NCSC warns of emerging threat to Critical National Infrastructure

In the alert, the NCSC – itself a part of GCHQ – warns that some groups have stated an intent to launch ‘destructive and disruptive attacks’' and that CNI organisations should ensure they’ve taken steps outlined in the NCSC’s heightened threat guidance to strengthen their defences. 

The threat emanates in particular from state-aligned groups sympathetic to Russia’s invasion of Ukraine and has emerged over the past 18 months. These groups are not motivated by financial gain or subject to control by the state. On that basis, their actions can be less predictable and their targeting broader than would be the case for traditional cyber crime-focused actors.

While in the short term any activity from the groups is likely to take the form of Distributed Denial of Service attacks, website defacements or the spread of misinformation, some groups have stated a desire to achieve a more destructive impact against infrastructure in the Western World, the alert suggests.

Intent to cause damage

Dr Marsha Quallo-Wright, deputy director for CNI at the NCSC, commented: “It has become clear that certain state-aligned groups are intent on causing damage to CNI organisations. It’s important that the sector is aware of this.”

Quallo-Wright continued: “In the wake of this emerging threat, our message to CNI sectors is to take sensible and proportionate steps now in order to protect themselves.”

In conclusion, Quall-Wright noted: “The NCSC has produced advice for organisations on steps to take when the cyber threat is heightened, and I would strongly encourage all CNI organisations to follow this advice now.”

The NCSC’s heightened threat guidance was published shortly before Russia’s invasion of Ukraine last year.