the NCSC. 

What does the NCSC do?

By its own definition, the NCSC provides a “single point of contact” for small businesses, large enterprises, government agencies, and the general public for all cyber-security-related issues or incidents. 

When a UK organization falls victim to a cyber attack, the NCSC provides critical incident response support to help alleviate the impact of an incident, coordinating with the affected business, law enforcement, and other UK authorities to assist with recovery. 

This support is provided through the Cyber Incident Response (CIR) scheme, originally aimed at assisting organizations operating in critical national infrastructure (CNI). It has since been expanded to include support for smaller enterprises. 

With small businesses and charities ranked among the most targeted organizations in the UK, the NCSC has expanded the scope of this program to provide more comprehensive support. Ransomware attacks against small businesses by groups such as LockBit are specifically on the rise and the NCSC has demonstrated a focus on alleviating this threat.

Recent instances of this support include the British Library ransomware attack, which saw the NCSC provide response and advice. 

NCSC training schemes

The agency provides more than just incident response support. A key focus for the NCSC centers around proactive actions to protect institutions across the country. 

This includes the publication of frequent threat advisories aimed at providing vital information for businesses to stay ahead of the curve and defend themselves. IN 2024 alone, the NCSC has published advisories on state-linked threat actors, so-called ‘living off the land attacks’, and attacks against CNI. 

The agency also provides best practice advice for businesses of all sizes across the UK. For example, the NCSC’s recent ransomware guidance urges organizations to cease ransomware payments to remove the incentive for threat actors to conduct these attacks.

In addition to its reactive and advisory roles, the NCSC provides educational programs to arm workers with the knowledge to spot and counter cyber threats. This includes its NCSC Certified Training program, which offers skills training for professionals already working in – or just joining – the cyber security industry. 

The NCSC runs practical training too, such as the Exercise in a Box scheme. This free-to-use exercise allows organizations to test their response to a cyber attack and fine-tune their processes in the event of an incident. 

In December 2023, the NCSC expanded this program in collaboration with CREST and certification organization, IASME. The Cyber Incident Exercising scheme gives users access to approved service providers from the security industry and provides bespoke, real-time cyber incident exercises. 

Supporting the cyber workforce of the future

With the UK contending with the well-publicized cyber security skills shortage, the NCSC has become a leading voice in the drive to encourage young people to take up careers in the industry. 

This includes the CyberFirst program, which aims to support students aged 11-17 to develop computing science and cyber skills with bursaries, free courses, and competitions. 

According to the NCSC, this program “provides opportunities for young people to explore their passion for tech by introducing them to the fast-paced world of cyber security”. 

The NCSC also runs the CyberFirst Girls competition, a competition for schoolgirls aged 12-13 intended to encourage more girls to aim for careers in tech and improve the share of women in cyber security in the long term.

Who leads the NCSC?

Ciaran Martin served as the first chief executive of the NCSC upon its formation in 2016. Martin had previously served as director of security and intelligence at the UK Cabinet Office from 2008-2011 and head of cyber security at GCHQ, a position from which he advocated for the creation of the NCSC. 

Throughout his tenure as CEO at NCSC, Martin oversaw the establishment of many of the programs and procedures the agency follows today and saw the UK’s cyber security preparedness ranking raised to first in the International Telecommunications Union (ITU)’s yearly index.

Martin left in August 2020 and has since expressed regret over the NCSC’s initial focus on state-sponsored cyber attacks at the expense of tackling organized cyber crime.

Since then, the agency has had several CEOs. Lindy Cameron succeeded Martin in 2020 and during her time in the role highlighted the immediate threat ransomware poses to the UK and how AI could increase the speed of CNI attacks.  

After Cameron announced her departure in December 2023, the post was filled by interim CEO Felicity Oswald, who continues to hold the role ahead of new chief executive Richard Horne taking the reins in the autumn of 2024.

The UK tech sector is failing to incentivize companies to build and roll out secure software products, according to NCSC chief technology office Ollie Whitehouse. 

In a keynote address at the CYBERUK conference in Birmingham, Whitehouse highlighted the steep rise in software product vulnerabilities in recent years, warning that the scale of the issue is placing businesses and individuals across the country at risk.

But the current state of the market means that companies building resilient products aren’t fully rewarded for their efforts. Firms across the country “know how to design and build resilient, secure technology,” he said, but the next key focus must be to build a market that “supports and rewards it”.

"We have security products which contain vulnerability classes that we have known about for over 70 years or 24 years, depending on how you count them, being discovered and exploited in our edge perimeters in 2024.

"For the last four years, the numbers of '22 to '23, we saw a 14% increase in disclosed vulnerabilities, bringing us to 29,000 but in addition to that what we saw was 40,000 vulnerabilities registered, which is also similarly a 14% increase."

Whitehouse described what he called a ‘thousand Band-Aid’ approach to cyber security - the tendency for organizations to layer sticking plasters over security cracks in an attempt to address technical debt. For the UK to become a truly cyber resilient nation, that approach needs to fundamentally change, he said.

Concerningly, Whitehouse warned that current legal frameworks are not keeping up with the pace of technological change, and is likely never to do so.

He called for developers to be honest about the profound challenges they are facing, in order to develop products and services that are fit for purpose and for a resilient future.

"The world is changing, fast, and we are facing a fundamental challenge: we don’t have the evidence for how to build a resilient country writ large," he said.

"The challenges ahead of us are the horse-sized ducks of states with strategic intentions, and the duck-sized horses of criminal actors out for financial gain. And the reality is that we don’t get to choose which one we’d rather counter, because we have to be able to face both with confidence."

Candid remarks welcomed by industry

Gareth Pritchard, CTO at security firm Sapphire, welcomed Whitehouse’s comments, adding that if boards continue to only see cyber as a ‘one and done’ transformation program, commercial market forces won’t fix the lingering technical debt and problems cited in his keynote. 

There must be a steadfast focus on cyber security as a cultural foundation for businesses of all shapes, sizes and sectors, Pritchard noted.

"Taking an evidence-based approach to security whilst implementing good security hygiene is vital to our continued fight against cyber threats," he said.

"We all must take on the challenge posed by Ollie as it is through collaboration and collective action that we will drive the market to make cyber security a core foundation of our business operations, products, and services that we all rely on.”

The National Cyber Security Centre (NCSC) has teamed up with insurance bodies to try and reduce the amount being paid by ransomware victims.

Concerned that too many organizations are paying ransoms, the NCSC, along with GCHQ and the Association of British Insurers (ABI), British Insurance Brokers’ Association (BIBA) and International Underwriting Association (IUA), said they want their guidance to help victims make informed decisions.

Considerations include the thorough assessment of business impact, reporting protocols, and where to access sources of support.

"The NCSC does not encourage, endorse or condone paying ransoms, and it’s a dangerous misconception that doing so will make an incident go away or free victims of any future headaches. In fact, every ransom that is paid signals to criminals that these attacks bear fruit and are worth doing," said NCSC CEO Felicity Oswald.

"This cross-sector initiative is an excellent next step in foiling the ransom business model: we’re proud to support work that will see cyber criminals’ wallets emptier and UK organizations more resilient."

Ransomware remains the biggest day-to-day cyber security threat to UK organizations, and the number of attacks is rising, the agency warned. Paying a ransom doesn't guarantee the end of an incident nor the removal of malicious software from victims’ systems.

However, it does provide incentives for criminals to continue and expand their activities. Even following payments, cyber criminal groups will lie about having deleted the data, the guidance points out.

The NCSC advises reviewing all the options - including not paying, keeping careful records of decision-making, and where possible consulting experts as well as staff.

Victims should assess the impact on business operations and data, as well as the financial implications, and should investigate the root cause of the incident to avoid a repeat attack.

If organizations do pay up, they should make sure it's legal to do so, and should be aware that paying a ransom does not fulfill their regulatory obligations. Similarly, they must make sure they report the incident to the authorities.

NCSC guidance welcomed by industry

Helen Dalziel, IUA director of public policy, said that the payment of ransoms in response to cyber attacks is on a downward trend globally.

"Businesses are realizing that there are alternative options and this guidance further illustrates how firms can improve their operational resilience to resist criminal demands," she commented.

Raghu Nandakumara, head of industry solutions at security firm Illumio, said he welcomes the advice, adding he'd like to see more guidance to help businesses build resilience and contain attacks.

"More often than not, recovery plans are inadequate or have not been properly tested, which makes them unviable when a real incident does occur. As a result, organizations are left with no choice but to pay the ransom to restore operations and productivity levels as quickly as possible," he said.

"The NCSC should encourage businesses to adopt an ‘assume attack’ mindset. This is not admitting defeat - instead it focuses on preparing to respond effectively to a cyber incident and building resilience."

The explosion of interest in AI since 2022 has not been limited to those with pure intentions, with many in the sector now warning that threat actors are adopting malicious LLMs or ‘hackbots’ via subscription.

Threat actors have been just as eager to leverage AI tools in their attack chains as defenders have in their security stack, raising the importance of a concrete strategy for AI threats among security teams.

The UK’s National Cyber Security Centre (NCSC) has claimed AI, “will almost certainly increase the volume and heighten the impact of cyber attacks over the next two years” in a report released in January 2024.

Hackers have already been using LLMs to refine social engineering attacks, matching the tone and style of an executive for phishing or using deepfake attacks to circumvent identity systems.

Vasu Jakkal, corporate vice president of security at Microsoft, has taken to the stage at RSA Conference 2024 to warn that AI is already being used to crack passwords and linked the availability of the technology to a 10x increase in identity-based attacks.

Experts have also suggested that chatbots could be used to create bespoke malware strains. Publicly available models like ChatGPT and Gemini have anti-blackhat guardrails built in to prevent them from being used to produce malicious content, but hackers have been able to bypass many of these protections through sophisticated prompt engineering techniques.

But recent research suggests that publicly-available LLMs are largely unable to exploit vulnerabilities, with only OpenAI’s GPT-4 having been able to produce exploits for known flaws. These limitations appear to have fed into the production of bespoke, malicious chatbots designed specifically to assist threat actors with their nefarious activities. 

WormGPT and FraudGPT – the birth of hackbot as a service

These tools are being advertised on marketplaces and forums across the dark web, and are available for threat actors to rent as and when they need them to enhance their attacks, spawning the hackbot as a service model.

Cyber security specialists Trustwave SpiderLabs published a blog in August 2023 outlining the rise of malicious LLMs being pushed on underground message boards across the dark web.

One such malicious LLM, WormGPT, was first discovered being touted on popular hacking platforms hosted on the dark web in June 2021, according to Trustwave’s research. Another is FraudGPT, first discovered by threat researchers at Netenrich being circulated on Telegram in July 2023.

Both of these tools allow attackers to design assets used in social engineering attacks such as phishing emails, deepfakes, voice cloning, and more but their creators claim their real value comes in exploiting vulnerabilities.

