An average of about four “nationally significant” cyberattacks were launched in the UK every week in the last year, twice as many as in the previous 12 months, according to the UK cyber agency’s latest annual review.
“Cyber is being used by state and non-state actors,” said the National Cyber Security Centre, “and the overall cyber threat to the UK is growing from an already high level.”
Where are the attacks coming from? Globally, around half of cyberattacks in 2024 may be attributed to financially motivated cybercriminals, while state-sponsored actors accounted for around a third, according to a report by Cognyte.
The “Big Four” – North Korea, Iran, Russia and China – are highest on the UK’s state actor list, said Politico. Three are considered “hostile states” and “Britain has an uneasy relationship with the latter”.
But a group of young, English-speaking hackers, who sometimes go by the name of Scattered Spider, claimed responsibility for the recent large-scale attacks on M&S and Jaguar Land Rover, although this hasn’t been confirmed.
How do the new hacking groups work? Ransomware is still one of the “most acute and pervasive cyberthreats” to the UK, said the National Cyber Security Centre. This was underscored in the attacks on British retailers this year, but most cybercriminals are “sector agnostic”. They target organisations that are vulnerable, hold sensitive data and are likely to pay a ransom.
One Russian group, Qilin, is “cementing its place as one of the most prolific ransomware-as-a-service operations in the world”, after an attack in Japan and the US, said Digit. It essentially “rents out” its malware and infrastructure to other hackers for a share of their ransom profits.
How are states using cyberattacks? Countries including Russia, Iran and China are “increasingly relying on criminal networks” to target political “adversaries”, said AP News. Security officials are reporting “growing collaboration” between governments and hackers, demonstrating “increasingly blurred lines” between state espionage and hackers motivated by financial gain.
Russia’s invasion of Ukraine, for example, has “inspired a growing number of pro-Russia hacktivist groups”, said the UK cyber agency. Without formal state control, they choose Western targets based on vulnerability, which “makes their activities less predictable”. |