Threat Intel
75% of UK Critical Infrastructure Attacks Linked to Hostile States
NCSC Director‑General Richard Horne revealed that three‑quarters of cyber incidents against UK critical infrastructure in the past year were attributable to hostile state actors. The finding underscores the need for heightened vigilance and proactive defense. Defenders should prioritize threat intelligence, hardening, and incident response readiness.
What happened
During the RUSI Annual Security Lecture, NCSC Director‑General Richard Horne disclosed that 75 % of cyber attacks targeting UK critical infrastructure in the last 12 months were linked to hostile state actors.
“Three‑quarters of attacks… are linked to hostile states.” – NCSC CEO Richard Horne
Impact
These attacks spanned sectors such as energy, transport, water, and telecommunications, causing service disruptions, data exfiltration and operational delays. The scale indicates that state‑backed adversaries are increasingly focused on UK infrastructure.
What to do
Defenders should:
- Integrate threat‑intel feeds that flag state‑sponsored indicators.
- Ensure rapid patching of known vulnerabilities in critical systems.
- Implement network segmentation and strict access controls.
- Conduct regular tabletop exercises simulating state‑backed intrusion scenarios.
- Maintain an up‑to‑date incident‑response playbook that includes escalation to NCSC when a state actor is suspected.
Monitoring & Reporting
Use the NCSC’s Active Cyber Defence services and MyNCSC portal to report suspicious activity and stay informed about emerging threats.
Related articles
NCSC Briefing: Assessing the Operational Risks of Commercial Cyber Proliferation
A new NCSC advisory details the growing risks posed by commercial cyber proliferation, highlighting the proliferation of spyware, hacking-as-a-service offerings, and the commercial zero-day exploit market. UK organizations and critical infrastructure face heightened exposure as advanced offensive capabilities become accessible to a broader range of threat actors. Defenders must adopt comprehensive threat modeling and robust endpoint monitoring to counter these sophisticated tactics.
Read briefing
FBI Seizes Domains Behind Chinese State‑Sponsored MicroScan & FishHub Tools
The FBI seized seven domains that supported the Chinese state‑sponsored hacking tools MicroScan and FishHub, used by the Flax Typhoon group to scan and breach critical infrastructure worldwide. The tools were operated by Integrity Technology Group, a China‑linked contractor. Defenders should block the domains, monitor for scanning activity, and ensure patched systems to mitigate exploitation.
Read briefing
Cyber Storm X Marks Two Decades of National Cyber Readiness
CISA’s biennial Cyber Storm exercise hits its 20th year, drawing 2,000 participants from every corner of critical infrastructure. The 2026 drill simulates real‑world attacks on food, energy, and communications systems, sharpening response plans and cross‑sector teamwork.
Read briefing
Cisco Faces Multi‑Vulnerability Storm – Remote Code, Privilege Escalation & DoS
Cisco’s latest advisory reveals a cascade of flaws across ASA, FMC, FTD and ISE platforms. Several CVEs enable attackers to execute code remotely, elevate privileges, and trigger denial‑of‑service attacks. Notably, CVE‑2026‑76460 is actively exploited. Versions 3.2 and 3.1 of ISE are unsupported and lack patches for multiple critical bugs. Immediate patching and hardening are required to protect network infrastructure.
Read briefing