Hackers can feed code pertaining to a specific vulnerability into these malicious models, which in theory could produce a number of proof of concept (PoC) exploits for an attacker to try.

Speaking to ITPro Jack Peters, customer solutions architect at cloud services company M247, describes the recent surge in these types of tools and how they can be used to assist in cyber attacks.

“Using the same user-friendly prompts akin to other generative AI chatbots, ‘FraudGPT’ and other tools are flooding the dark web, allowing hackers to take similar shortcuts to create malware, malicious code, and phishing emails to steal data and create havoc for businesses”, Peters explained.

“As with any sophisticated language model, one of FraudGPT’s biggest strengths is its ability to produce convincing emails and documents in order to gain access to a business’ systems.”

These tools are available through underground marketplaces on the dark web where hackers can pay for a monthly license to use the hackbot. In this sense, they are similar to the ransomware as a service (RaaS) model, which experts have directly linked to the diversified ransomware industry that plagues businesses today.

The research from Trustwave listed the price range for a monthly subscription for FraudGPT as between $90 and $200, whereas the first version WormGPT is available for €100 per month. 

Several new malicious LLMs have entered the market since the arrival of WormGPT, including BlackHatGPT, XXXGPT, WolfGPT, and more, forming a new segment of the cyber black market.

A blackhat alternative to ChatGPT, but are they really worth it?

Trustwave’s research attempted to test the efficacy of these tools by comparing the outputs of the hackbots to those produced by a legitimate chatbot.

The results showed that with the right prompts, ChatGPT could be made to produce some Python malware. But users had to first claim the code was to be used for white hat purposes and before it could be deployed the output code required further tweaking.

Ultimately, ChatGPT was able to produce a malicious Python script to the same requirements as WormGPT, but ChatGPT included a disclaimer urging the user to “use this script responsibly” etc. 

In a similar fashion, ChatGPT is also able to create very realistic exchanges that could be used for phishing but the prompts required to produce these outputs need to be very specific. In most circumstances, ChatGPT will refuse to comply with malicious requests.

As such, these malicious chatbots may simply offer cyber criminals an easier route to using AI for attacks compared to spending time trying to jailbreak their instance of ChatGPT or craft the phishing page or malware they require.

Etay Maor, senior director of security strategy at Cato Networks, tells ITPro he had doubts about the coding capabilities of these tools early on, citing the Python code included in the listing for WormGPT.

“I’m not impressed with the example that they gave here of a Python script that knows how to create a DDoS attack," Maor says. "Looking at this, it is pretty lame, I don’t know who it’s supposed to impress”.

Camden Woollven, group head of AI at GRC International Group, expresses similar skepticism and argues that the adversarial capabilities of these tools do not appear to be vastly superior to anything proficient hackers can already achieve.

“From what I can tell, these tools seem to be fairly rudimentary – generating simple malware code, phishing schemes, stuff a decent hacker could pull off without an AI assistant,” Woollven tells ITPro.

“There’s an element of ‘overhype’ at play, as seems to be the case with anything AI-related.”

Cyber criminals themselves have expressed their discontent with the capabilities of these tools. Reviews for WormGPT contain frequent complaints about the tool’s limited functionality, with some threat actors even having accused the developer behind the hackbot of operating a scam.

One review warns would-be users that the tool is "just an old cheap version of ChatGPT", adding that it was just as restrictive as the original version of the chatbot.

Hackbot as a service as a shortcut for cyber attacks

Despite their limited malicious credentials, Maor believes the real threat posed by these rudimentary hackbots is that they can significantly reduce the time and work a threat actor needs to put in to launch a high volume of effective attacks.

Even if the success rate of attacks based on hackbot outputs is the same or lower than those completely crafted by human attackers, the improved consistency and volume of attacks backed by AI could nevertheless drive up the success rates of threat actors. Hackbot as a service can therefore be a tempting value proposition for attackers looking for a leg up in what is an increasingly competitive space.

Maor says he is particularly concerned that hackbot as a service models could lower the barrier to entry for cyber crime for individuals who would have previously lacked the digital literacy to launch a cyber attack.

Simple attacks are likely to become easier for the scammers to pull off, while skilled hackers could see the scope of their capabilities increase dramatically when paired with malicious LLMs.

“Yes, it does lower the barrier for threat actors to do more and it makes life easier for those who are already proficient,” Maor explains.

This is a nascent market with new threats appearing all the time. In March, Maor published a blog post detailing a callout from a Russian group looking for engineers with a foundation in machine learning (ML) and AI to help them develop a malicious LLM.

Maor provides two reasons why he thinks the LLM in question, xGPT, could pose a far more serious threat to enterprises than WormGPT or similar ChatGPT variants:

“First, this is a known threat actor that has already sold credentials and access to US government entities, banks, mobile networks, and other victims,” he tells ITPro. “Second, it looks like they are not trying to just connect to an existing LLM but rather develop a solution of their own.”

As the hackbot as a service underground matures, businesses will need to carefully assess the protections they have in place. Strong AI security systems may become more necessary to counter the threat posed by corrupted LLMs, and controls such as identity management tools will be a boon against tailored social engineering attempts.

The efficacy of these tools is still in debate, but as security teams see with more and more advanced strains of ransomware there is always the potential for criminals to innovate at a pace approaching that of legitimate developers.

UK and US authorities are warning that pro-Russian hacktivists have been targeting vulnerable, small-scale industrial control systems (ICS) in North America and Europe.

The UK’s National Cyber Security Centre (NCSC) and US Cybersecurity and Infrastructure Security Agency (CISA) say victims have seen 'some limited physical disruption' to operations.

"The pro-Russia hacktivist activity appears mostly limited to unsophisticated techniques that manipulate ICS equipment to create nuisance effects," CISA said in an advisory.

"However, investigations have identified that these actors are capable of techniques that pose physical threats against insecure and misconfigured OT environments."

The hacktivists have targeted industrial control systems (ICS) and small-scale operational technology (OT) systems in North American and European critical infrastructure sectors, including water and wastewater systems, dams, energy, and food and agriculture.

The NCSC added that while they often align to Russian government interests, this isn't always the case - making them less predictable.

"While the cyber activity of these groups often focuses on DDoS attacks, website defacements and/or the spread of misinformation, some have stated a desire to achieve a more disruptive and destructive impact against western critical national infrastructure (CNI), including in the UK," the NCSC warned.

"We expect these groups to look for opportunities to create such an impact, particularly if systems are poorly protected."

The hackers' techniques involve manipulating ICS equipment to create nuisance effects. However, CISA said its investigations have revealed they can also pose physical threats against insecure and misconfigured OT environments.

They have been spotted gaining remote access by exploiting publicly exposed internet-facing connections and outdated virtual network computing (VNC) software, as well as by using the factory default passwords of human machine interfaces (HMIs) and weak passwords, without multifactor authentication.

Similarly, they’ve been able to alter the settings for water pumps and blower equipment to make them exceed their normal operating parameters, and were also able to max out set points, alter other settings, turn off alarm mechanisms, and change administrative passwords to lock out the WWS operators.

But while some victims experienced minor tank overflows, most victims reverted to manual controls in the immediate aftermath and were able to quickly restore operations.

"Without external assistance, we consider it unlikely that these groups have the capability to deliberately cause a destructive, rather than disruptive, impact in the short term," said the NCSC.

"But they may become more effective over time, and so the NCSC is recommending that organizations act now to manage the risk against successful future attacks."

Organizations should take immediate steps to improve their cyber security capabilities, according to security experts, by following official guidance for heightened security threats and advice on secure system administration.

"Cyber resilience should be the top priority for the NCSC, government and businesses, underpinning comprehensive cyber defense measures to combine reactive, preventative and recovery procedures," said Achi Lewis, area VP EMEA for Absolute Security.

"With cyber attacks being a case of when, not if, particularly when it comes to critical national infrastructure, it is vital that organizations ensure their endpoint devices are best protected against threats to best mitigate the threat and impact of a breach."

The National Cyber Security Centre (NCSC) has appointed Richard Horne as its new CEO, taking over from Lindy Cameron later this year.

As well as leading the NCSC, the UK’s national technical authority for cyber security, he will also become a board member of the UK’s spy agency, GCHQ.

His mission, he said, will be to increase the UK’s cyber resilience, particularly in light of future technology challenges such as AI and quantum computing. He will also seek to make sure the NCSC can carry on managing the most critical cyber incidents affecting the UK.

"It is an honour to become CEO of the NCSC. Over the seven years since its establishment, the NCSC has repeatedly shown its world-leading understanding of technology and its unparalleled knowledge of the cyber threat we face in the UK," says Horne. 

"I’m incredibly honoured and excited about leading a globally recognised organisation, its world class experts and leaders into the future whilst helping ensure that our mission is realised."

Unlike his predecessors, who both had a background in civil service, Horne has spent most of his professional life in cyber security. Currently, he chairs the cyber security practice at PWC and before that he was managing director of cyber security for Barclays. It was in that role that he got his first taste of working in the public sector when, in 2011, he was seconded to the Cabinet Office. There he helped shape and drive the government’s first Cyber Security Strategy across government and the wider economy.

Horne holds a PhD in Mathematics and Cryptography from Royal Holloway, University of London, and has served on a number of advisory boards for academic institutions and cyber security startup companies.

"I’m delighted that Richard Horne will become the next CEO of the NCSC. He brings with him a wealth of experience working with major companies and organisations to help them understand and manage their cyber security and respond to incidents when they occur," says GCHQ director Anne Keast-Butler. 

"Richard’s experience will ensure the NCSC continues to drive cyber security up the boardroom agenda and develop its world-leading partnerships to address the cyber security threats that the UK faces."

Recent initiatives from the NCSC include the release of new cyber guidance for small and medium businesses on how to use cloud and online services more securely, with practical advice on basic security measures that small businesses can readily use.

Earlier this year, it issued an invitation to security professionals to sign up as members of its new Cyber League initiative. The group will work with NCSC analysts to share their specialist knowledge and understanding of the threat landscape to develop techniques and strategies to counter cyber attacks.

The NCSC has issued guidance for organizations moving SCADA (Supervisory Control and Data Acquisition) systems into the cloud, as more companies are considering the shift.

These systems are used for running and monitoring industrial systems and processes everywhere from power stations to factory assembly lines and wind farms.

SCADA industrial control systems have been around for decades, but were rarely connected to the open internet, which kept them relatively protected from attack.

In recent years however, these systems have been connected to the internet to make them easier to access. With this shift, the NCSC believes there is evidence of a clear change in attitudes towards using cloud computing for these industrial applications.

“Where this has previously been a commonly dismissed topic due to the potential risks, many operational technology (OT) organizations are now looking to the cloud for solutions,” the security agency said. Operational technology refers to any hardware or software that runs or monitors industrial systems.

As a result, the NCSC has published new guidance on cloud-hosted SCADA systems, and said that cyber security should be a key consideration.

