In July, the National Cyber Security Centre (NCSC), in partnership with numerous foreign cyber agencies, issued a joint advisory alerting the public to a so-called ‘zero-click’ email scam. Its origin? A Russia-backed hacking group called ‘Laundry Bear.’

According to the advisory, Laundry Bear had released an exploit targeting users of the Zimbra Collaboration software suite, which powers 200m mailboxes around the world. By contrast to standard phishing, which requires clicks to take effect, users had only to view a compromised email to spark an attack. Once triggered, it attempts to exfiltrate the last 90 days of the victim’s emails, their organisation’s entire email directory and other confidential information, the advisory stressed.

The agencies warned that the exploit was “almost certainly” designed to gather sensitive data for the Russian Federation and that it was “very likely” that Laundry Bear would target other email systems.

Sure enough, on 29 July, US cyber security firm Proofpoint reported that the gang had launched a similar exploit focused on Outlook.

Destructive state-backed tactics

State-backed cyber crime is a major priority for NCSC. In a speech to this year’s CYBERUK conference in April, agency CEO Richard Horne said that while ransomware remains the biggest cyber threat to UK organisations, state-backed attacks from China, Russia and Iran are more advanced. For Horne, the rapid development of AI is adding to geopolitical tensions to create “a period of tumultuous uncertainty”.

Dray Agha, Senior Manager, Tactical Response, at cyber security specialists Huntress, confirms that China, Russia and Iran are of primary concern, alongside North Korea. “Attackers range from official intelligence units to private criminal groups operating with the blessing of their host states,” he says. “Their methods typically involve advanced phishing, exploiting vulnerable perimeter devices and moving through supply chains to steal intellectual property or deploy destructive malware.”

Craig Kennedy is partner and Head of Cyber Consulting at HF, a legal advisory firm to the insurance and commercial sectors. He points out that state-sponsored cyber crime increasingly accompanies or supports military action, with attackers typically disrupting communications and gathering intelligence to gain an edge ahead of conventional warfare. 

“State actors are often highly sophisticated, well-resourced and aggressive,” Kennedy says. “Their tactics include destructive attacks such as wiper malware, large-scale disruption of communications infrastructure, espionage, long-term network compromise and attacks designed to undermine critical services. Once those capabilities are deployed, their impact can be difficult to contain. Consequences are often felt well beyond the original target.”

Beware of legacy systems

Kennedy says that the UK’s critical infrastructure sectors – healthcare, energy, transport and communications – are the most vulnerable, as their disruption can have severe societal and economic impacts.

“A particular concern is operational technology (OT),” he points out. “Many critical infrastructure operators rely on legacy OT systems built to be functional and reliable rather than secure. Those systems are often difficult to update, and frequently incorporate Internet of Things (IoT) devices that can’t be secured in the same way as traditional IT systems. So, many organisations have large attack surfaces.”

But, Kennedy stresses, small and medium-sized enterprises (SMEs)SMEs are under growing pressure to demonstrate resilience, as their larger counterparts ramp up cyber requirements on suppliers and third parties as part of their due diligence.

Agha shares that view. “SMEs are increasingly targeted because they serve as an easy entry point into larger and more secure supply chains,” he says. “Attackers know that smaller businesses often operate with limited security resources and lack dedicated teams. A state actor will happily compromise a local supplier just to steal credentials that grant access to a major corporate network.”

Plan for all eventualities

In Kennedy’s assessment, regardless of your organisational type, the foundations of building resilience to combat potential national threat actors are relatively straightforward:

“Organisations should address emerging risks from AI, which is rapidly expanding attack surfaces. Set clear governance around how AI platforms are used, where data is stored and what information employees are permitted to upload,” Kennedy advises.

In a statement, NCSC Director for National Resilience Jonathon Ellison said, “The potential operational and economic impact a successful cyber attack can have on an organisation has never been clearer. That is why we encourage all organisations to treat cyber security as a business-critical issue and urge all senior leaders to take ownership of cyber risk and resilience.”

He added, “NCSC is supporting organisations to strengthen their defences through practical guidance, training and services, and we encourage firms to get the basics right by adopting measures such as Cyber Essentials – or, for smaller and micro businesses, make use of the free Cyber Action Toolkit – to take simple, actionable steps to improve cyber security.”