UK’s cyber security agency warns of ‘sophisticated’ threat from Chinese hackers
GCHQ’s cybersecurity agency has warned that Chinese hackers pose a “highly sophisticated and skilled” threat to the UK.
The warning comes after the National Cyber Security Center (NCSC) recorded a 50% increase in “highly significant” online incidents by criminals and government-linked groups by the end of August.
The NCSC said attacks on well-known names such as Marks and Spencer, Co-op and Jaguar Land Rover showed the real-world impact of cyber attacks.
At the launch of the NCSC’s annual review, security minister Dan Jarvis said all Britons needed to “step up” and play their part in protecting the country online.
He said: “Cybercrime is one of the biggest threats to our economy, to our businesses, to the livelihoods of our people, and while the Government is providing greater cybersecurity support, we cannot do this alone.
“We need businesses to lead the way by making cybersecurity a top priority.
“And we need citizens to take action and take personal responsibility for their cybersecurity.”
He warned that “any organization of cowards hiding behind keyboards could have a devastating effect” and that they were “just as happy to hack the NHS and nurseries as they are multi-billion pound corporations”.
As well as online criminals launching ransomware attacks to demand money from companies or individuals, the UK is also a target of hostile states, either directly or through groups operating at arm’s length from authorities in Beijing, Moscow, Tehran and Pyongyang.
The NCSC’s annual review said: “State actors continue to pose a significant threat to UK and global cybersecurity, aided by a thriving cyberattack industry.
“As threats intensified, our incident management team faced a record number of nationally significant incidents.”
The report said:
– China is a “highly sophisticated and capable threat actor targeting a wide range of sectors and institutions around the world, including the UK”.
– While Russia is a “skilled and irresponsible threat actor in cyberspace,” pro-Moscow “hacktivist” groups operating outside official state control are seeking to target the United Kingdom, Europe, the United States and other NATO countries in retaliation for Western support for Ukraine and Israel.
– Iran’s activities are largely focused on the Middle East, but the NCSC assesses it is “highly likely” that UK organizations could be potential targets for Tehran-linked hackers following a US warning that Iranian state-sponsored or affiliated cyber activity could threaten critical infrastructure.
– North Korea’s “prolific and skilled” hacking activity is mainly aimed at increasing revenue, gathering intelligence and offsetting the impact of international sanctions, while undercover IT workers in Kim Jong Un’s country are “almost certainly” targeting UK firms by posing as third-country freelancers.
NCSC chief Richard Horne said: “We know that our adversaries combine cyber means with physical methods to achieve their goals.
“Last month, agencies from 13 countries came together to warn that three China-based technology companies were executing a malicious global cyberattack targeting critical networks on behalf of the host country.”
Alongside the warning in August of this year, the NCSC and its allies in September 2024 uncovered a secret network operated by a China-affiliated company called Integrity Technology Group, or Flax Typhoon, with a botnet of 260,000 compromised devices worldwide.
NCSC’s experts also worry that hostile states are “pre-positioning” for attacks on infrastructure, including deploying IT workers who can attack targets at short notice.
The NCSC’s report comes as the risk China poses to the UK comes under intense political scrutiny following the collapse of an alleged spying case, and a decision on Beijing’s application to build a major new embassy in the heart of London.
The NCSC report warned that hackers, including those with links to Beijing, were using artificial intelligence (AI) to increase the power of their attacks.
“Actresses affiliated with China, Russia, Iran, and North Korea are using large language models to evade detection, support reconnaissance, manipulate leaked data, access systems through social engineering, and support vulnerability research and exploit development,” the NCSC warned.
In the year to the end of August, NSCS provided support in 429 cases; of these, 204 were deemed “events of national significance”; This was an increase from 89 cases in the previous 12 months.
Of these, 18 were classified as “extremely important”; This means they have serious impacts on the government, essential services, the economy or large parts of the UK population.