The agency said it would not dictate whether the cloud was the right or the wrong approach - but said cloud-hosted SCADA has some “unique” risks.

“The current state of play in OT can make the path to securely implementing a cloud migration challenging,” the NCSC warned.

Keeping SCADA systems safe is a particular concern because they often form the basis for control across critical national infrastructure (CNI) and other cyber-physical systems.

That means hacking into and meddling with a SCADA system can have dangerous real-world consequences, something that governments have been worried about for a number of years.

Critical infrastructure is at constant risk of targeted cyber attack, something that’s increased in the last couple of years. Last year, the NCSC warned that hackers backed by China have been making efforts to target critical infrastructure in the UK and elsewhere.

“This persistent and elevated threat means cyber security needs to be at the forefront of all decisions in both CNI and wider cyber-physical systems, and you should understand the challenges that a shift to the cloud will involve,” the NCSC said.

Protecting SCADA systems

The guidance lists some of the key considerations for moving SCADA into the cloud.

Large industrial control systems are often put in place for 20 or more years. While a cloud migration project means a chance to re-think those systems and make them more secure, it can also introduce risks by exposing legacy infrastructure to external threats it was never designed to deal with.

SCADA systems were often designed to be ‘air-gapped’, disconnected from the public internet and broader enterprise networks.

The agency also warned that firms need to consider how critical functions would be recovered in the event of a cloud (or cloud connectivity) outage.

“As with safety critical functions, organizations will need to consider break glass recovery solutions to ensure local control can be regained,” it said.

“Cloud migration should not be executed in isolation, and needs to be considered as part of the organization’s wider cyber security strategy.”

Organizations considering making the switch also need to consider the impact of other issues with operational technology, such as the reliance on legacy equipment, as well as on-premises and monolithic software packages.

They were urged to consider whether their SCADA software is even supported in a cloud deployment, the trust model between on-premise and cloud components and issues such as latency, as well as the sensitivity of the data that is being sent to the cloud.

“SCADA data is sensitive, and provides the necessary information required to control physical infrastructure. Ensuring that this data is adequately protected should be a priority both on-premises and in a cloud deployment,” the NCSC said.

The National Cyber Security Centre (NCSC) has released guidance specifically for CEOs aimed at helping them manage cyber security incidents.

According to the NCSC, resources and learning materials for executives on how to respond to a cyber attack are few and far in between, leaving many in the dark in the event of an incident.

The new guidance aims to provide detailed information on how executives can manage a cyber incident, as well as how to engage with staff and relevant authorities to remediate issues.

"If your organization is the victim of a significant cyber attack, the immediate aftermath will be challenging. You may find there is a lot of information in some areas, and none in others," the NCSC warns.

"There will be difficult risk-based decisions to make to protect your operations. Your aim will be to limit the impact on your business, clients and staff in the weeks and months which follow."

Here are seven things every CEO needs to know if their organization suffers a cyber attack. 

Governance is critical

The NCSC says organizations should consider appointing a Senior Responsible Officer, or using a broader governance command structure such as the bronze, silver, and gold model to assign overall responsibility for an incident. 

CEOs should make sure that there are structures in place to handle the full impact across the whole organization and make it easy for those managing the response to regularly come together to collaborate and confer on progress.

Similarly, the guidance recommended they should inform and empower senior decision-makers and work with regulators and insurers, providing updates to the board.

Bring in external resources

Organizations affected by a cyber attack often bring in third parties to help assess impact and identify key areas of focus during the remediation process, which the NCSC says is advised in most cases. 

The security center says it strongly advises using a cyber incident response (CIR) company to help recovery management.

For companies that have cyber insurance in place, their insurer may have in-house experts or preferred CIR firms that organizations can work with. The NCSC has its own list of approved companies, which executives can find via the center’s website.

Communicate with those affected

ICO guidance makes it clear that notifiable breaches must be reported to them ‘without undue delay’ and not later than 72 hours after becoming aware of it. Risks to data must also be reported to the data owners.

In terms of public messaging, the NCSC says communications should be factual and clear, and the incident shouldn't be misrepresented or downplayed.

"You might need to give a different level of detail to different groups – key decision-makers and stakeholders in your organization, wider staff, your partner organizations or communications to the public," the NCSC warned.

"Make sure you know in advance who needs to be brought into your communications planning."

Think twice before paying a ransom

While it's tempting to just pay up in the event of a ransom demand, the NCSC advises against this. 

As it points out, there's no guarantee that paying up will mean getting access to data or networks back. Research published by Cybereason earlier this year showed that companies who have previously paid ransoms are frequently targeted again as cyber criminals have evidence that they’re likely to comply.

The question of whether to pay a ransom has become a source of controversy across the security industry in recent months.

In January 2024, calls for an outright ban on ransom payments by a major security vendor prompted backlash from some in the community, with experts suggesting that it could risk “criminalizing victims”.

Consider team resilience and welfare

It's important to bear in mind the effect an incident can have on staff morale, with stress and uncertainty likely, according to the NCSC. 

Security incidents can take months to remediate, therefore it’s important to ensure that staff aren’t exhausted.

Stress and burnout among cyber security practitioners have been a long-running issue across the industry. Research last year showed that nearly half of senior cyber security staff were considering leaving the profession altogether.

Meanwhile, alternative research on working culture in the industry found that many practitioners frequently work longer hours, with some even missing important life events and canceling vacations due to work.

Review the lessons learned

The NCSC advises holding a debrief after any cyber security incident to try and identify how it came about. 

This, the guidance says, should be systemic in nature, rather than an exercise in assigning blame. Recent research specifically highlighted a ‘blame game’ culture as a leading cause of burnout and workforce discontent in the immediate wake of a cyber attack. A clear set of rules ahead of a cyber attack such as a data breach response plan can help prevent these pressures from becoming too great.

The NCSC says organizations should carry out a general cyber security review to help understand and manage vulnerabilities that could lead to further attacks. Leaders can also implement specific steps to protect against data breaches and establish a strategy for AI threats.

Report incidents

Finally, significant incidents should be reported to the NCSC and UK law enforcement who can provide support. 

The NCSC says this can be done using UK government signposting tools, which explain how organizations can notify relevant authorities based on the individual circumstances of the incident.

Law enforcement and agencies such as the Information Commissioner’s Office (ICO) and the NCSC frequently work with public and private sector organizations in the wake of a cyber attack or security incident.

The former chief executive of the UK's National Cyber Security Centre (NCSC) has called for the government to ban organizations from making ransomware payments.

Writing in The Times, Ciaran Martin, who served as the NCSC’s inaugural chief executive, suggested a ban could help put a stop to the ever-increasing proliferation of ransomware, referring to the 'apparently sanguine attitude' of British policymakers to cyber criminals groups.

"Ransomware is by far the most damaging cyber threat to most businesses right now. We have to find a way of making a ransom payments ban work," he wrote.

Martin suggested that any ban would need a better support network for affected companies. However, the lack of such a policy is in part down to the US' reluctance to introduce a ban amid concerns that it would unreasonably constrain businesses. 

Similar concerns have been raised that this could be a particular problem for the country's hospitals, many of which are in the private sector.

Currently, many governments, including the UK, have a policy that they won't pay ransoms themselves. In October 2023, 40 countries pledged their support for the International Counter Ransomware Initiative (CRI) as part of an effort to create a more aligned global approach to cyber crime.

Participating nations agreed not to make payments and pledged to share information and create a blacklist of digital wallets being used to deposit and move ransomware payments.

The official advice for UK-based companies is that they should not pay ransoms under any circumstances. The NCSC suggests that even when companies do so, there's no guarantee that they will get access to their data or systems back, that computers will still be infected, and that those who pay are more likely to be targeted in the future.

Across the cyber security community, there are mixed feelings about whether or not a ban should be introduced.

Oliver Norman, vice president for UK and Ireland at data management firm Veritas, said that regardless of a ban, the outcome of incidents will remain the same, with organizations more likely to be targeted in future and given no guarantees of having data safely returned.

"Whether banned or not, paying not only puts a target on the organization’s back for future attacks," he said. "There’s also no guarantee all of the data will be returned even if a payment is made – we estimate that 32% of businesses that paid ransoms still lost over half their data."

Others, though, believe that a ban is impractical.

"Banning ransomware payments can often have further implications – and this is not the first time this idea has cropped up. Although prevention is better than cure, there are still multiple cases where the only option has been to pay," said Jake Moore, global cyber security advisor at security firm ESET.

"Being stuck between a rock and a hard place is no position any company wants to be in but if the law is directed only one way, then companies can easily fold and the potential of livelihoods lost can make this a damming and forced decision."

Moore warned there is also a danger that driving ransom payments underground could lead to further demands, as well as criminalizing victims.

"Although the long term effects of banning ransom payments may sound idyllic, the path needed to navigate all companies to this ideal is going to be challenging, if not impossible," he said.

Moore's comments follow hefty criticism for cyber security firm Emsisoft in January after it called for an outright ban on ransomware payments. 

Emsisoft urged lawmakers to introduce legislation aimed at preventing firms from engaging with cyber criminals, but critics argued it would “shift the focus of criminality” from perpetrators to victims.

Currently, according to a recent report from data security and management firm Cohesity, more than nine-in-ten UK businesses have a no-pay policy - but virtually all of those that have fallen victim to a ransomware attack have in fact paid out.

The Russian hacking group known as APT29, Midnight Blizzard, the Dukes, or Cozy Bear is adapting its techniques to attack organizations' cloud-hosted environments.

The UK's National Cyber Security Centre (NCSC), along with Five Eyes partners the US, Australia, Canada and New Zealand, has issued an advisory about the threat.

"We are resolute in our commitment to exposing malicious cyber activity, which includes raising awareness of changes in the behavior of groups which persistently target the UK," said NCSC director of operations Paul Chichester.

"The NCSC urges organizations to familiarize themselves with the intelligence and mitigation advice within the advisory to help defend their networks."

The group is best known for the supply chain compromise of SolarWinds software in 2020, as well as the targeting of organizations involved in the development of the Covid-19 vaccine in the same year.

Linked to Russia’s Foreign Intelligence Service (SVR), it has tended to target think tanks, healthcare, and education organizations, many of which have moved to cloud-based infrastructure.

NCSC analysis shows it’s now expanding operations to target aviation, education, law enforcement, local and state governments, government financial departments, and military organizations.

As organizations move to the cloud, the group has been forced to move beyond its traditional means of initial access, such as exploiting software vulnerabilities in an on-premise network.

Instead, it's started targeting the cloud services themselves, which means successfully authenticating to the cloud provider.

Over the past 12 months, the NCSC said SVR-linked actors have been spotted stealing system-issuing access tokens to compromise victim accounts, enrolling new devices to the victim’s cloud environment via credential reuse from personal accounts, and targeting system accounts with password spraying and brute forcing.

