This alert highlights the emerging risk posed by state-aligned adversaries following the Russian invasion of Ukraine.
Over the past 18 months, a new class of Russian cyber adversaries has emerged. These state-aligned groups are often sympathetic to Russia’s invasion and are ideologically, rather than financially, motivated.
Although these groups can align to Russia’s perceived interests, they are often not subject to formal state control, and so their actions are less constrained and their targeting broader than traditional cybercrime actors. This makes them less predictable.
While the cyber activity of these groups often focuses on DDoS attacks, website defacements, and/or the spread of misinformation, some have stated a desire to achieve a more disruptive and destructive impact against western critical national infrastructure (CNI), including in the UK. We expect these groups to look for opportunities to create such an impact, particularly if systems are poorly protected.
Without external assistance, we consider it unlikely that these groups have the capability to deliberately cause a destructive, rather than disruptive, impact in the short term. But they may become more effective over time, and so the NCSC is recommending that organizations act now to manage the risk against successful future attacks.
Recommendation
The NCSC recommends that organizations implement the measures described in actions to take when the cyber threat is heightened, particularly the NCSC advice on secure system administration.
As noted in the guidance, larger organisations could benefit from using the Cyber Assessment Framework (CAF) to help them identify areas for improvement. The CAF ‘indicators of good practice’ may be helpful here.
‘Heightened threat of state-aligned groups against western critical national infrastructure’, 2023, April 19, National Cyber Security Centre, Retrieved from URL www.ncsc.gov.uk