Once initial access has been gained, the actor is then capable of deploying highly sophisticated capabilities, the NCSC warned, such as MagicWeb, spotted in 2022 targeting government organizations, NGOs, intergovernmental organizations, and think tanks across the US, Europe, and Central Asia.

These techniques are made possible by weak passwords and the absence of two-step verification - and the Five Eyes partners are advising organizations on how to stay safe.

Organizations should use multi-factor authentication (MFA) where possible, or failing that, strong, unique passwords; user and system accounts should be disabled when no longer required, and system and service accounts should implement the principle of least privilege.

The NCSC also suggested creating 'canary service accounts' that appear to be valid service accounts but are never used by legitimate services. In doing so, organizations can monitor these accounts to show if they’ve been compromised and are being used by threat actors.

Session lifetimes should be kept as short as practical, and device enrolment policies should be configured to only permit authorized devices to enroll.

"As the world modernizes their systems, we need to do all we can to reduce the attack surface for cyber actors to penetrate," said Rob Joyce, director of cybersecurity for the US National Security Agency (NSA).

The UK’s National Cyber Security Centre (NCSC), along with its Five Eyes allies, has issued a new warning to critical infrastructure operators about ‘living off the land’ attacks.

Together with cyber security agencies in the US, Australia, Canada, and New Zealand, the NCSC said in its advisory that state-sponsored actors have been exploiting native tools and processes built into computer systems to blend in with legitimate system and network behavior.

This, the NCSC said, can make their activity difficult to distinguish – even for organizations with more mature security postures.

"In this new dangerous and volatile world where the frontline is increasingly online, we must protect and future proof our systems," said deputy prime minister Oliver Dowden. "By driving up the resilience of our critical infrastructure across the UK, we will defend ourselves from cyber attackers that would do us harm."

The new guidance - an update to a warning issued last May - warns that state-sponsored attackers from China and Russia have been observed living off the land on compromised critical infrastructure networks.

It gives advice on how to identify living off the land activity, and to mitigate and remediate if a compromise is detected.

Priorities, it said, should include implementing logging and aggregate logs in an out-of-band, centralized location and establishing a baseline of network, user, and application activity, with automation used to continually review all logs and compare activity.

Organizations should also work to reduce alert noise, implement application allow listing, enhance network segmentation and monitoring, implement authentication controls, and make use of user and entity behavior analytics (UEBA).

"It is vital that operators of UK critical infrastructure heed this warning about cyber attackers using sophisticated techniques to hide on victims’ systems. Threat actors left to carry out their operations undetected present a persistent and potentially very serious threat to the provision of essential services," said Paul Chichester, NCSC director of operations.

"Organizations should apply the protections set out in the latest guidance to help hunt down and mitigate any malicious activity found on their networks."

Alongside this guidance, the five countries have also issued a separate advisory that shares specific details about China state-sponsored actor Volt Typhoon. This group has been observed using living off the land techniques to compromise US critical infrastructure systems, mainly in the communications, energy, transport and water and wastewater sectors.

"It’s clear the US has grown increasingly concerned about the threat Volt Typhoon exposes its critical infrastructure to and is working to disband the adversary," said Ian McGowan, managing director at Barrier Networks.

"All critical organizations across the world have migrated their operations to digital today, yet this has made them more vulnerable to attack. Gas facilities use automated tools to manage critical processes, while electrical plants rely on automated tools to control the electricity supply into peoples’ home.

“But, if attackers find a way to get access to these systems, they can shut down these key services, causing serious damage to a country and its citizens."

A team of university computer scientists has analyzed the messaging for a campus-wide mandatory password change in what is considered the first study of its kind to look at effective communications around password policies.

Researchers at the University of California San Diego teamed up with the campus’ Information Technology Services team to analyze the messaging for a campus-wide mandatory password change affecting almost 10,000 faculty and staff members.

They believe this is the first time that an empirical analysis of a mandatory password update has been conducted on this large a scale and in the wild, rather than as part of a simulation or controlled experiment.

Over the first four weeks of the campaign, faculty and staff at UC San Diego received four emails at roughly weekly intervals prompting them to change their single sign-on password. Those who still failed to act then got a prompt to do so as they logged in.

The emails were considered to be generally effective, with between 5% and 15% of users updating their passwords during each wave of emails. However, there were diminishing returns: even after four email prompts, a quarter of users still hadn't completed the update procedure.

Eight out of ten of these reluctant users, though, finally changed their passwords when they were prompted to do so at log-in.

"The active single sign on prompting was a big winner across the board," says the paper’s first author, Ariana Mirian. "You managed to get people who are stubborn – and maybe not paying attention – to take action, and that’s huge."

In what must have come as a relief – and despite concerns from the campus – the campaign did not generate a significant increase in tickets to the IT help desk. While ticket volume did increase by three to four times, tickets related to the password update only represented 8% of all requests.

The users who were slowest to carry out the update were those working in areas where they weren't required to log in to their computers regularly, such as maintenance, recreation, and dining services.

"Targeting such users earlier, or forgoing email reminders and using login intercepts from the start, or even using a different notification mechanism such as text messages, may be more effective," the researchers write.

Mandatory password change programs aren't always a good idea, with the UK's National Cyber Security Centre (NCSC) warning that it can be counterproductive. When users are forced to change their password, it says, the chances are that they'll pick something similar to the password they used before.

"The new password may have been used elsewhere, and attackers can exploit this too. The new password is also more likely to be written down, which represents another vulnerability," it says. 

"New passwords are also more likely to be forgotten, and this carries the productivity costs of users being locked out of their accounts, and service desks having to reset passwords."

Instead, the NCSC recommends using system monitoring tools that present users with information about the last login attempt, so they can see if they’re responsible for failed login attempts and report any issues for investigation.

"Initiatives such as this are far more likely to help keep systems safe, and much more manageable for the user," says the NCSC.

Two security jobs are up for grabs in possibly the poshest workplace in the UK - Buckingham Palace.

The Royal Household is advertising for a cyber security manager and an information security, privacy and records manager, working to reduce cyber risk and build resilience against cyber attacks.

Both jobs are based in the Privy Purse and Treasurer’s Office, and come with a good range of perks and benefits – including employee discounts at the royal shops.

"It’s developing your skills whilst pushing our systems forward," reads the cyber security manager ad. "And it's being a part of the professional business behind the Monarchy. This is what makes working for the Royal Household exceptional."

The job pays a relatively modest £75,000 for a 37.5-hour week, and involves heading up the royal household's cyber risk management strategy and cyber security framework delivery.

This means leading in-house teams working to reduce cyber risk and build resilience against cyber-attacks, as well as working with the enterprise architecture team to mature a secure by design culture.

Working with the National Cyber Security Centre (NCSC), the successful applicant will also work to upskill the wider digital services team and keep all employees on their toes in terms of security best practice.

The royal household is looking for a strong track record, with "significant experience in a cyber security role, with an understanding of information security frameworks and a proven ability to lead a cyber function and execute an enterprise-level security strategy, preferably within UK HMG."

Candidates will also need to be "able to review complex information systems and web applications, identify risks and recommend appropriate, pragmatic (and cost effective) solutions to mitigate those risks, as well as provide clear and concise advice to senior management".

Meanwhile, the information security, privacy and records manager will pull a slightly smaller salary – £70,000. They'll be responsible for developing and enhancing strategy, policies, and practices for data protection, records management and information security.

"With a relevant qualification in Information Security and Data/Records Management you’ll also have experience of managing a complex and varied portfolio of digital and physical records," reads the ad.

"Experience of team leadership, strategy development, risk and business analysis, and a deep understanding of relevant technical best practice. Knowledge of ISO 27001 would be an advantage."

The Royal Household is, of course, a rather high profile target, and any breaches could be dangerous as well as embarrassing.

Last October, the Royal Family website went down for an hour and a half, thanks to a denial of service (DoS) attack. No systems were compromised, nor any data breached, said the palace. The pro-Russian hacktivist group KillNet took responsibility for the attack on its Telegram channel.

Three local councils in Kent have been hit by cyber attacks that have severely disrupted services for communities in the region. 

Canterbury City Council, Thanet District Council, and Dover District Council confirmed they are investigating the incidents.

At present, it’s not known whether any personal data has been compromised in the incidents. However, all three local authorities said they have taken precautions to contain the incidents, which has made certain parts of their websites inaccessible.

"We are working to resolve this as soon as possible and apologise for any inconvenience caused," said Thanet District Council.

The councils say they are working with the National Cyber Security Centre (NCSC) to establish what happened.

"Our teams are taking a precautionary approach while we work hard to investigate the problem and to minimise any disruption to our services. Our email system and website have been available throughout although some parts of the website may not quite work as intended," said Canterbury City Council.

"We are sorry for any inconvenience people may have experienced over the past few days and will provide updates as and when we have them."

Cyber attacks on local authorities have grown in both frequency and intensity in recent years, according to Trevor Dearing, director of critical infrastructure at security firm Illumio.

In 2023, for example, Kent County Council’s children’s department fell victim to a phishing attack when an officer clicked on a link from an email to reset their password.

Gloucester City Council was also severely affected by a 2023 cyber attack which resulted in more than £1 million in recovery costs.

"Attacks on the public sector are becoming more frequent and more pervasive, but the problem is cyber security funding isn’t rising in tandem,” he said.

“Investments in technologies that provide demonstrable gains in cyber resilience must be prioritized."

Last year, a report from software provider TechnologyOne found that six-in-ten senior leaders at UK councils said their approach to cyber security is 'outdated', but that they couldn't afford the cost of a security breach.

Leo Hanna, UK executive vice president at TechnologyOne, said a concerted national effort to improve cyber security among local authorities should be prioritized.

"Systems held together by gaffer tape and chewing gum still deliver mission-critical services at local authorities across the country but they need to be urgently overhauled if they are to remain secure," he said.

The UK’s National Cyber Security Centre (NCSC) is inviting security professionals to sign up as members of its new Cyber League, an initiative aimed at working on some of the biggest security threats currently facing the country. 

The plan is to bring together a community of industry experts, working with NCSC analysts and with each other, to use their specialist knowledge and understanding of the threat landscape to develop techniques and strategies to counter future attacks.

Members will take part in a range of projects, the NCSC said, including analytics workshops and discussion groups on key trending issues.

Paul Chichester, director of operations at the security agency, said the initiative will draw on the combined strengths of the country’s cyber industry and institutions to improve national resilience.

"Cyber defence is a giant, complex and ever-changing puzzle, with critical knowledge, skills and innovation spread widely across industry and government,” he said. .

"Only through working together can we achieve our collective aim of making the UK the safest place to live and work online."

Raj Samani, SVP and chief scientist at Rapid7 said the announcement marks a positive step for the UK cyber security landscape, and could play a critical role in ensuring broader national resilience.

“With the current asymmetry of information among criminal threat groups and the cyber security industry, it’s great to see the NCSC taking proactive steps to promote the sharing of skills and information through the Cyber League initiative,” he said.

Samani said the industry has a tendency to get “bogged down too much in speculation about vulnerabilities and threats”, and therefore the launch of the scheme presents an opportunity for industry to collaborate more closely on mitigating threats.

“This new Cyber League will act as a great place to boost context-driven threat hunting and innovate how we tackle the rising problem of cyber security,” he added.

How the NCSC Cyber League will work

To take part in the Cyber League, an organization must have a 'substantial' UK connection and be part of the cyber security or threat intelligence industry, according to the NCSC. 

Up to three individuals in an organization can sign up to participate providing they have the “relevant cyber experience and knowledge".

Participants will be required to pass security checks, and will also have to have been a resident in the UK for the last five consecutive years.

The NCSC said the aim of the initiative is to be as flexible as possible when it comes to membership. Anyone can take part, even if they can't commit much time, as long as they still have experience and knowledge to share that can bring operational benefit.

Most members, though, are likely to come through the Industry 100 (i100) secondment program.

This involves secondees working across a wide range of placements on a part-time basis, ranging from one day a week to one day a month. Participating organizations continue to pay the salary of their staff members while on secondment, in order to maintain independence.

There are currently 127 placements from 87 organizations, with 200 secondments to date. Participating organisations get the opportunity to challenge and help shape government thinking on cyber issues, build a network of professional contacts across government and the wider cyber security community, and gain a greater understanding of how a central government department works.

"i100 brings together public and private sector talent to challenge thinking, test innovative ideas and enable greater understanding of cyber security – one of the most important issues of our time," the NCSC said.

"In i100, we are bringing industry and government expertise together to help us all learn lessons, identify systemic vulnerabilities and reduce the impact of cyber attacks."

The UK's National Cyber Security Centre (NCSC) has released new cyber guidance for SMBs on how to use cloud and online services more securely.

Concerned that smaller businesses may be overwhelmed by its existing cloud security guidance - aimed squarely at IT professionals and containing a lot more technical details - the NCSC said it wants to help SMBs avoid falling victim to cyber attacks.

"Many SMEs already rely on online services for day-to-day tasks, even if they’re not aware of it. This includes email and instant message communications, cloud storage, website/shop hosting, online accounting and invoicing, or simply using social media to engage with customers," said Amelia H of the NCSC's economy and society team.

"If you rely on any of these services, it’s important that they are set up in such a way that they’re safe from online risks, whilst also reflecting your organization’s priorities."

The new guidance offers practical advice on basic cyber security measures that small businesses can employ to protect themselves amid heightened threats.

It recommends checking to make sure that cloud services are configured in such a way that they are safe from common cyber attacks. " Reputable service providers make it easy for you to do this," the NCSC said.

Organizations should make sure that all their essential data is exported and backed up, and that they know how to access and restore it. While some cloud services keep a copy of deleted files for a short period, this shouldn't be relied on, according to the NCSC, and organizations should keep their own independent copy.

The cyber security center also offered fresh advice on how to keep domain names secure.

"If your public domain name was set up with a personal email account, you should change this so that it is now managed by an account under your organization’s control, such as a work email account," the NCSC said.

Organizations are also warned not to allow staff to use personal accounts for work activities or the other way round, nor to allow accounts to be shared. Accounts should be secured using two-factor verification, with unique, unguessable passwords. Admin accounts should have similar protection, and should only be created when necessary.

NCSC warns of growing malware threats

The NCSC also detailed additional advice on avoiding malware for small businesses amid an uptick in incidents over the last year. Devices should be kept up to date and protected, the guidance reads, and only trusted devices should be used to log into work accounts.

"The amount of trust you want in a device should be based on what it will be able to do and access. For example, users should only use a device that they know has been kept up to date and protected when logging into admin and staff accounts," the guidance reads.

"Similarly, your organization may choose whether to allow users that only have limited access to log in from a personal device as long as you trust them and they trust their device."

Organizations should make sure they make full use of cloud services' built-in security features, such as filtering out malicious messages and files and accessing services via a web browser or a dedicated mobile or desktop app.

Finally, there's advice on how to spot the signs and compromise and how to recover a hacked account or service, including step-by-step guides for Google Workspace and Microsoft 365.

"Our new guidance will help SMEs use online services more securely, so that they’re less likely to be the victim of a cyber attack," said Amelia H.

Every business is a potential target for cyber attacks, but hackers choose targets in some industries more than others. The most targeted industries for cyber attacks often include firms operating in “critical” sectors like energy, health, and finance which are targeted by both for-profit hacking groups and state-backed adversaries aiming to do damage to international rivals.

Other industries are targeted because of the lucrative information they hold – retail is a top target for cyber attacks and law firms are often singled out for the same reason. Meanwhile government agencies, councils, and educational establishments often find themselves in hot water due to under-investment and lack of understanding of the importance of security. 

Three industries stand out as key targets in the first half of 2023: technology, energy and education, according to recent analysis by Gatewatcher. 

Gatewatcher CEO Jacques de la Riviere tells ITPro that schools and universities “suffer from a significant and recurring lack of resources, investment, and staff – and they offer criminals a lot of return”. 

“There is access to a database of student and teacher accounts, confidential information that could be resold and technological and engineering data at research establishments.”

Why critical national infrastructure is targeted for cyber attacks

Firms operating in so-called critical national infrastructure (CNI) sectors such as energy, water, transport, and health can find themselves at the top of the cyber-attack target list, with former National Cyber Security Centre (NCSC) chief Ciaran Martin having warned that CNI is the next big ransomware target in March 2023. Financial institutions, cryptocurrency exchanges, and fintech organizations are also considered a prime target, says James McQuiggan, security awareness advocate at KnowBe4. “These organizations handle large amounts of financial information, including sensitive data such as credit card numbers.”

The healthcare industry is also a popular goal for hackers partly because it handles information including medical records. “Cyber-criminals recognize that healthcare systems are maintained by the government or regulatory bodies and are sometimes challenged by slow-moving technological and implementation processes,” McQuiggan adds. 

Manufacturing and energy sectors are vulnerable to hacking and McQuiggan describes how they are more likely to be singled out by hackers. “Year after year, manufacturing organizations are a top target for nation states as they work to disrupt, damage, or destroy manufacturing, energy, and other critical infrastructure organizations,” says McQuiggan.

Outside of CNI, online retailers and e-commerce sites also handle large amounts of sensitive customer data, making them vulnerable to attack. In some cases, the reason for attacks is obvious. Attacks on CNI sectors such as energy firms are “a very political act” that can cause physical damage, says Ian Thornton-Trump, CISO at Cyjax. 

Sectors that fall under this header, including energy and water firms, often use technology that was never meant to be connected to the internet, increasing the risk. It’s this exposure and the legacy technology they use that can cause “spectacular impacts” such as shutting down a critical power system, Thornton-Trump says. 

Stuxnet, the infamous computer worm that caused physical damage to Iran’s nuclear centrifuges in 2010, is a prime example. 

The threat state-sponsored groups pose to industries

Attackers themselves are a diverse bunch, spanning nation-states through to cyber-criminals and hacktivism groups. State-sponsored attackers are typically directed by national governments and often target “strategically essential industries”, such as manufacturing and energy organizations, says McQuiggan.

Philip Ingram MBE, a former senior British Military Intelligence officer, describes how different nation-state adversaries target businesses. “International entities linked to nation-state priorities are themselves a potential target.”

One nation-state adversary to look out for is Iran, says Ingram. “It has a huge cyber capability but this is focused on specific areas: the first is Saudi Arabia and any infrastructure linked to the Saudi government including large corporations such as the oil giant Aramco.“

Iran also focuses on US defense targets, as well as CNI and financial institutions, Ingram adds. Meanwhile, Russia aims to have a disruptive political impact, targeting CNI, healthcare and financial institutions, says Ingram. “The aim is to create upset and undermine current government activity, leading to political pressure being applied.”

Chinese cyber attacks tend to focus on victims that offer a technical and therefore economic advantage. “Universities, research institutes, large technology, pharma companies, defense industries, and economic institutions are all high priority targets for Chinese cyber activity”, Ingram explains.

At the same time, North Korean cyber attacks typically aim for financial institutions and crypto firms, says Ingram. When it comes to individual North Korean groups, a famous example from is Lazarus, which targets organizations in the financial industry and is known for the WannaCry cyber attack that laid waste to the NHS and is still wreaking havoc today. 

The BlackCat ransomware gang, also known as ALPHV,  is notorious for targeting companies in the financial, legal, and professional services industries, says Kevin Curran, senior IEEE member and professor of cyber security at Ulster University. “The group uses a combination of advanced techniques in attacks. They initially infiltrate networks using the Emotet botnet and Log4Shell vulnerability and redirect users to malware-laden pages via hijacked legitimate websites.”

Regulating to protect the most-targeted industries 

Given the number of specific targets for attack, it’s no surprise that regulation is emerging covering the security of critical sectors. For example, firms operating in Europe should be looking out for the Network and Information Security 2 (NIS2) directive and the Digital Operational Resilience Act (DORA). 

“NIS2 focuses on stepping up cyber security risk management and incident reporting across critical sectors in the EU, while DORA zeroes in on the financial sector and its supply chain, demanding better handling and reporting of IT risks,” says Cliff Martin, head of cyber incident response at GRCI Law.

Among its stipulations, the NIS2 Directive places the onus on organizations to adopt protective measures, share information on cyber threats, and comply with stricter supervisory requirements, says McQuiggan.

Beyond regulation, highly-targeted industry sectors should implement a robust cyber security strategy to safeguard their organization against threats, says David Emm, principal security researcher at Kaspersky.

In addition, he says, organizations need to fortify network and endpoint security, encrypt sensitive data, and “continuously monitor for potential threats, utilizing threat intelligence sources to stay informed”.

For high-risk sectors, a layered approach to security is crucial, agrees Martin. “It’s vital that organizations are confident in their ability to detect and handle incidents as well as to prevent them. This means regular risk assessments, thorough employee training, solid incident response strategies and investing in cutting-edge security tech.”

A global crackdown on ransomware payments is underway after a coalition of forty nations signed an agreement designed to stop digital extortionists. Part of the International Counter Ransomware Initiative, the no ransoms pledge aims to address ransomware attacks globally, with plans to leverage artificial intelligence (AI) and enhance information-sharing capabilities among nations. 

The Initiative will see countries designing platforms to share information on digital payment accounts and wallets associated with ransomware. The idea is to make it easier to trace the accounts used by criminals and prevent the transfer of funds.

Global organizations including the UK’s National Cyber Security Centre (NCSC) and US Federal Bureau of Investigation (FBI) already advise against paying ransoms, but many firms still pay up.

As the new crackdown on ransomware ramps up across the globe, what are the rules now – and what can firms do to avoid paying the ransom?

Crackdown on public sector ransomware payments

The Initiative does not directly impact private firms, as it focuses on government organizations and agencies. However, the overall aim is to increase collaboration between the public and private sectors and discourage payments by all organizations, says Javvad Malik, lead security awareness advocate at KnowBe4.

In doing so, the initiative hopes to make things difficult for ransomware-as-a-service operators and their business model. The agreement sets the stage for governments to collaborate more closely with each other to attack the problem from multiple angles, says Daniel Clayton, VP of security operations at Expel. This includes measures such as analyzing the blockchain to identify funding for ransomware and track and capture extortionists. 

The initiative also aims to boost information sharing between member governments, he says, a step towards the kind of information-sharing framework for which experts in the space have long called. Recent developments such as the information sharing agreement between the European Union Agency for Cybersecurity (ENISA) and US Cybersecurity and Infrastructure Security Agency (CISA) may complement this.

Of course, no firm wants to pay the ransom but the reality is often complex. It is not illegal unless the payment is made to a sanctioned entity, says Picus researcher Huseyin Can Yuceel. “Many businesses weigh the financial losses and legal repercussions of the attack and choose to pay the ransom as an unforeseen cost.”

But there are also multiple risks associated with paying ransoms. There is no way of knowing for certain if the attackers will honor the agreement and provide the decryption key, says Matt Roach, head of International information integrity institute (i-4) cyber security leaders community at KPMG UK. “Nor is there a guarantee that they won’t attack the company again. There are numerous instances of repeat victimization by different groups of cyber-criminals once word gets around that a particular company is a ‘cyber-soft touch’.”

At the same time, there are important ethical considerations to bear in mind, says Roach. “There is a risk that the money paid to cyber-criminals will be used for organized crime, human trafficking, terrorism, or other illegal activities.”

Recent Trend Micro research found that ransomware payments could fund up to ten new attacks, with researchers warning that ransomware groups can escalate attacks using payments from just a few victims.

Roach adds that law enforcement is closing in on cyber crime and that this should also be something businesses take into consideration. “Several governments are now imposing sanctions on cyber criminals. Hence, you might be breaking the law if you intend to acquiesce to their demands for payment.”  

In February 2023 the UK government issued sanctions against members of Ryuk and Conti, ransomware groups known for attacks victims including Sopra Steria and the government of Costa Rica respectively. The US Department of Justice (DoJ) has also charged three members of Lockbit, the group behind the most dangerous ransomware strain and known for attacks such as the February 2023 Royal Mail cyber attack which cost the firm £10 million ($12.58 million) in remediation costs.

While you shouldn’t pay unless you have to, for private companies it is still a business decision. There is a need to weigh up the pros and cons of cost, reputational damage linked to a data breach, and downtime with the risks associated with paying the ransom and the potential mitigation of cyber insurance, says Clayton. “It is a reality that if a company has not been sufficiently diligent with response planning, they may have no choice but to make the payment.”

Richard Breavington, partner at international law firm RPC describes how his firm has dealt with cases where organizations have had to pay a ransom due to encryption of their main servers. “This meant that they were unable to carry out business and as a result, were suffering ongoing and unsustainable losses to revenue and commercial reputation that could only be remedied through getting their data back.”

Another firm needed to delay the publication of sensitive commercial information.  “In one case, the publication of data relating to a sensitive corporate agreement could have jeopardized the deal at the time. Once the deal was complete, the sensitivity decreased considerably, but the ransom payment to delay imminent data release was considered necessary by the client.”

Negotiating with attackers over ransomware payments

Whether a firm pays in the end or not, it is often necessary to negotiate with attackers. If they need to do so, organizations shouldn’t go it alone. First and foremost, consult with your legal team before and during any negotiation, says Clayton. He recommends using a well-regarded third-party ransomware negotiation service to interact with attackers, especially if you plan to pay. 

Of course, the ideal outcome is to avoid paying the ransom at all – something backed up by all the advice from experts and governments. 

Organizations are better off investing money that would be paid to a ransomware adversary in improving their security, says Allan Liska, threat intelligence analyst at Recorded Future. “Invest in better backup capabilities, as well as more effective data management. Because of the way ransomware attacks have evolved, where data exfiltration is integral to an attack it can be just as important to know where your data is, both locally and in cloud environments, and how it is being secured at all times good backups and other effective security steps.”

Businesses should remember the basics to help mitigate ransomware risks, says Adam Harrison, managing director in the cybersecurity practice at FTI Consulting. “Identify what and where critical data is and make sure it is properly protected; ensure backups are complete, offline, and tested; and employ multi-factor authentication (MFA) wherever possible.”

In addition, Malik advises patching vulnerable software and providing security awareness training to employees. No business can escape this threat altogether, with small business ransomware attacks on the rise as attackers exploit the lower security budgets and outdated software of smaller businesses for financial gain.

The global ransomware crackdown is likely to expand as the data-locking malware continues to be a part of many modern cyber-attacks. The new agreement is about discouraging payments, rather than banning them, to try and disrupt the ransomware business model for good. For now, experts agree that collaboration between companies and the public sector is key – and paying the ransom should only be a last resort.

As ransomware evolves, it is vital that organizations anticipate how stolen data could be used for secondary crime and fraud, says Roach. “Place additional cyber security measures around the data that would cause the greatest embarrassment or damage in the hands of enemies.”

The National Cyber Security Centre (NCSC) has launched its new Cyber Incident Exercising scheme, with the aim of helping organizations to carry out cyber incident response exercises. 

First announced in August 2023, the scheme involves cyber security not-for-profit CREST and certification organization IASME as the delivery partners for the scheme, managing assessments and bringing the assured exercising service providers on board.

"In some respects, there is no difference between our delivery partners – both will adhere to the NCSC’s strict standards for assessing technical and organizational capability," said Catherine H, NCSC's head of assured professional services schemes, industry assurance.

"However, the model each is using for the processes of onboarding, ongoing management and off-boarding of suppliers is different. Having two delivery partners means potential providers have two routes to apply for membership of the CIR Level 2 scheme and can choose whichever is best for their business."

Inside the NCSC Cyber Incident Exercising scheme

The NCSC Cyber Incident Exercising scheme gives organizations access to approved service providers that will create bespoke, structured table-top or live-play cyber incident exercises. 

It's designed to complement the NCSC’s free Exercise in A Box tool, which allows organizations to test their incident response against a host of generic cyber incident scenarios.

"I’ve often said the first time you try out your cyber incident response plan shouldn’t be on the day you are attacked. So, if you do only one thing on a regular basis, incident exercising should be it," said NCSC director of operations Paul Chichester.

"Exercising in a safe and supportive environment will allow all the relevant teams and individuals to properly understand their roles and maximize their effectiveness during an incident. In turn this will help to minimize harm and improve the resilience of both individual organizations and the UK as a whole."

However, the scheme doesn't cover category 1 and category 2 incidents, as defined by the UK cyber incident categorization system.

Category 1 incidents are national cyber emergencies causing sustained disruption to the UK’s public services or affecting national security, and leading to severe economic and social impacts or deaths.

Meanwhile, Category 2 incidents are those with a 'serious impact' on central government, essential public services, a large proportion of the population, or the economy. In both these cases, there would be a coordinated government response.

Instead, the scheme is designed to simulate incidents that have a significant impact on a single client organization.

According to IASME, the scheme is primarily aimed at private sector organizations, charities, local authorities, and smaller public sector organizations which operate in the UK.

Companies can access services through a portal of approved providers, the NCSC said.

"We are determined that companies of any size can apply to join any of our schemes. We particularly welcome companies located in or serving geographically remote or under-represented areas," the NCSC said.

"Similarly, if your company is working hard to address issues of under-representation in the cyber security workforce, we’d love to see your application."

The UK's National Cyber Security Centre (NCSC) has warned of the active exploitation of Unitronics programmable logic controllers (PLCs), used extensively across the water sector.

The statement follows a similar alert from the US Cybersecurity & Infrastructure Security Agency (CISA) earlier this week, with the NCSC recommending that organizations should follow its guidance.

"The NCSC has warned for some time of the enduring threat to the UK’s critical national infrastructure," says Jonathon Ellison, NCSC director for national resilience and future technology.

"Our US counterparts, CISA, have issued an advisory outlining a threat against the water sector. We are notifying UK providers of this threat, and recommend they protect consumers by following the mitigation advice set out by CISA."

Water and waste water facilities use PLCs to control and monitor various processes, including turning on and off pumps to fill tanks and reservoirs, flow pacing chemicals to meet regulations, gathering compliance data for monthly regulation reports, and announcing critical alarms to operations.

While the NCSC says that the exploitation is of ‘limited sophistication’ and is highly unlikely to cause any disruption to water supplies, there is a potential risk to some small suppliers.

The CISA advisory follows an attack on an unidentified US water facility, in which the attackers appear to have accessed the affected device — a Unitronics Vision Series PLC with a Human Machine Interface (HMI) — by exploiting poor password security and exposure to the internet.

The facility, says CISA, immediately took the system offline and switched to manual operations, meaning that there was no known risk to the drinking water or water supply.

But to prevent other attacks, it says, users should change all default passwords on PLCs and HMIs, require multifactor authentication for all remote access, including from the IT network and external networks, and disconnect the PLC from the open internet.

They should also back up the logic and configurations on any Unitronics PLCs to enable fast recovery, where possible utilize a TCP port other than the default TCP 20256 port and update PLC/HMI to the latest version.

The alert follows a recent NCSC report that warned that the UK’s critical sectors, including the water industry, are facing an 'enduring and significant’ threat.

"The last year has seen a significant evolution in the cyber threat to the UK – not least because of Russia’s ongoing invasion of Ukraine but also from the availability and capability of emerging tech," says NCSC CEO Lindy Cameron.

"Beyond the present challenges, we are very aware of the threats on the horizon, including rapid advancements in tech and the growing market for cyber capabilities."

In summer last year, South Staffs Water fell victim to hackers who were able to access the names and addresses of account holders, along with the sort codes and account numbers used for direct debit payments. Shortly after, a ransomware group claimed it was possible to tamper with water supplies.

And in the US, there have been a number of attacks, including the breach of a water authority near Pittsburgh which affected the water pressure in nearby towns. The attack is believed to have been carried out by hacktivists aligned with the government of Iran.

The UK’s National Cyber Security Centre (NCSC) has raised concerns over the rising possibility of AI-supported cyber attacks against critical national infrastructure (CNI) targets.

In its annual review, the security center warned that state-aligned threat actors are accelerating attempts to disrupt critical targets, such as hospitals or organizations operating in the energy sector. 

The NCSC pointed toward a range of tactics employed by threat actors, including ransomware and DDoS attacks, as well as the spread of misinformation to create chaos across the UK. 

“2023 has seen the addition of state-aligned actors to the ongoing threat from state actors, as a new and emerging cyber threat to CNI,” the review states. 

“While the cyber activity of these groups often focuses on DDoS attacks, website defacements, and/or the spread of misinformation, some have stated a desire to achieve a more disruptive and destructive impact against western CNI.”

The report further warned that the use of generative AI tools among threat actors could pose heightened threats to infrastructure targets across the country. 

“Our adversaries - hostile states and cyber criminals - will seek to exploit AI technology to enhance existing tradecraft,” it said. 

“In the short term, AI technology is more likely to amplify existing cyber threats than create wholly new ones, but it will almost certainly sharply increase the speed and scale of attacks.”

Threats to CNI have been rising in recent years. A UK government report in August suggested that a successful attack against a target could wreak havoc on-par with a chemical or biological warfare attack. 

Andy Kays, CEO of Socura, a Cardiff-based security firm that works with CNI providers such as NHS trusts, said attacks on infrastructure targets have been escalating and have the potential to cause widespread national disruption. 

"Attacks on UK banks, hospitals and energy providers have all increased in recent years, especially since the start of the Ukraine war," he said. 

"These are typically well-resourced organizations, but they are prime targets for adversaries who are seeking to cause maximum disruption. The UK can always do more to protect these critical assets."

Ransomware still a potent threat

Ransomware still remains a pervasive and potent threat to critical national infrastructure, according to the NCSC, with threat actors now switching tactics to include double extortion techniques. 

Double extortion techniques differ from a traditional ransomware approach by both exfiltrating and encrypting stolen data, providing the threat actor with an additional degree of leverage to demand payments.

The NCSC warned that Russian-speaking threat actors have been observed conducting these style of attacks to great success in recent months.

Kevin Curran, IEEE senior member and professor of cyber security at Ulster University said the Colonial Pipeline attack in May 2021 still serves as a reminder of the devastating impact such an attack could have on CNI. 

"Ransomware remains one of the biggest threats to critical national infrastructure. Attacks have increased tenfold and in severity,” he said. 

“Consider the more recent attack in May 2021 on the Colonial pipeline in the US which runs from Houston to New Jersey and controls 50% of the fuel supply in North America.

"It revealed the damage ransomware can pose to vital national infrastructure and public services, which seem to be the main target at present, as it causes the most disruption."

AI election meddling 

AI-based cyber threats were a common recurring talking point in the NCSC’s annual review, with the center warning that countries such as Russian, China, or Iran may use the technology to interfere in elections. 

According to the report, the rise of AI and geopolitical pressures are putting UK electoral processes at risk. 

NCSC chief executive Lindy Cameron said geopolitical threats have been rising rapidly since the Russian invasion of Ukraine in February 2023, and warned that the country can expect to see additional threats in the coming years. 

"The last year has seen a significant evolution in the cyber threat to the UK – not least because of Russia’s ongoing invasion of Ukraine, but also from the availability and capability of emerging tech," she said.  

"Beyond the present challenges, we are very aware of the threats on the horizon, including rapid advancements in tech and the growing market for cyber capabilities."

The UK government has said it's almost certain that Russian actors attempted to interfere with the 2019 general election. And, with the next set to take place before the end of January 2025, the NCSC warned that the changing geopolitical situation has made the prospect of influencing the political discourse ever more attractive.

The center warned threat actors will “almost certainly” harness large language models (LLMs) to generate election disinformation, which could then be spread by AI-created hyper-realistic bots. 

Simon Thompson, head of data science and AI at digital transformation firm GFT said the prospect of AI-generated misinformation is a serious concern given the current maturity of technologies designed to mitigate these threats.

"As it stands, the technology that is being used to assess and flag AI-made content, both positive and negative, has not yet matured as much as we would have hoped to prevent this content from reaching its intended audiences," he said.

"This means that election commissions and those charged with protecting the sanctity of the electoral process will have to focus on the impact that the technology could have on the democratic process and seek ways to combat it." 

The review also highlights a new trend of malicious actors targeting the personal email accounts of high-profile and influential individuals involved in politics. 

This warning from the NCSC follows a campaign conducted by Chinese-linked threat actors earlier this year which saw email correspondence belonging to US State Department officials exposed.  

The UK’s National Cyber Security Centre (NCSC) has announced its new chief technical officer (CTO) as Ollie Whitehouse, a veteran of the cyber security sector.

Whitehouse has spent the past 27 years in the private sector, having most recently held the role of CTO at NCC Group. 

Throughout his time at NCC Group Whitehouse stressed the importance of fruitful public-private partnerships when it comes to cyber security. 

He praised the work of the NCSC in particular, describing it as a central player for the entire UK’s cyber resilience and the country’s place within the international cyber community. He also called for greater cross-sector information sharing, a goal he could pursue further in his new role.

"I’m honored to be starting as chief technology officer at the NCSC and look forward to supporting its world-class talent in their critical work keeping the UK safe online,” said Whitehouse.

“Having worked closely with the NCSC since its inception, I know how crucial its mission is and I am eager to contribute to our national security by addressing the collective challenges we face in maintaining our edge in cyberspace.”

In 2017 and 2022 Whitehouse gave testimony to the UK Parliament Joint Committee on the National Security Strategy. The session was centered on the threat posed to the UK by ransomware, and the dividing lines between groups motivated by profit and those with state backing.

Among the expert areas of discussion Whitehouse offered testimony on the rise of ransomware as a service (RaaS), as well as the motivations for threat actors and how smaller groups can obtain malware through the dark web.

Whitehouse will formally take up the role in October, at which point he will inherit responsibilities such as ongoing cyber support for Ukraine and incident response for smaller groups such as charities and other public sector organizations.

The UK’s National Cyber Security Centre (NCSC) and joint partners have issued a report into a new malware linked to the Sandworm group openly targeting Ukrainian military devices.

‘Infamous Chisel’ is an infostealer malware that was found targeting Android devices in use by Ukrainian military personnel on the front lines as a possible first step towards a wider-scale compromise of Ukrainian military networks.

Though the malware largely contains standard components implemented with intermediate sophistication, and was easily discovered via an investigation, researchers noted that Android has no automatic detection for attacks of this kind.

The authors also noted the overt nature of the campaign was matched by the serious danger associated with any exfiltration of sensitive Ukrainian military data. 

According to the NCSC, Infamous Chisel made little attempt to obscure its activities from security services but had been specially crafted to establish persistence on victims’ devices. 

The Security Service of Ukraine (SBU) discovered and eradicated the malware on Android tablets, and shared its findings with international partners.

“Since the first days of the full-scale war, we have been fending off cyber attacks of Russian intelligence services aiming to break our military command system and more,” said Illia Vitiuk, head of the SBU’s cyber security department.

“The operation we have carried out now is the cyber defense of our forces.”

The SBU first published a report on Infamous Chisel on 8 August, in which it stated that it was confident the APT group Sandworm was behind the malware campaign.

In the weeks after, the NCSC worked on analyzing the threat with international partners including the US Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA), New Zealand’s National Cyber Security Centre (NCSC-NZ), and the Canadian Centre for Cyber Security.

Paul Chichester, director of operations at the NCSC, noted that the campaign represents a new evolution in Russia’s ongoing cyber campaigns against Ukraine and its allies.

“The exposure of this malicious campaign against Ukrainian military targets illustrates how Russia’s illegal war in Ukraine continues to play out in cyberspace,” he said.

“Our new report shares expert analysis of how this new malware operates and is the latest example of our work with allies in support of Ukraine’s staunch defense. The UK is committed to calling out Russian cyber aggression and we will continue to do so.”

The NCSC has linked Sandworm to Russia’s Main Intelligence Directorate (GRU), specifically its Unit 74455 which is otherwise known as the Main Centre for Special Technologies GTsST.

Previously tracked by Microsoft as IRIDIUM, and now known under the name Seashell Blizzard, Sandworm is the main suspect behind the NotPetya attacks that in 2017 encrypted Ukrainian financial, energy, and government systems. 

The NCSC has also credited Sandworm with a 2018 attempt to breach UK Defence and Science Technology Laboratory (DSTL) systems, as well as widespread description of Georgian government websites.

In November 2022 the UK government specifically named Sandworm’s ‘Industroyer2’ malware as a strain of concern, and pledged to provide Ukraine with £6.35 million ($8 million) for cyber defense which has since been increased to up to £25 million ($32 million).

The Industroyer family targets industrial control systems (ICS) and is part of a wave of new threats against critical national infrastructure (CNI).

How does Infamous Chisel operate?

Infamous Chisel is made up of several main components named ‘netd’, ‘killer’, ‘blob’, and ‘td’ which all perform different functions.

‘Netd’ replaces the default binary of the same name within Android’s system directory, which allows it to achieve persistence. Its main function is to exfiltrate data, which it performs approximately once per day. It collects a wide range of file types, including .dat, .bat, .txt, and .xml. 

The component collects device information as well as any network and application data specific to the Ukraine military. It scans all networks available via the Transmission Control Protocol (TCP) ports approximately every two days, and collects network information as .tmp and .csv text files for exfiltration.

The SBU described some of its behavior as consistent with Russian intelligence activities, and the NCSC noted that network scanning of this kind suggests an intent for lateral attacks down the line.

Once collected, the malware uses the ‘blob’ and ‘td’ components to establish a connection with a hard-coded local IP via the open-source anonymous browser The Onion Router (Tor). The software package ‘dropbear’ maintains the threat actor’s remote access to the infected device via port 34371.

‘Killer’ is simply used to end ‘netd’ by remote threat actor command.

The SBU additionally identified a component named ‘stl’, through which the malware collects data on the device’s connection to the Starlink satellite constellation, as well as two components used to download additional Trojans.

Ukrainian forces have made extensive use of SpaceX’s Starlink since Russia’s invasion, to stay connected in areas with poor traditional connectivity. Its fleet of low-earth orbit (LEO) satellites has been a reliable platform for crucial networks, amid Russian missile and cyber attacks on other communications networks.

Initially provided to Ukraine for free, the New York Times has since reported that SpaceX has requested funds from the Department of Defense (DoD) to subsidize its operating costs and that Elon Musk has personally intervened to ‘geofence’ Starlink access within Ukraine. 

It’s possible that this has curtailed Ukrainian troops from accessing the internet via Starlink in regions under Russian occupation.

More than 50,000 students have been signed up for a UK government-run programme that aims to boost the cyber workforce by providing children with engaging courses on digital skills and cyber security.

Cyber Explorers is a series of free lesson plans and learning materials for young students run by the Department for Science, Innovation and Technology in collaboration with the National Cyber Security Centre (NCSC).

Webinars with prominent experts within the sector are also offered through the programme, with an upcoming session on coding led by Coding Black Females founder Charlene Hunter MBE and Teach the Nation to Code founder Shafeeq Muhammad.

The programme, which was launched in 2022, has now been taken on over 2,000 schools. It is aimed at key stage 2 and 3 students, with a particular focus on fostering cyber skills in 11-14-year-olds before they select their GCSEs.

Students are also given information through interactive quizzes and videos, ranging from broad cyber security skills to knowledge that could fire students’ interest in specific sectors or roles.

Broad topics covered include how to use command line interfaces, what the Internet of Things is, how to secure IoT to avoid network-threatening malware like Mirai, and a look at DDoS attacks.

More sector-specific guidance includes a lesson plan focused on industrial control systems (ICS) which are used throughout the energy, manufacturing, and telecommunications sectors.

Core skills for a new generation of workers

Matt Lorentzen, principal consultant at information security consultancy Cyberis, told ITPro that the programme would make an “excellent” introduction to cyber security roles for students and can foster inquisitiveness as well as provide a firm grip on key computing concepts.

“As we continue to build society on layers of technology, we will continue to need a workforce to implement, support and secure it,” he said.

“There is a significant shortage of people with the knowledge and areas of expertise and with the pace of change within technology, this gap will continue to widen. This initiative can introduce younger people to the technology around them which could serve to ignite a passion for technology and outline a career path. 

“Covering a broad range of topics such as IoT, malware analysis and incident response can introduce areas they may have not previously understood or considered. The earlier you can educate a potential "pipeline" of the workforce with foundational knowledge that then extends into more specialist areas of cyber security, the better for society.”

A recent UK government report found that approximately 50% of UK businesses have a gap in basic cyber security skills, while 33% have suffered from a lack of advanced security skills.

There are signs of growing interest in the field among young people. This year’s A-Level results show record computing degree uptake with 26,430 students accepted onto computing-related degrees, a rise of more than 10% since 2019.

Earlier in the year, the British Computer Society (BCS) reported that more than 92,980 18-year-olds had applied to start computing degrees in 2023, with record interest having been sparked by generative AI.

Diverting would-be hackers into cyber security roles

In addition to the positive skills taught through the lessons and material, the programme also aims to provide guidance for computing-inclined students who could go down the path of cyber crime without the proper support and teaching.

It is hoped that this could have the effect of reducing the number of cyber criminals in the UK in the long term, as well as providing these students with a viable career path within cyber security. The Cybersecurity and Infrastructure Security Agency recently called for similar measures to identify and guide at-risk juveniles to be implemented in the USA.

One lesson plan titled ‘City Saved - Cyber Choices’ provides a breakdown of the ethical and legal restrictions for using technology with a key focus on the Computer Misuse Act.

“Those students who have a natural tendency to want to test things and try to find "security holes" are more than likely unaware of the ramifications of performing unauthorised activities,” said Lorentzen.

“One strength of the programme is raising awareness of the computer misuse act and how people have a responsibility to govern their own activities whilst interacting with systems and resources online. Asking students to consider the types of crimes that are committed using a computer and orientating conversations around what they consider appropriate actions is a great way of highlighting how someone could breach this act.”

Schools, parents, and guardians have been urged to sign up for the programme for free on its dedicated website.

The UK’s National Cyber Security Centre (NCSC) has announced an expansion to its Cyber Incident Response (CIR) scheme in a move that has been welcomed by industry figures. 

In a statement on Wednesday, the authority revealed that it plans to introduce a new level of coverage through the scheme, meaning that more companies will be able to provide incident response services to a “wider range and larger number” of organizations across the country. 

The move is aimed specifically at providing support for charities, local authorities, smaller public sector organizations, and firms operating outside of critical national infrastructure, the NCSC said. 

In its prior setup, the CIR scheme focused on providing incident response services to organizations “running networks of national significance”. This applied to central government departments, critical national infrastructure organizations, and regulated industries. 

While this aimed to offer protection to organizations at high risk of targeted attacks by cyber criminals and nation-state-backed groups, many industry stakeholders were excluded from coverage due to their size. 

Chris Ensor, deputy director of cyber growth at the NCSC, said the expansion of the CIR will give confidence to a wider range of organizations at risk of cyber attacks. 

“Falling victim to a cyber attack is really stressful. Finding someone with the skills and knowledge to help can also be hard, if, like many, you are not familiar with the cyber security world,” he said. “For many years, we have Assured Cyber Incident Response services for organizations targeted by the most sophisticated threat actors.

“I am really pleased that we can now assure a similar service for any organizations affected by criminal threat actors, a service that will be good enough for the majority of incidents that smaller organizations face. The NCSC badge will give confidence that the company they use has the right expertise to help them.”

Joseph Carson, chief security scientist and advisory CISO at Delinea, welcomed the move, noting that the expansion of the scheme is a well-needed “refresh”. 

“The new update is an important and needed refresh that will provide all organizations with a service that will be relevant for most cyber security incidents, rather than a focus on purely organizations running networks of significance, such as central government, critical national infrastructure, and regulated industries,” he said. 

Growing cyber security threats

The move by the NCSC comes against a backdrop of heightened cyber security threats facing businesses across the UK. 

Third-sector organizations in particular have become lucrative targets for threat actors in recent years, representing easier prey than their private-sector counterparts, according to the NCSC’s own analysis. 

Statistics from the UK government’s data breach report, published in late 2022, found that 30% of UK charities were hit with a cyber attack across the year. 

87% of those reported experiencing phishing attempts, while nearly one-quarter (23%) were subjected to ransomware attacks. 

The UK’s Electoral Commission has warned that hostile actors have accessed voter data, including names and addresses, belonging to anyone registered to vote in elections between 2014 and 2022.

The attackers gained access to full names, addresses, and the date on which a person achieves voting age – which is 18 for UK parliamentary elections.

The attackers also had access to the commission’s email and control system as well as the names of those registered as overseas voters, but not their addresses, since the organization doesn’t hold this data. Personal data contained in the email system was also affected and includes name, email, address, telephone numbers, and any personal images along with webform data.

The Information Commissioner’s Office (ICO) risk assessment doesn’t suggest that exposing such personal by itself puts individuals at high risk, given much of this information is already in the public domain. But combined with other pieces of information, it could be used to identify or profile individuals.

Webform data or email attachments, meanwhile, could potentially contain sensitive information such as medical or personal financial details.

No group has claimed responsibility for the attack at the time of writing. The Electoral Commission has reported the incident to the National Cyber Security Centre, and said it notified the ICO within 72 hours of identifying the breach.

The fact that systems were first accessed in August 2021, more than a year before suspicious activity was identified, suggests the cyber criminals were patient and possibly surveilling internal operations.

The commission has been quick to reassure voters that the data can’t be used to interfere with the UK’s electoral process, and insisted the exposed data isn’t enough to impersonate a voter under current rules. But the stolen data could help fuel future attacks and other forms of fraud, according to Matt Aldridge, principal solutions consultant at OpenText Cybersecurity.

“If a nation-state actor was at work here, this data could be used to boost any influence campaigns they are running against UK targets in an effort to support that nation’s competitive agenda,” he said.

The potential theft of name and home addresses could be used to contribute to targeted social engineering attacks, for example. Aldridge urged organizations to learn from this breach, check their defenses, and ensure staff are trained in cyber security best practices.

“Rather than viewing data protection as a box-ticking exercise,” he continued, “it should be a key priority and integrated into every aspect of an organization.”

The commission hasn’t disclosed how it became aware of the attack, but said it’s been implementing a number of mitigations: “We have strengthened our network login requirements, improved the monitoring and alert system for active threats and reviewed and updated our firewall policies.”

Cyber criminals are favoring the exploitation of older vulnerabilities more so than recently disclosed flaws.

That’s according to the latest security advisory from the UK’s National Cyber Security Centre and its equivalent partners in the Five Eyes alliance.

On Thursday, it made public a list of the top 12 most commonly exploited vulnerabilities in 2022, many of which appeared in the previous year’s list.

The findings offer insight into the strategies behind cyber criminal activity, highlighting the apathy organizations are evidently taking towards patching security flaws affecting their software and equipment.

“This advisory reinforces one of the foundational aspects of cyber security, said Lisa Fong, deputy director-general at New Zealand’s National Cyber Security Centre. 

“Malicious actors continue to succeed using the same techniques over and over. I can’t emphasize enough the importance of doing the basics well by understanding your assets, and rapidly applying patches when they become available. Acting on CVE reporting is the difference between getting onto your to-do list and getting onto someone else’s to-do list.”

Attackers generally experienced the greatest exploit success in the first two years following a vulnerability’s public disclosure. 

The value of these vulnerabilities gradually decreases as organizations patch or upgrade software.

The advice from the security agencies is to apply patches in a timely manner, thus forcing attackers to seek other - potentially more costly - avenues of attack. These include developing zero-day exploits or conducting software supply chain attacks.

Failing to swiftly apply patches means attackers can scan for the number of exposed systems to any given vulnerability, giving them information on its value for attacks. 

If security issues go unpatched by many organizations, it can motivate attackers to develop exploitation tools that enable faster attacks. These tools can be sold to other cyber criminals and they can be used for years if the vulnerability remains unpatched.

The most routinely exploited vulnerabilities of 2022 are:

• CVE-2018-13379: Affect Fortinet SSL VPNs and was exploited as far back as 2020. Its continued presence on the list is an indicator that many organizations have thus far failed to apply available patches
• CVE-2021-34473, CVE-2021-31207, and CVE-2021-34523 - also known as ProxyShell: Affect Microsoft Exchange email servers
• CVE-2021-40539: A remote code execution flaw in Zoho ManageEngine ADSelfService Plus that first saw exploitation in late 2021 and into 2022
• CVE-2021-26084: A vulnerability in Atlassian’s Confluence Server and Data Center collaboration tools. Mass exploitation of this vulnerability was attempted in late 2021, according to the NCSC advisory
• CVE-2021-44228, also known as Log4Shell: Affect Apache’s Log4j library. It was first disclosed at the end of 2021, but the NCSC noted high interest in the vulnerability from attackers throughout the first half of 2022
• CVE-2022-22954 and CVE-2022-22960: Vulnerabilities in VMware’s products that allowed for remote code execution, privilege escalation, and authentication bypass. Exploits were noted at the beginning of 2022 and continued throughout the year

Also exploited in 2022 were CVE-2022-30190 - a vulnerability impacting the Microsoft Support Diagnostic Tool, CVE-2022-26134 - a critical remote code execution vulnerability in Atlassian Confluence and Data Center, and CVE-2022-1388 - a vulnerability permitting attackers to bypass iControl REST authentication on F5 BIG-IP application delivery and security software.

“Today, adversaries commonly exploit categories of vulnerabilities that can and must be addressed by technology providers as part of their commitment to secure by design,” said Eric Goldstein, executive assistant director for cyber security at CISA. 

“Until that day, malicious actors will continue to find it far too easy to exploit organizations around the world. With our partners, we urge all organizations to review our joint advisory, for every enterprise to prioritize mitigation of these vulnerabilities, and for every technology provider to take accountability for the security outcomes of their customers by reducing the prevalence of these vulnerabilities by design.”